o
    'h,                     @   s  d Z ddlZddlZddlZddlZddlZddlZddlZddl	ZG dd dej
jZG dd dej
jZG dd dej
jZG d	d
 d
ej
jZG dd dej
jZG dd deZG dd deZG dd deZG dd deZejdZejdZejdZejdZejdZejdZejdZejdZejdZejdZ eZ!eded ed!ed"ed#ed$ed%ed!ed"e d&i
Z"G d'd( d(Z#G d)d* d*Z$G d+d, d,Z%d:d-d.Z&d/d0 Z'd;d2d3Z(	1d<d4d5Z)d6d7 Z*G d8d9 d9Z+dS )=zDNS TSIG support.    Nc                   @      e Zd ZdZdS )BadTimez8The current time is not within the TSIG's validity time.N__name__
__module____qualname____doc__ r	   r	   D/var/www/html/olx_land/venv/lib/python3.10/site-packages/dns/tsig.pyr          r   c                   @   r   )BadSignaturez#The TSIG signature fails to verify.Nr   r	   r	   r	   r
   r   #   r   r   c                   @   r   )BadKeyz2The TSIG record owner name does not match the key.Nr   r	   r	   r	   r
   r   '   r   r   c                   @   r   )BadAlgorithmz*The TSIG algorithm does not match the key.Nr   r	   r	   r	   r
   r   +   r   r   c                   @   r   )	PeerErrorz;Base class for all TSIG errors generated by the remote peerNr   r	   r	   r	   r
   r   /   r   r   c                   @   r   )
PeerBadKeyz$The peer didn't know the key we usedNr   r	   r	   r	   r
   r   3   r   r   c                   @   r   )PeerBadSignaturez*The peer didn't like the signature we sentNr   r	   r	   r	   r
   r   7   r   r   c                   @   r   )PeerBadTimez%The peer didn't like the time we sentNr   r	   r	   r	   r
   r   ;   r   r   c                   @   r   )PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNr   r	   r	   r	   r
   r   ?   r   r   zHMAC-MD5.SIG-ALG.REG.INTz	hmac-sha1zhmac-sha224zhmac-sha256zhmac-sha256-128zhmac-sha384zhmac-sha384-192zhmac-sha512zhmac-sha512-256gss-tsig             0      @      c                   @   s0   e Zd ZdZdd Zdd Zdd Zdd	 Zd
S )GSSTSigaG  
    GSS-TSIG TSIG implementation.  This uses the GSS-API context established
    in the TKEY message handshake to sign messages using GSS-API message
    integrity codes, per the RFC.

    In order to avoid a direct GSSAPI dependency, the keyring holds a ref
    to the GSSAPI object required, rather than the key itself.
    c                 C   s   || _ d| _d| _d S )N    r   )gssapi_contextdataname)selfr   r	   r	   r
   __init__j   s   
zGSSTSig.__init__c                 C   s   |  j |7  _ d S N)r    r"   r    r	   r	   r
   updateo   s   zGSSTSig.updatec                 C   s   | j | jS r$   )r   get_signaturer    )r"   r	   r	   r
   signr   s   zGSSTSig.signc                 C   s&   z	| j | j|W S  ty   tw r$   )r   verify_signaturer    	Exceptionr   )r"   expectedr	   r	   r
   verifyv   s
   zGSSTSig.verifyN)r   r   r   r   r#   r&   r(   r,   r	   r	   r	   r
   r   `   s    	r   c                   @   s(   e Zd Zdd Zdd Zedd ZdS )GSSTSigAdapterc                 C   s
   || _ d S r$   )keyring)r"   r.   r	   r	   r
   r#      s   
zGSSTSigAdapter.__init__c                 C   sB   || j v r| j | }t|tr|jtkr|rt||| |S d S r$   )r.   
isinstanceKey	algorithmGSS_TSIGr-   parse_tkey_and_step)r"   messagekeynamekeyr	   r	   r
   __call__   s   

zGSSTSigAdapter.__call__c                 C   sV   z | |j|tjjtjj}|r|d j}|j}|	|W S W d S  t
y*   Y d S w )Nr   )
find_rrsetanswerdns
rdataclassANY	rdatatypeTKEYr6   secretstepKeyError)clsr6   r4   r5   rrsettokenr   r	   r	   r
   r3      s   
z"GSSTSigAdapter.parse_tkey_and_stepN)r   r   r   r#   r7   classmethodr3   r	   r	   r	   r
   r-      s
    
r-   c                   @   sv   e Zd ZdZeejeeje	ej
eej
dfeejeejdfeejeejdfeeji	Zdd Zdd Zd	d
 Zdd ZdS )HMACTSigzo
    HMAC TSIG implementation.  This uses the HMAC python module to handle the
    sign/verify operations.
    r         c                 C   s   z| j | }W n ty   td| dw t|tr,tj||d d| _|d | _ntj||d| _d | _| jj	| _	| jrL|  j	d| j 7  _	d S d S )NzTSIG algorithm z is not supportedr   )	digestmod   -)
_hashesrA   NotImplementedErrorr/   tuplehmacnewhmac_contextsizer!   )r"   r6   r1   hashinfor	   r	   r
   r#      s   

