o
    h8-                     @   s  d Z ddlZddlZddlZddlZddlZddlZddlZddl	Zddl
ZG dd dejjZG dd dejjZG dd dejjZG d	d
 d
ejjZG dd dejjZG dd deZG dd deZG dd deZG dd deZejdZejdZejdZejdZejdZejdZejdZejdZejdZ ejdZ!eZ"eded ed!ed"ed#ed$ed%e d!ed"e!d&i
Z#G d'd( d(Z$G d)d* d*Z%G d+d, d,Z&d:d-d.Z'd/d0 Z(d;d2d3Z)	1d<d4d5Z*d6d7 Z+G d8d9 d9Z,dS )=zDNS TSIG support.    Nc                   @      e Zd ZdZdS )BadTimez8The current time is not within the TSIG's validity time.N__name__
__module____qualname____doc__ r	   r	   J/var/www/html/pro-man-master/venv/lib/python3.10/site-packages/dns/tsig.pyr           r   c                   @   r   )BadSignaturez#The TSIG signature fails to verify.Nr   r	   r	   r	   r
   r   $   r   r   c                   @   r   )BadKeyz2The TSIG record owner name does not match the key.Nr   r	   r	   r	   r
   r   (   r   r   c                   @   r   )BadAlgorithmz*The TSIG algorithm does not match the key.Nr   r	   r	   r	   r
   r   ,   r   r   c                   @   r   )	PeerErrorz;Base class for all TSIG errors generated by the remote peerNr   r	   r	   r	   r
   r   0   r   r   c                   @   r   )
PeerBadKeyz$The peer didn't know the key we usedNr   r	   r	   r	   r
   r   4   r   r   c                   @   r   )PeerBadSignaturez*The peer didn't like the signature we sentNr   r	   r	   r	   r
   r   8   r   r   c                   @   r   )PeerBadTimez%The peer didn't like the time we sentNr   r	   r	   r	   r
   r   <   r   r   c                   @   r   )PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNr   r	   r	   r	   r
   r   @   r   r   zHMAC-MD5.SIG-ALG.REG.INTz	hmac-sha1zhmac-sha224zhmac-sha256zhmac-sha256-128zhmac-sha384zhmac-sha384-192zhmac-sha512zhmac-sha512-256gss-tsig             0      @      c                   @   s0   e Zd ZdZdd Zdd Zdd Zdd	 Zd
S )GSSTSigaG  
    GSS-TSIG TSIG implementation.  This uses the GSS-API context established
    in the TKEY message handshake to sign messages using GSS-API message
    integrity codes, per the RFC.

    In order to avoid a direct GSSAPI dependency, the keyring holds a ref
    to the GSSAPI object required, rather than the key itself.
    c                 C   s   || _ d| _d| _d S )N    r   )gssapi_contextdataname)selfr   r	   r	   r
   __init__k   s   
zGSSTSig.__init__c                 C   s   |  j |7  _ d S N)r    r"   r    r	   r	   r
   updatep   s   zGSSTSig.updatec                 C   s   | j | jS r$   )r   get_signaturer    )r"   r	   r	   r
   signs   s   zGSSTSig.signc                 C   s&   z	| j | j|W S  ty   tw r$   )r   verify_signaturer    	Exceptionr   )r"   expectedr	   r	   r
   verifyw   s
   zGSSTSig.verifyN)r   r   r   r   r#   r&   r(   r,   r	   r	   r	   r
   r   a   s    	r   c                   @   s(   e Zd Zdd Zdd Zedd ZdS )GSSTSigAdapterc                 C   s
   || _ d S r$   )keyring)r"   r.   r	   r	   r
   r#      s   
zGSSTSigAdapter.__init__c                 C   sB   || j v r| j | }t|tr|jtkr|rt||| |S d S r$   )r.   
isinstanceKey	algorithmGSS_TSIGr-   parse_tkey_and_step)r"   messagekeynamekeyr	   r	   r
   __call__   s   

zGSSTSigAdapter.__call__c                 C   sV   z | |j|tjjtjj}|r|d j}|j}|	|W S W d S  t
y*   Y d S w )Nr   )
find_rrsetanswerdns
rdataclassANY	rdatatypeTKEYr6   secretstepKeyError)clsr6   r4   r5   rrsettokenr   r	   r	   r
   r3      s   
z"GSSTSigAdapter.parse_tkey_and_stepN)r   r   r   r#   r7   classmethodr3   r	   r	   r	   r
   r-      s
    
r-   c                   @   sv   e Zd ZdZeejeeje	ej
eej
dfeejeejdfeejeejdfeeji	Zdd Zdd Zd	d
 Zdd ZdS )HMACTSigzo
    HMAC TSIG implementation.  This uses the HMAC python module to handle the
    sign/verify operations.
    r         c                 C   s   z| j | }W n ty   td| dw t|tr,tj||d d| _|d | _ntj||d| _d | _| jj	| _	| jrL|  j	d| j 7  _	d S d S )NzTSIG algorithm z is not supportedr   )	digestmod   -)
_hashesrA   NotImplementedErrorr/   tuplehmacnewhmac_contextsizer!   )r"   r6   r1   hashinfor	   r	   r
   r#      s   

