eventlist.py 0000644 00000013330 15173300434 0007133 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
from collections import defaultdict
from .dnskey import *
from .keydict import *
from .keyevent import *
class eventlist:
_K = defaultdict(lambda: defaultdict(list))
_Z = defaultdict(lambda: defaultdict(list))
_zones = set()
_kdict = None
def __init__(self, kdict):
properties = ["SyncPublish", "Publish", "SyncDelete",
"Activate", "Inactive", "Delete"]
self._kdict = kdict
for zone in kdict.zones():
self._zones.add(zone)
for alg, keys in kdict[zone].items():
for k in keys.values():
for prop in properties:
t = k.gettime(prop)
if not t:
continue
e = keyevent(prop, k, t)
if k.sep:
self._K[zone][alg].append(e)
else:
self._Z[zone][alg].append(e)
self._K[zone][alg] = sorted(self._K[zone][alg],
key=lambda event: event.when)
self._Z[zone][alg] = sorted(self._Z[zone][alg],
key=lambda event: event.when)
# scan events per zone, algorithm, and key type, in order of
# occurrence, noting inconsistent states when found
def coverage(self, zone, keytype, until, output = None):
def noop(*args, **kwargs): pass
if not output:
output = noop
no_zsk = True if (keytype and keytype == "KSK") else False
no_ksk = True if (keytype and keytype == "ZSK") else False
kok = zok = True
found = False
if zone and not zone in self._zones:
output("ERROR: No key events found for %s" % zone)
return False
if zone:
found = True
if not no_ksk:
kok = self.checkzone(zone, "KSK", until, output)
if not no_zsk:
zok = self.checkzone(zone, "ZSK", until, output)
else:
for z in self._zones:
if not no_ksk and z in self._K.keys():
found = True
kok = self.checkzone(z, "KSK", until, output)
if not no_zsk and z in self._Z.keys():
found = True
zok = self.checkzone(z, "ZSK", until, output)
if not found:
output("ERROR: No key events found")
return False
return (kok and zok)
def checkzone(self, zone, keytype, until, output):
allok = True
if keytype == "KSK":
kz = self._K[zone]
else:
kz = self._Z[zone]
for alg in kz.keys():
output("Checking scheduled %s events for zone %s, "
"algorithm %s..." %
(keytype, zone, dnskey.algstr(alg)))
ok = eventlist.checkset(kz[alg], keytype, until, output)
if ok:
output("No errors found")
allok = allok and ok
return allok
@staticmethod
def showset(eventset, output):
if not eventset:
return
output(" " + eventset[0].showtime() + ":", skip=False)
for event in eventset:
output(" %s: %s" % (event.what, repr(event.key)), skip=False)
@staticmethod
def checkset(eventset, keytype, until, output):
groups = list()
group = list()
# collect up all events that have the same time
eventsfound = False
for event in eventset:
# we found an event
eventsfound = True
# add event to current group
if (not group or group[0].when == event.when):
group.append(event)
# if we're at the end of the list, we're done. if
# we've found an event with a later time, start a new group
if (group[0].when != event.when):
groups.append(group)
