/usr/lib/python3.9/site-packages/dns/__pycache__/
/usr/lib/python3.9/site-packages/dns/__pycache__
NameSizeModeActions
asyncbackend.cpython-39.opt-1.pyc26160644editdlrm
asyncbackend.cpython-39.pyc26160644editdlrm
asyncquery.cpython-39.opt-1.pyc178050644editdlrm
asyncquery.cpython-39.pyc178170644editdlrm
asyncresolver.cpython-39.opt-1.pyc129580644editdlrm
asyncresolver.cpython-39.pyc130020644editdlrm
dnssec.cpython-39.opt-1.pyc321600644editdlrm
dnssec.cpython-39.pyc321880644editdlrm
dnssectypes.cpython-39.opt-1.pyc16160644editdlrm
dnssectypes.cpython-39.pyc16160644editdlrm
e164.cpython-39.opt-1.pyc34520644editdlrm
e164.cpython-39.pyc34520644editdlrm
edns.cpython-39.opt-1.pyc147200644editdlrm
edns.cpython-39.pyc147340644editdlrm
entropy.cpython-39.opt-1.pyc33480644editdlrm
entropy.cpython-39.pyc33480644editdlrm
enum.cpython-39.opt-1.pyc32490644editdlrm
enum.cpython-39.pyc32490644editdlrm
exception.cpython-39.opt-1.pyc55180644editdlrm
exception.cpython-39.pyc57140644editdlrm
flags.cpython-39.opt-1.pyc22080644editdlrm
flags.cpython-39.pyc22080644editdlrm
grange.cpython-39.opt-1.pyc10890644editdlrm
grange.cpython-39.pyc11330644editdlrm
immutable.cpython-39.opt-1.pyc24280644editdlrm
immutable.cpython-39.pyc24280644editdlrm
inet.cpython-39.opt-1.pyc46030644editdlrm
inet.cpython-39.pyc46030644editdlrm
ipv4.cpython-39.opt-1.pyc18440644editdlrm
ipv4.cpython-39.pyc18440644editdlrm
ipv6.cpython-39.opt-1.pyc39380644editdlrm
ipv6.cpython-39.pyc39380644editdlrm
message.cpython-39.opt-1.pyc506310644editdlrm
message.cpython-39.pyc506720644editdlrm
name.cpython-39.opt-1.pyc350740644editdlrm
name.cpython-39.pyc350890644editdlrm
namedict.cpython-39.opt-1.pyc29860644editdlrm
namedict.cpython-39.pyc29860644editdlrm
nameserver.cpython-39.opt-1.pyc89080644editdlrm
nameserver.cpython-39.pyc89080644editdlrm
node.cpython-39.opt-1.pyc116050644editdlrm
node.cpython-39.pyc116050644editdlrm
opcode.cpython-39.opt-1.pyc24750644editdlrm
opcode.cpython-39.pyc24750644editdlrm
query.cpython-39.opt-1.pyc402980644editdlrm
query.cpython-39.pyc403430644editdlrm
rcode.cpython-39.opt-1.pyc32530644editdlrm
rcode.cpython-39.pyc32530644editdlrm
rdata.cpython-39.opt-1.pyc236090644editdlrm
rdata.cpython-39.pyc236090644editdlrm
rdataclass.cpython-39.opt-1.pyc27920644editdlrm
rdataclass.cpython-39.pyc27920644editdlrm
rdataset.cpython-39.opt-1.pyc154370644editdlrm
rdataset.cpython-39.pyc154510644editdlrm
rdatatype.cpython-39.opt-1.pyc66730644editdlrm
rdatatype.cpython-39.pyc66730644editdlrm
renderer.cpython-39.opt-1.pyc98220644editdlrm
renderer.cpython-39.pyc98410644editdlrm
resolver.cpython-39.opt-1.pyc524720644editdlrm
resolver.cpython-39.pyc526250644editdlrm
reversename.cpython-39.opt-1.pyc30550644editdlrm
reversename.cpython-39.pyc30550644editdlrm
rrset.cpython-39.opt-1.pyc78850644editdlrm
rrset.cpython-39.pyc78990644editdlrm
serial.cpython-39.opt-1.pyc29330644editdlrm
serial.cpython-39.pyc29330644editdlrm
set.cpython-39.opt-1.pyc87990644editdlrm