zHMACTSig.__init__c                 C   s   | j |S r$   )rQ   r&   r%   r	   r	   r
   r&      s   zHMACTSig.updatec                 C   s&   | j  }| jr|d | jd  }|S )N   )rQ   digestrR   )r"   rU   r	   r	   r
   r(      s   
zHMACTSig.signc                 C   s   |   }t||std S r$   )r(   rO   compare_digestr   )r"   r+   macr	   r	   r
   r,      s   zHMACTSig.verifyN)r   r   r   r   	HMAC_SHA1hashlibsha1HMAC_SHA224sha224HMAC_SHA256sha256HMAC_SHA256_128HMAC_SHA384sha384HMAC_SHA384_192HMAC_SHA512sha512HMAC_SHA512_256HMAC_MD5md5rL   r#   r&   r(   r,   r	   r	   r	   r
   rF      s     


rF   c                 C   s0  |o| }|rt |}|r|tdt| || |td|j || dd  |rN||j  |tdtj	j
 |tdd |du rU|j}|d? d@ }|d@ }	td	||	|j}
t|j}|dkrutd
|r||j |
  |td|j||j  |S ||
 |S )zReturn a context containing the TSIG rdata for the input parameters
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    !H   Nz!Ir   r   i  l    z!HIHz TSIG Other Data is > 65535 bytesz!HH)get_contextr&   structpacklenoriginal_idr!   to_digestabler:   r;   r<   time_signedfudgeother
ValueErrorr1   error)wirer6   rdatatimerequest_macctxmultifirst
upper_time
lower_timetime_encoded	other_lenr	   r	   r
   _digest   s4   



r   c                 C   s4   |rt | }|tdt| || |S dS )zIf this is the first message in a multi-message sequence,
    start a new context.
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    rh   N)rj   r&   rk   rl   rm   )r6   rW   rz   ry   r	   r	   r
   _maybe_start_digest   s   
r   Fc           	      C   s:   t | ||||||}| }|j||d}|t|||fS )a~  Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
    for the input parameters, the HMAC MAC calculated by applying the
    TSIG signature algorithm, and the TSIG digest context.
    @rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    )rp   rW   )r   r(   replacer   )	ru   r6   rv   rw   rx   ry   rz   rW   tsigr	   r	   r
   r(     s   	r(   c	                 C   s  t d| dd \}	|	dkrtjj|	d8 }	| dd t d|	 | d|  }
|jdkrY|jtjjkr7t	|jtjj
kr@t|jtjjkrIt|jtjjkrRttd|j t|j| |jkret|j|krlt|j|jkrttt|
||d|||}||j t||j|S )aF  Validate the specified TSIG rdata against the other input parameters.

    @raises FormError: The TSIG is badly formed.
    @raises BadTime: There is too much time skew between the client and the
    server.
    @raises BadSignature: The TSIG signature did not validate
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrh   
      r   rJ   zunknown TSIG error code %dN)rk   unpackr:   	exception	FormErrorrl   rt   rcodeBADSIGr   BADKEYr   BADTIMEr   BADTRUNCr   r   absrp   rq   r   r!   r   r1   r   r   r,   rW   r   )ru   r6   ownerrv   nowrx   
tsig_startry   rz   adcountnew_wirer	   r	   r
   validate  s0   $

r   c                 C   s"   | j tkr
t| jS t| j| j S )zReturns an HMAC context for the specified key.

    @rtype: HMAC context
    @raises NotImplementedError: I{algorithm} is not supported
    )r1   r2   r   r?   rF   )r6   r	   r	   r
   rj   :  s   

rj   c                   @   s(   e Zd ZefddZdd Zdd ZdS )r0   c                 C   sZ   t |trtj|}|| _t |trt| }|| _t |tr(tj|}|| _	d S r$   )
r/   strr:   r!   	from_textbase64decodebytesencoder?   r1   )r"   r!   r?   r1   r	   r	   r
   r#   H  s   



zKey.__init__c                 C   s.   t |to| j|jko| j|jko| j|jkS r$   )r/   r0   r!   r?   r1   )r"   rr   r	   r	   r
   __eq__S  s   



z
Key.__eq__c                 C   sN   d| j  dd| j d }| jtkr!|dt| j  d7 }|d7 }|S )Nz<DNS key name='z', zalgorithm=''z
, secret='>)r!   r1   r2   r   	b64encoder?   decode)r"   rr	   r	   r
   __repr__[  s
   
zKey.__repr__N)r   r   r   default_algorithmr#   r   r   r	   r	   r	   r
   r0   G  s    r0   )NNNN)NNNF)NF),r   r   rY   rO   rk   dns.exceptionr:   dns.name	dns.rcodedns.rdataclassr   DNSExceptionr   r   r   r   r   r   r   r   r   r!   r   rf   rX   r[   r]   r_   r`   rb   rc   re   r2   r   	mac_sizesr   r-   rF   r   r   r(   r   rj   r0   r	   r	   r	   r
   <module>   sd    
4#

&