group = list()
group.append(event)
if group:
groups.append(group)
if not eventsfound:
output("ERROR: No %s events found" % keytype)
return False
active = published = None
for group in groups:
if (until and calendar.timegm(group[0].when) > until):
output("Ignoring events after %s" %
time.strftime("%a %b %d %H:%M:%S UTC %Y",
time.gmtime(until)))
return True
for event in group:
(active, published) = event.status(active, published)
eventlist.showset(group, output)
# and then check for inconsistencies:
if not active:
output("ERROR: No %s's are active after this event" % keytype)
return False
elif not published:
output("ERROR: No %s's are published after this event"
% keytype)
return False
elif not published.intersection(active):
output("ERROR: No %s's are both active and published "
"after this event" % keytype)
return False
return True
__pycache__/keyevent.cpython-36.opt-1.pyc 0000644 00000003500 15173300434 0014171 0 ustar 00 3
�!�i � @ s d dl Z G dd� d�ZdS )� Nc @ s4 e Zd ZdZd dd�Zdd� Zdd� Zd d d
�ZdS )
�keyeventz� A discrete key event, e.g., Publish, Activate, Inactive, Delete,
etc. Stores the date of the event, and identifying information
about the key to which the event will occur.Nc C s@ || _ |p|j|�| _|| _|j| _|j| _|j| _|j| _d S )N) �whatZgettime�when�key�sep�name�zone�alg�keyid)�selfr r r � r � /usr/lib/python3.6/keyevent.py�__init__ s zkeyevent.__init__c C s t | j| j| j| j| j| jf�S )N)�reprr r r
r r r )r r r r
�__repr__ s zkeyevent.__repr__c C s t jd| j�S )Nz%a %b %d %H:%M:%S UTC %Y)�timeZstrftimer )r r r r
�showtime$ s zkeyevent.showtimec C s� dd� }|s|}|st � }|s$t � }| jdkr<|j| j� n�| jdkrT|j| j� n�| jdkr�| j|kr||dt| j� � q�|j| j� nl| jdkr�| j|kr�|j| j� q�|dt| j� � n6| jd kr�| j|kr�|j| j� | j|kr�|j| j� ||fS )
Nc _ s d S )Nr )�args�kwargsr r r
�noop* s z keyevent.status.<locals>.noopZActivateZPublishZInactivez= WARNING: %s scheduled to become inactive before it is activeZDeletez@WARNING: key %s is scheduled for deletion before it is publishedZRevoke)�setr �addr
r r �remove)r ZactiveZ published�outputr r r r
�status) s6
zkeyevent.status)N)N)�__name__�
__module__� __qualname__�__doc__r r r r r r r r
r s
r )r r r r r r
�<module> s __pycache__/policy.cpython-36.opt-1.pyc 0000644 00000046217 15173300435 0013653 0 ustar 00 3
�!�i2g � @ s: d dl Z d dljZd dljZd dlT d dlmZ G dd� d�ZG dd� d�ZG dd � d e �Z
G d
d � d �Z e d k�r6d dl
Z
e
jd
dkr�ee
jd �Zej� Zej� ed
d�Zeje� nxe
jd
dk�r6y4e e
jd ddd�Zeejd � eejd�� W n2 e k
�r4 Z zeejd � W Y ddZ[X nX dS )� N)�*)�copyc
@ s� e Zd Zd3Zed4 Zi ZdZdZdZdZ dZ
d d � Z d d � Z d d!� Z
d"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2S )5� PolicyLex�POLICY�ALGORITHM_POLICY�ZONE� ALGORITHM� DIRECTORY�KEYTTL�KEY_SIZE� ROLL_PERIOD� PRE_PUBLISH� POST_PUBLISH�COVERAGE�STANDBY�NONE�
DATESUFFIX�KEYTYPE�ALGNAME�STR�QSTRING�NUMBER�LBRACE�RBRACE�SEMIz z (//|\#).*z\{z\}�;c C s |j j|jjd�7 _dS )z\n+�
N)�lexer�lineno�value�count)�self�t� r# � /usr/lib/python3.6/policy.py� t_newline7 s zPolicyLex.t_newlinec C s |j j|jjd�7 _dS )z/\*(.|\n)*?\*/r N)r r r r )r! r" r# r# r$ � t_comment; s zPolicyLex.t_commentc C s t jd|j�jd�j� |_|S )z�(?i)(?<=[0-9 \t])(y(?:ears|ear|ea|e)?|mo(?:nths|nth|nt|n)?|w(?:eeks|eek|ee|e)?|d(?:ays|ay|a)?|h(?:ours|our|ou|o)?|mi(?:nutes|nute|nut|nu|n)?|s(?:econds|econd|econ|eco|ec|e)?)\bz (?i)(y|mo|w|d|h|mi|s)([a-z]*)� )�re�matchr �group�lower)r! r" r# r# r$ � t_DATESUFFIX? s zPolicyLex.t_DATESUFFIXc C s |j j� |_ |S )z(?i)\b(KSK|ZSK)\b)r �upper)r! r" r# r# r$ � t_KEYTYPED s zPolicyLex.t_KEYTYPEc C s |j j� |_ |S )z�(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b)r r- )r! r" r# r# r$ � t_ALGNAMEI s zPolicyLex.t_ALGNAMEc C s | j j|jd�|_|S )z[A-Za-z._-][\w._-]*r )� reserved_map�getr �type)r! r" r# r# r$ �t_STRN s zPolicyLex.t_STRc C s& | j j|jd�|_|jdd� |_|S )z"([^"\n]|(\\"))*"r r' ���)r0 r1 r r2 )r! r" r# r# r$ � t_QSTRINGS s zPolicyLex.t_QSTRINGc C s t |j�|_|S )z\d+)�intr )r! r" r# r# r$ �t_NUMBERY s zPolicyLex.t_NUMBERc C s" t d|jd � |jjd� d S )NzIllegal character '%s'r r' )�printr r �skip)r! r" r# r# r$ �t_error^ s zPolicyLex.t_errorc K sb dt t�krtjdd�}n
tdd�}x"| jD ]}|| j|j� j|�< q,W tjf d| i|��| _d S )N� maketrans�_�-�object) �dir�strr; �reservedr0 r+ � translate�lexr )r! �kwargsZtrans�rr# r# r$ �__init__b s
zPolicyLex.__init__c C s. | j j|� x | j j� }|s P t|� qW d S )N)r �input�tokenr8 )r! �textr" r# r# r$ �testk s
zPolicyLex.testN)
r r r r r r
r r r
r r r r ) r r r r r r r r r )�__name__�
__module__� __qualname__rA �tokensr0 Zt_ignoreZt_ignore_olcommentZt_LBRACEZt_RBRACEZt_SEMIr% r& r, r. r/ r3 r5 r7 r: rF rJ r# r# r# r$ r sN r c
@ s� e Zd ZdZdZdZdZdZdZdZ dZ
dZ dZ dZ
dZdZdZdZdZddgddgddgddgddgddgddgdddddd� Zddd�Zd d
� Zd d � Zd
d� Zdd� Zdd� ZdS )�PolicyFNi i i ) �DSA�NSEC3DSA�RSAMD5�RSASHA1� NSEC3RSASHA1� RSASHA256� RSASHA512�ECCGOST�ECDSAP256SHA256�ECDSAP384SHA384�ED25519�ED448c C s || _ || _|| _d S )N)�name� algorithm�parent)r! r\ r] r^ r# r# r$ rF � s zPolicy.__init__c C sF d| j r dp"| jrdp"| jr dp"d| jp*d| jr8| jjp:d| jrRdt| j� d pTd| jp\d| jrlt| j�pnd| j r~t| j �p�d| j
r�t| j
�p�d| j r�t| j �p�d| j r�t| j �p�d| j
r�t| j
�p�d| jr�t| j�p�d| jr�t| j�p�d| jr�t| j�p�d| j�rt| j��pd| j�r(t| j��p*d| j�r>t| j��p@df S ) Na %spolicy %s:
inherits %s
directory %s
algorithm %s
coverage %s
ksk_keysize %s
zsk_keysize %s
ksk_rollperiod %s
zsk_rollperiod %s
ksk_prepublish %s
ksk_postpublish %s
zsk_prepublish %s
zsk_postpublish %s
ksk_standby %s
zsk_standby %s
keyttl %s
z constructed zzone z
algorithm � ZUNKNOWN�None�")�is_constructed�is_zone�is_algr\ r^ � directoryr@ r] �coverage� ksk_keysize� zsk_keysize�ksk_rollperiod�zsk_rollperiod�ksk_prepublish�ksk_postpublish�zsk_prepublish�zsk_postpublish� ksk_standby� zsk_standby�keyttl)r! r# r# r$ �__repr__� s(
zPolicy.__repr__c C s |d | ko|d kS S )Nr r' r# )r! Zkey_sizeZ
size_ranger# r# r$ Z