set.cpython-39.pyc87990644editdlrm
tokenizer.cpython-39.opt-1.pyc172420644editdlrm
tokenizer.cpython-39.pyc172560644editdlrm
transaction.cpython-39.opt-1.pyc202610644editdlrm
transaction.cpython-39.pyc202610644editdlrm
tsig.cpython-39.opt-1.pyc103810644editdlrm
tsig.cpython-39.pyc103810644editdlrm
tsigkeyring.cpython-39.opt-1.pyc18350644editdlrm
tsigkeyring.cpython-39.pyc18350644editdlrm
ttl.cpython-39.opt-1.pyc16800644editdlrm
ttl.cpython-39.pyc16800644editdlrm
update.cpython-39.opt-1.pyc88860644editdlrm
update.cpython-39.pyc88860644editdlrm
version.cpython-39.opt-1.pyc5630644editdlrm
version.cpython-39.pyc5630644editdlrm
versioned.cpython-39.opt-1.pyc87230644editdlrm
versioned.cpython-39.pyc87750644editdlrm
win32util.cpython-39.opt-1.pyc56530644editdlrm
win32util.cpython-39.pyc56530644editdlrm
wire.cpython-39.opt-1.pyc33270644editdlrm
wire.cpython-39.pyc33550644editdlrm
xfr.cpython-39.opt-1.pyc77710644editdlrm
xfr.cpython-39.pyc77890644editdlrm
zone.cpython-39.opt-1.pyc452680644editdlrm
zone.cpython-39.pyc454120644editdlrm
zonefile.cpython-39.opt-1.pyc176630644editdlrm
zonefile.cpython-39.pyc176870644editdlrm
zonetypes.cpython-39.opt-1.pyc10230644editdlrm
zonetypes.cpython-39.pyc10230644editdlrm
_asyncbackend.cpython-39.opt-1.pyc42080644editdlrm
_asyncbackend.cpython-39.pyc42080644editdlrm
_asyncio_backend.cpython-39.opt-1.pyc89840644editdlrm
_asyncio_backend.cpython-39.pyc90020644editdlrm
_ddr.cpython-39.opt-1.pyc40710644editdlrm
_ddr.cpython-39.pyc40710644editdlrm
_features.cpython-39.opt-1.pyc23670644editdlrm
_features.cpython-39.pyc23670644editdlrm
_immutable_ctx.cpython-39.opt-1.pyc21590644editdlrm
_immutable_ctx.cpython-39.pyc21590644editdlrm
__init__.cpython-39.opt-1.pyc6670644editdlrm
__init__.cpython-39.pyc6670644editdlrm
Edit: /usr/lib/python3.9/site-packages/dns/__pycache__/dnssec.cpython-39.pyc (32188B)
a Me@s<dZddlZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z mZmZmZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlmZmZm Z ddlm!Z!m"Z"m#Z#m$Z$ddl%m&Z&ddl'm(Z(dd l)m*Z*dd l+m,Z,dd l-m.Z.m/Z/dd l0m1Z1dd l2m3Z3m4Z4ddl5m6Z6edZ7edZ8e ej9j:ej;jedddZ?eee@fe>dddZAeee>eBe@fe@dddZCee*e&fe@dddZDGdddZEGdddeEZFeFejGejHejIejJhejGejHejIhejKejLejMhejKhZNeFeOeOeOeOZPeNZQdeeejRjSe>fejTjUeee>fe ejRjSe eEeVe,d!d"d#ZWdfeejRjSe>fejTjUeee>fe ejRjSe(d$d%d&ZXe ejRjSeejYjZej[j\ffe3e e e*d'd(d)Z]eej;je@eBfe eee>e@eBfe e@eVe eEe ejRjSe3d6 d7d8Zcdjeej;jfe@e@e*d=d>d?Zfe6jedfe@e@e&d=d@dAZgeejRjSe>fe ee>e_fe@ee@e>fe>dBdCdDZhdkeej;jfe ejRjSejYjZdEdFdGZiejYjZejYjZdHdIdJZjdleejRjSe>fejYjZeee>fe ejRjSejYjZdKdLdMZkejYjZejYjZdHdNdOZldmej9j:ej;je@eBfe eee>e@eBfe e@e eEe ejRjSddP dQdRZmdnejnjoe ej9j:e e ee8e*feVe e@e eee>e@eBfe eee>e@eBfe e@e e1e e=e eEddT dUdVZpdoejnjoej9j:e e=ddWdXdYZqdZd[Zrejstd\rdd]lumvZvdd^lwmxZxdd_lwmyZydd`lwmzZzddalwm{Z{ddblwm|Z|ddcl}m~Z~mZdddlmZmZebZeaZecZefZegZdSZnerZerZerZerZerZd ZejGZGejZejHZHejZejZejIZIejZejZejZejJZJejZejZejZejZejZejZejZdS)pz.Common DNSSEC-related functions and