zHMACTSig.__init__c                 C   s   | j |S r$   )rQ   r&   r%   r	   r	   r
   r&      s   zHMACTSig.updatec                 C   s&   | j  }| jr|d | jd  }|S )N   )rQ   digestrR   )r"   rU   r	   r	   r
   r(      s   
zHMACTSig.signc                 C   s   |   }t||std S r$   )r(   rO   compare_digestr   )r"   r+   macr	   r	   r
   r,      s   zHMACTSig.verifyN)r   r   r   r   	HMAC_SHA1hashlibsha1HMAC_SHA224sha224HMAC_SHA256sha256HMAC_SHA256_128HMAC_SHA384sha384HMAC_SHA384_192HMAC_SHA512sha512HMAC_SHA512_256HMAC_MD5md5rL   r#   r&   r(   r,   r	   r	   r	   r
   rF      s     


rF   c                 C   s<  |o| }|rt |}|r|tdt| || |dus#J |td|j || dd  |rT||j  |tdtj	j
 |tdd |du r[|j}|d? d@ }|d@ }	td	||	|j}
t|j}|dkr{td
|r||j |
  |td|j||j  |S ||
 |S )zReturn a context containing the TSIG rdata for the input parameters
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    !HN   z!Ir   r   i  l    z!HIHz TSIG Other Data is > 65535 bytesz!HH)get_contextr&   structpacklenoriginal_idr!   to_digestabler:   r;   r<   time_signedfudgeother
ValueErrorr1   error)wirer6   rdatatimerequest_macctxmultifirst
upper_time
lower_timetime_encoded	other_lenr	   r	   r
   _digest   s6   



r   c                 C   s4   |rt | }|tdt| || |S dS )zIf this is the first message in a multi-message sequence,
    start a new context.
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    rh   N)rj   r&   rk   rl   rm   )r6   rW   rz   ry   r	   r	   r
   _maybe_start_digest   s   
r   Fc           	      C   s:   t | ||||||}| }|j||d}|t|||fS )a~  Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
    for the input parameters, the HMAC MAC calculated by applying the
    TSIG signature algorithm, and the TSIG digest context.
    @rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    )rp   rW   )r   r(   replacer   )	ru   r6   rv   rw   rx   ry   rz   rW   tsigr	   r	   r
   r(     s   	r(   c	                 C   s  t d| dd \}	|	dkrtjj|	d8 }	| dd t d|	 | d|  }
|jdkrZ|jtjjkr7t	|jtjj
kr@t|jtjjkrIt|jtjjkrRttd|j t|j| |jkrft|j|krmt|j|jkrutt|
||d|||}||j t||j|S )aF  Validate the specified TSIG rdata against the other input parameters.

    @raises FormError: The TSIG is badly formed.
    @raises BadTime: There is too much time skew between the client and the
    server.
    @raises BadSignature: The TSIG signature did not validate
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrh   
      r   rJ   zunknown TSIG error code N)rk   unpackr:   	exception	FormErrorrl   rt   rcodeBADSIGr   BADKEYr   BADTIMEr   BADTRUNCr   r   absrp   rq   r   r!   r   r1   r   r   r,   rW   r   )ru   r6   ownerrv   nowrx   
tsig_startry   rz   adcountnew_wirer	   r	   r
   validate  s0   $

r   c                 C   s"   | j tkr
t| jS t| j| j S )zReturns an HMAC context for the specified key.

    @rtype: HMAC context
    @raises NotImplementedError: I{algorithm} is not supported
    )r1   r2   r   r?   rF   )r6   r	   r	   r
   rj   <  s   

rj   c                   @   sJ   e Zd ZefdejjeB deeB dejjeB fddZ	dd Z
dd	 Zd
S )r0   r!   r?   r1   c                 C   sZ   t |trtj|}|| _t |trt| }|| _t |tr(tj|}|| _	d S r$   )
r/   strr:   r!   	from_textbase64decodebytesencoder?   r1   )r"   r!   r?   r1   r	   r	   r
   r#   J  s   



zKey.__init__c                 C   s.   t |to| j|jko| j|jko| j|jkS r$   )r/   r0   r!   r?   r1   )r"   rr   r	   r	   r
   __eq__Z  s   



z
Key.__eq__c                 C   sN   d| j  dd| j d }| jtkr!|dt| j  d7 }|d7 }|S )Nz<DNS key name='z', zalgorithm=''z
, secret='>)r!   r1   r2   r   	b64encoder?   decode)r"   rr	   r	   r
   __repr__b  s
   
zKey.__repr__N)r   r   r   default_algorithmr:   r!   Namer   bytesr#   r   r   r	   r	   r	   r
   r0   I  s    


r0   )NNNN)NNNF)NF)-r   r   rY   rO   rk   dns.exceptionr:   dns.name	dns.rcodedns.rdataclassdns.rdatatyper   DNSExceptionr   r   r   r   r   r   r   r   r   r!   r   rf   rX   r[   r]   r_   r`   rb   rc   re   r2   r   	mac_sizesr   r-   rF   r   r   r(   r   rj   r0   r	   r	   r	   r
   <module>   sf    
4$

&