constants.N)datetime)CallableDictListOptionalSetTupleUnioncast) AlgorithmDSDigest NSEC3Hash)AlgorithmKeyMismatchDeniedByPolicyUnsupportedAlgorithmValidationFailure)CDNSKEY)CDS)DNSKEY)DS)NSECBitmap) NSEC3PARAM)RRSIGsigtime_to_posixtime)Flag)GenericPublicKeyzrsa.RSAPublicKeyzec.EllipticCurvePublicKeyzed25519.Ed25519PublicKeyzed448.Ed448PublicKey)GenericPrivateKeyzrsa.RSAPrivateKeyzec.EllipticCurvePrivateKeyzed25519.Ed25519PrivateKeyzed448.Ed448PrivateKey)textreturncCs t|S)zConvert text into a DNSSEC algorithm value. *text*, a ``str``, the text to convert to into an algorithm value. Returns an ``int``. )r from_text)rr!./usr/lib/python3.9/site-packages/dns/dnssec.pyalgorithm_from_textLsr#)valuercCs t|S)zConvert a DNSSEC algorithm value to text *value*, a ``dns.dnssec.Algorithm``. Returns a ``str``, the name of a DNSSEC algorithm. )r Zto_textr$r!r!r"algorithm_to_textWsr&cCsTt|trt|St|tr(t|St|tr:t|St|trH|StddS)z%Convert various format to a timestampzUnsupported timestamp typeN) isinstancerintZ timestampstrrfloat TypeErrorr%r!r!r" to_timestampbs     r,keyrcCs|}|jtjkr(|dd>|dSd}tt|dD](}||d|d>|d|d7}q7}||d?d@7}|d@Sd S) zReturn the key id (a 16-bit number) for the specified key. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` Returns an ``int`` between 0 and 65535 riN)to_wire algorithmr RSAMD5rangelen)r.rdatatotalir!r!r"key_idps &r=c@sTeZdZddZeedddZeedddZeeddd Z eedd d Z d S) PolicycCsdSNr!)selfr!r!r"__init__szPolicy.__init__)_rcCsdSNFr!r@rBr!r!r" ok_to_signszPolicy.ok_to_signcCsdSrCr!rDr!r!r"ok_to_validateszPolicy.ok_to_validatecCsdSrCr!rDr!r!r"ok_to_create_dsszPolicy.ok_to_create_dscCsdSrCr!rDr!r!r"ok_to_validate_dsszPolicy.ok_to_validate_dsN) __name__ __module__ __qualname__rArboolrErFr rGrHr!r!r!r"r>s r>cs\eZdZfddZeedddZeedddZeedd d Z eedd d Z Z S) SimpleDenycs&t||_||_||_||_dSr?)superrA _deny_sign_deny_validate_deny_create_ds_deny_validate_ds)r@Z deny_signZ deny_validateZdeny_create_dsZdeny_validate_ds __class__r!r"rAs  zSimpleDeny.__init__r-cCs |j|jvSr?)r6rOr@r.r!r!r"rEszSimpleDeny.ok_to_signcCs |j|jvSr?)r6rPrUr!r!r"rFszSimpleDeny.ok_to_validate)r6rcCs ||jvSr?)rQr@r6r!r!r"rGszSimpleDeny.ok_to_create_dscCs ||jvSr?)rRrVr!r!r"rHszSimpleDeny.ok_to_validate_ds) rIrJrKrArrLrErFr rGrH __classcell__r!r!rSr"rMs  rMF)namer.r6originpolicy validatingrc CsZ|dur t}zt|tr$t|}WntyDtd|Yn0|rR|j}n|j}||sdt t|t t fszt d|tj krt}n4|tjkrt}n |tjkrt}n td|t|trtj||}|}|dusJ||||j|d|} tdt||j|| } tj tj!j"tj#j$| dt%| } t&t$| S)aCreate a DS record for a DNSSEC key. *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``, the key the DS is about. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name, then it will be made absolute using the specified origin. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. *validating*, a ``bool``. If ``True``, then policy is checked in validating mode, i.e. "Is it ok to validate using this digest algorithm?". Otherwise the policy is checked in creating mode, i.e. "Is it ok to create a DS with this digest algorithm?". Raises ``UnsupportedAlgorithm`` if the algorithm is unknown. Raises ``DeniedByPolicy`` if the algorithm is denied by policy. Returns a ``dns.rdtypes.ANY.DS.DS`` Nunsupported algorithm "%s"zkey is not a DNSKEY/CDNSKEYrYz!HBBr)'default_policyr'r)r upper ExceptionrrHrGrrr ValueErrorSHA1hashlibsha1ZSHA256Zsha256ZSHA384Zsha384dnsrXr canonicalizer5updatedigeststructpackr=r6r:Z from_wire rdataclassIN rdatatyperr9r ) rXr.r6rYrZr[checkZdshashZwirerhZdsrdatadsr!r!r"make_dssB%             rp)rXr.r6rYrcCs0t||||}t|jtjj|j|j|j|jdS)aCreate a CDS record for a DNSSEC key. *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``, the key the DS is about. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if the algorithm is unknown. Returns a ``dns.rdtypes.ANY.DS.CDS`` rdclassrdtypekey_tagr6 digest_typerh) rprrrrermrtr6rurh)rXr.r6rYror!r!r"make_cdssrv)keysrrsigrcsR|j}t|tjjr0|tjjtj j }n|}|dur@dSfdd|DS)NcsLg|]D}|jjkrt|jkr|jtj@tjkr|jdkrtt|qS)) r6r=rtflagsrZONEprotocolr r).0Zrdrxr!r" 2s   z(_find_candidate_keys..) getsignerr'renodeNodeZ get_rdatasetrkrlrmr)rwrxr$rdatasetr!r~r"_find_candidate_keys(s  r)rrsetrcCs(t|tr|d|dfS|j|fSdS)Nrr3)r'tuplerX)rr!r!r"_get_rrname_rdataset<s r)sigdatar.rcCsDt|j}z||}Wnty2tdYn0|||dS)Nzinvalid public key)get_algorithm_cls_from_dnskey public_clsZ from_dnskeyrarverify)rrr.r public_keyr!r!r"_validate_signatureEs   r)rrxrwrYnowrZrc Cs|dur t}t||}|dur&td|dur6t}|j|krHtd|j|krZtdt|||}|D]B}||szqjzt|j ||WdSt tfyYqjYqj0qjtddS)aValidate an RRset against a single signature rdata, throwing an exception if validation is not successful. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsig*, a ``dns.rdata.Rdata``, the signature to validate. *keys*, the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative names. *now*, a ``float`` or ``None``, the time, in seconds since the epoch, to use as the current time when validating. If ``None``, the actual current time is used. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. Raises ``ValidationFailure`` if the signature is expired, not yet valid, the public key is invalid, the algorithm is unknown, the verification fails, etc. Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by dnspython but not implemented. Nz unknown keyZexpiredz not yet validzverify failure) r^rrtime expiration inception_make_rrsig_signature_datarFr signatureInvalidSignature) rrxrwrYrrZZcandidate_keysrZ candidate_keyr!r!r"_validate_rrsigNs*(      r)rrrsigsetrwrYrrZrc Cs|dur t}t|tr(tj|tjj}t|tr<|d}n|j}t|tr^|d}|d}n |j}|}||}||}||krt d|D]H} t| t st dzt || ||||WdSt t fyYq0qt ddS)aValidate an RRset against a signature RRset, throwing an exception if none of the signatures validate. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsigset*, the signature RRset. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *keys*, the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin*, a ``dns.name.Name``, the origin to use for relative names; defaults to None. *now*, an ``int`` or ``None``, the time, in seconds since the epoch, to use as the current time when validating. If ``None``, the actual current time is used. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. Raises ``ValidationFailure`` if the signature is expired, not yet valid, the public key is invalid, the algorithm is unknown, the verification fails, etc. Nrr3zowner names do not matchzexpected an RRSIGzno RRSIGs validated) r^r'r)rerXr rootrZchoose_relativityrrrr) rrrwrYrrZrrnameZ rrsignameZ rrsigrdatasetrxr!r!r" _validates2'        r) r private_keyrdnskeyrrlifetimerrZrYrc  Csx|dur t}||stt|trL|dj} |dj} |d} |dj} n|j} |j} |j} |j} |durvt |}n t t }|durt |}n|dur||}nt d| dur| | } t| d}| r|d8}t| tjj| |j|| ||t||dd }tj||| }t|tr&|}n4zt|}||d}WntyXtdYn0|||}tt|j|d S) aSign RRset using private key. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *private_key*, the private key to use for signing, a ``cryptography.hazmat.primitives.asymmetric`` private key class applicable for DNSSEC. *signer*, a ``dns.name.Name``, the Signer's name. *dnskey*, a ``DNSKEY`` matching ``private_key``. *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature inception time. If ``None``, the current time is used. If a ``str``, the format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text form; this is the same the RRSIG rdata's text form. Values of type `int` or `float` are interpreted as seconds since the UNIX epoch. *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature expiration time. If ``None``, the expiration time will be the inception time plus the value of the *lifetime* parameter. See the description of *inception* above for how the various parameter types are interpreted. *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This parameter is only meaningful if *expiration* is ``None``. *verify*, a ``bool``. If set to ``True``, the signer will verify signatures after they are created; the default is ``False``. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. *origin*, a ``dns.name.Name`` or ``None``. If ``None``, the default, then all names in the rrset (including its owner name) must be absolute; otherwise the specified origin will be used to make names absolute when signing. Raises ``DeniedByPolicy`` if the signature is denied by policy. Nr3rz(expiration or lifetime must be specified) rrrsZ type_coveredr6labels original_ttlrrrtrrr.zUnsupported key algorithm)r)r^rErr'rrrrsttlrXr,r(rra derelativizer9is_wildrrermr6r=dnssecrrrrr+signr replace)rrrrrrrrrZrYrrrsrrZrrsig_inceptionZrrsig_expirationrZrrsig_templaterZ signing_keyZ private_clsrr!r!r"_signsb5             r)rrxrYrcsttrtjtjj|j}|sDdur:td| }t |\}}d}||j |ddd7}||j |7}|sdurtd| }t |}|r|j|dkrtd|d|jkrtd n2|j|dkr||jdd}tjd |}| } td |j|j|j} fd d |D} t| D]6} || 7}|| 7}tdt | } || 7}|| 7}qF|S)aCreate signature rdata. *rrset*, the RRset to sign/validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsig*, a ``dns.rdata.Rdata``, the signature to validate, or the signature template used when signing. *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative names. Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by dnspython but not implemented. Nz,relative RR name without an origin specifiedrr]r2z&wild owner name has wrong label lengthr3z#owner name longer than RRSIG labels*z!HHIcsg|]}|qSr!) to_digestable)r}r:r]r!r"rrz._make_rrsig_signature_data..z!H)r'r)rerXr rr is_absoluterrrr5rr9rrsplitrirjrsrrrsorted)rrxrYrrrrZname_lensuffixZ rrnamebufZrrfixedZrdatasr:Zrrlenr!r]r"rUsB       rry)rr6rzr|rcCsDt|}t|tr"|j||dSt|j}||dj||dSdS)aConvert a public key to DNSKEY Rdata *public_key*, a ``PublicKey`` (``GenericPublicKey`` or ``cryptography.hazmat.primitives.asymmetric``) to convert. *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm. *flags*: DNSKEY flags field as an integer. *protocol*: DNSKEY protocol field as an integer. Raises ``ValueError`` if the specified key algorithm parameters are not unsupported, ``TypeError`` if the key type is unsupported, `UnsupportedAlgorithm` if the algorithm is unknown and `AlgorithmKeyMismatch` if the algorithm does not match the key type. Return DNSKEY ``Rdata``. )rzr|rN)r Zmaker'rZ to_dnskeyget_algorithm_clsr)rr6rzr|rr!r!r" _make_dnskeys    rcCs0t||||}t|jtjj|j|j|j|jdS)aConvert a public key to CDNSKEY Rdata *public_key*, the public key to convert, a ``cryptography.hazmat.primitives.asymmetric`` public key class applicable for DNSSEC. *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm. *flags*: DNSKEY flags field as an integer. *protocol*: DNSKEY protocol field as an integer. Raises ``ValueError`` if the specified key algorithm parameters are not unsupported, ``TypeError`` if the key type is unsupported, `UnsupportedAlgorithm` if the algorithm is unknown and `AlgorithmKeyMismatch` if the algorithm does not match the key type. Return CDNSKEY ``Rdata``. rrrsrzr|r6r.) rrrrrermrzr|r6r.)rr6rzr|rr!r!r" _make_cdnskeysr)domainsalt iterationsr6rc Cstdd}zt|tr$t|}Wnty@tdYn0|tjkrTtd|durbd}n4t|trt|ddkrt |}qtdn|}t|t j j st j |}|}|dusJt||}t|D]}t||}qt|d } | |} | S) a Calculate the NSEC3 hash, according to https://tools.ietf.org/html/rfc5155#section-5 *domain*, a ``dns.name.Name`` or ``str``, the name to hash. *salt*, a ``str``, ``bytes``, or ``None``, the hash salt. If a string, it is decoded as a hex string. *iterations*, an ``int``, the number of iterations. *algorithm*, a ``str`` or ``int``, the hash algorithm. The only defined algorithm is SHA1. Returns a ``str``, the encoded NSEC3 hash. Z ABCDEFGHIJKLMNOPQRSTUVWXYZ234567Z 0123456789ABCDEFGHIJKLMNOPQRSTUVz-Wrong hash algorithm (only SHA1 is supported)Nrr2rzInvalid salt lengthzutf-8)r) maketransr'r r_r`rarbr9bytesfromhexrerXNamer rfr5rcrdrhr8base64Z b32encodedecode translate) rrrr6Zb32_conversionZ salt_encodedZdomain_encodedrhrBoutputr!r!r" nsec3_hashs6           r)r algorithmsrYrc Cst|\}}|jtjjtjjtjjfvr0tdt}|D]H}zt |t rVt | }Wnt yvtd|Yn0||q:|jtjjkrg}t|D]}|j|vr||qt|dkrtdtj|j|Sg}|D]}|t||||qtj|j|S)aCreate a DS record from DNSKEY/CDNSKEY/CDS. *rrset*, the RRset to create DS Rdataset for. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *algorithms*, a set of ``str`` or ``int`` specifying the hash algorithms. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. If the RRset is a CDS, only digest algorithms matching algorithms are accepted. *origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if any of the algorithms are unknown and ``ValueError`` if the given RRset is not usable. Returns a ``dns.rdataset.Rdataset`` zrrset not a DNSKEY/CDNSKEY/CDSr\rzno acceptable CDS rdata found)rrsrermrrrrasetr'r)r r_r`raddcds_rdataset_to_ds_rdatasetruappendr9rfrom_rdata_listrextenddnskey_rdataset_to_cds_rdataset) rrrYrrZ _algorithmsr6resr:r!r!r"make_ds_rdatasets6        r)rrc Cs\|jtjjkrtdg}|D],}|t|jtjj|j|j |j |j dqtj |j|S)zCreate a CDS record from DS. *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for. Raises ``ValueError`` if the rdataset is not CDS. Returns a ``dns.rdataset.Rdataset`` zrdataset not a CDSrq)rsrermrrarrrrrtr6rurhrrrrrr:r!r!r"rUs  r)rXrr6rYrcCsP|jtjjtjjfvrtdg}|D]}|t||||q&tj |j |S)aCreate a CDS record from DNSKEY/CDNSKEY. *name*, a ``dns.name.Name`` or ``str``, the owner name of the CDS record. *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if the algorithm is unknown or ``ValueError`` if the rdataset is not DNSKEY/CDNSKEY. Returns a ``dns.rdataset.Rdataset`` zrdataset not a DNSKEY/CDNSKEY) rsrermrrrarrvrrr)rXrr6rYrr:r!r!r"rrs rc CsZ|jtjjkrtdg}|D]*}|t|j|j|j|j |j |j dqtj |j|S)zCreate a CDNSKEY record from DNSKEY. *rdataset*, a ``dns.rdataset.Rdataset``, to create CDNSKEY Rdataset for. Returns a ``dns.rdataset.Rdataset`` zrdataset not a DNSKEYr)rsrermrrarrrrrzr|r6r.rrrrr!r!r"#dnskey_rdataset_to_cdnskey_rdatasets  r) txnrrkskszsksrrrrZrYrc  Csr|jttjjjtjjjtjjjgvr,|} n|} | D]8\} } tjj || | |||||| d } | |j |j | q4dS)zDefault RRset signer) rrrrrrrrZrYN) rsrrerm RdataTyperrrrrrrXr)rrrrrrrrrZrYrwrrrxr!r!r"default_rrset_signers*  rT) zonerrw add_dnskey dnskey_ttlrrrnsec3 rrset_signerrZrc  CsBg} g} |rN|D]*} | djtj@r0| | q| | q| sD|} | sR|} ng}|rbt|}n|}|}|r|dur||jt j j }|r|j }n||jt j j }|j }|D]\}}||j||q|rtdn@| ptjt|j| | |||| |jd }t|||WdSWdn1s40YdS)a?Sign zone. *zone*, a ``dns.zone.Zone``, the zone to sign. *txn*, a ``dns.transaction.Transaction``, an optional transaction to use for signing. *keys*, a list of (``PrivateKey``, ``DNSKEY``) tuples, to use for signing. KSK/ZSK roles are assigned automatically if the SEP flag is used, otherwise all RRsets are signed by all keys. *add_dnskey*, a ``bool``. If ``True``, the default, all specified DNSKEYs are automatically added to the zone on signing. *dnskey_ttl*, a``int``, specifies the TTL for DNSKEY RRs. If not specified the TTL of the existing DNSKEY RRset used or the TTL of the SOA RRset. *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature inception time. If ``None``, the current time is used. If a ``str``, the format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text form; this is the same the RRSIG rdata's text form. Values of type `int` or `float` are interpreted as seconds since the UNIX epoch. *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature expiration time. If ``None``, the expiration time will be the inception time plus the value of the *lifetime* parameter. See the description of *inception* above for how the various parameter types are interpreted. *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This parameter is only meaningful if *expiration* is ``None``. *nsec3*, a ``NSEC3PARAM`` Rdata, configures signing using NSEC3. Not yet implemented. *rrset_signer*, a ``Callable``, an optional function for signing RRsets. The function requires two arguments: transaction and RRset. If the not specified, ``dns.dnssec.default_rrset_signer`` will be used. Returns ``None``. r3Nz&Signing with NSEC3 not yet implemented)rrrrrrrZrY)rzrZSEPr contextlib nullcontextwriterrrYrermrrZSOArNotImplementedError functoolspartialr_sign_zone_nsec)rrrwrrrrrrrrZrrr.cmZ_txnrZsoarBZ _rrset_signerr!r!r" sign_zonesN6       r)rrrrc Cs8dtjjtjjttjjtjjttt dddd}| j }d}d}t | D]}|rh||rhqRn$||tjjr||jkr|}nd}|r||}|r|jD]N} | jtjjkrqq|r| jtjjkrqqtjj|| jg| R} ||| q|dur|||||j|||}qR|r4||||j|j||dS)zNSEC zone signerN)rrX next_securerrrrrc Ssttjjjtjjjg}||}|r|rtdd|jD|B}t t |} tj ||t|tjjj|| d} | | |r||| dS)zNSEC zone signer helpercSsg|] }|jqSr!)rs)r}rr!r!r"rVrz:_sign_zone_nsec.._txn_add_nsec..)rrrsnextwindowsN)rrermrrrget_node rdatasetsrZ from_rdtypeslistr from_rdatar) rrXrrrrrZmandatory_typesrtypesrrr!r!r" _txn_add_nsecGs*   z&_sign_zone_nsec.._txn_add_nsec)N)re transaction TransactionrXrrrkZ RdataClassr( RRsetSignerZget_soaZminimumrZ iterate_namesZ is_subdomainrrmZNSrYrrrsrrrrrrr) rrrrZ rrsig_ttlZ delegationZ last_securerXrrrr!r!r"r@sH       rcOs tddS)Nz.DNSSEC validation requires python cryptography) ImportError)argskwargsr!r!r" _need_pycasrr)r)dsa)ec)ed448)rsa)ed25519)rr)rr)NNF)N)NNN)NNN)NNNFNN)N)N)N)NNNNN) NNTNNNNNNN)N)__doc__rrrrcrirrtypingrrrrrrr r Z dns._featuresreZ dns.exceptionZdns.nameZdns.nodeZ dns.rdataZdns.rdataclassZ dns.rdatasetZ dns.rdatatypeZ dns.rrsetZdns.transactionZdns.zoneZdns.dnssectypesr r r rrrrZdns.rdtypes.ANY.CDNSKEYrZdns.rdtypes.ANY.CDSrZdns.rdtypes.ANY.DNSKEYrZdns.rdtypes.ANY.DSrZdns.rdtypes.ANY.NSECrrZdns.rdtypes.ANY.NSEC3PARAMrZdns.rdtypes.ANY.RRSIGrrZdns.rdtypes.dnskeybaserZ PublicKeyZ PrivateKeyrrrZRRsetrr)r#r(r&r*r,r=r>rMr7ZDSAZ DSANSEC3SHA1ZECCGOSTZNULLrbZGOSTZrfc_8624_policyrZallow_all_policyr^rXrr:ZRdatarLrprvrZRdatasetrrrrrrrrrrr{rrrrrrrrrZZonerrrZ _featuresZhaveZcryptography.exceptionsrZ)cryptography.hazmat.primitives.asymmetricrrrrrZdns.dnssecalgsrrZdns.dnssecalgs.baserrZvalidateZvalidate_rrsigrZ make_dnskeyZ make_cdnskeyZ _have_pycaZDHZECCZRSASHA1ZRSASHA1NSEC3SHA1Z RSASHA256Z RSASHA512ZECDSAP256SHA256ZECDSAP384SHA384ZED25519ZED448ZINDIRECTZ PRIVATEDNSZ PRIVATEOIDr!r!r!r"s (           P   %      I  N  |  D  %  '  @  ; !   " !  *  m O