__verify_size� s zPolicy.__verify_sizec C s | j S )N)r\ )r! r# r# r$ �get_name� s zPolicy.get_namec C s | j S )N)rb )r! r# r# r$ � constructed� s zPolicy.constructedc C s$ | j r:| jdk r:| j| j kr:t| j � dd| j| j f fS | j rj| jdk rj| j| j krjdd| j| j f fS | jr�| jdk r�| j| jkr�dd| j| jf fS | jr�| jdk r�| j| jkr�dd| j| jf fS | j o�| jo�| jo�| j| j | j k�rdd| j| j| j f fS | j�rL| j�rL| j�rL| j| j | jk�rLdd| j| j| jf fS | jdk �r | jj | j�}|dk �r�| j
| j |��s�dd
| j |f fS | j
| j |��s�dd | j |f fS | jd k�r�| j d dk�r�dd | j fS | jd k�r| j d dk�rdd | j fS | jd k�r d| _ d| _ d!S )"zr Check if the values in the policy make sense
:return: True/False if the policy passes validation
NFz6KSK pre-publish period (%d) exceeds rollover period %dz7KSK post-publish period (%d) exceeds rollover period %dz6ZSK pre-publish period (%d) exceeds rollover period %dz7ZSK post-publish period (%d) exceeds rollover period %dz%KSK pre/post-publish periods (%d/%d) z"combined exceed rollover period %dz%ZSK pre/post-publish periods (%d/%d) z&KSK key size %d outside valid range %sz&ZSK key size %d outside valid range %srP rQ �@ r z$KSK key size %d not divisible by 64 zas required for DSAz$ZSK key size %d not divisible by 64 rW rX rY rZ r[ Tr_ zGKSK pre/post-publish periods (%d/%d) combined exceed rollover period %dzGZSK pre/post-publish periods (%d/%d) combined exceed rollover period %d)rP rQ z7KSK key size %d not divisible by 64 as required for DSA)rP rQ z7ZSK key size %d not divisible by 64 as required for DSA)rW rX rY rZ r[ )Tr_ )
ri rk r8 rl rj rm rn r] �valid_key_sz_per_algor1 �_Policy__verify_sizerg rh )r! Z key_sz_ranger# r# r$ �validate� s�
zPolicy.validate)NNN)rK rL rM rc rd rb ri rj rk rm rl rn rg rh ro rp rq rf re rv rF rr rw rs rt rx r# r# r# r$ rO v sD
&rO c @ s e Zd ZdS )�PolicyExceptionN)rK rL rM r# r# r# r$ ry ) s ry c @ s. e Zd Zi Zi Zi ZdZdZdZdEdd�Z dd� Z
dd� Z d d
� Z d d � Z
d
d� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Z d+d,� Z d-d.� Z d/d0� Z d1d2� Z d3d4� Z!d5d6� Z"d7d8� Z#d9d:� Z$d;d<� Z%d=d>� Z&d?d@� Z'dAdB� Z(dCdD� Z)dS )F�
dnssec_policyNTc K s� t � | _| jj| _d|kr"d|d< d|kr2d|d< tjf d| i|��| _| jd� t� }d |_d|_d|_ d|_
t |�| j d< d| j d _d| j d _
d | j d _ t |�| j d
< d
| j d
_d
| j d
_
d | j d
_ t |�| j d < d | j d _d | j d _
t |�| j d < d | j d _d | j d _
t |�| j d
< d
| j d
_d
| j d
_
t |�| j d< d| j d _d| j d _
t |�| j d< d| j d _d| j d _
t |�| j d< d| j d _d| j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
|�r�| j|� d S )N�debugF� write_tables�modulea policy global { algorithm rsasha256;
key-size ksk 2048;
key-size zsk 2048;
roll-period ksk 0;
roll-period zsk 1y;
pre-publish ksk 1mo;
pre-publish zsk 1mo;
post-publish ksk 1mo;
post-publish zsk 1mo;
standby ksk 0;
standby zsk 0;
keyttl 1h;
coverage 6mo; };
policy default { policy global; };Ti rP i rQ rR rS rT rU rV rW rX rY rZ r[ )r �plexrN �yacc�parser�setuprO r] rd rg rh r �
alg_policyr\ �load)r! �filenamerD �pr# r# r$ rF 4 s|
zdnssec_policy.__init__c C sH || _ d| _t|��$}|j� }d| jj_| jj|� W d Q R X d | _ d S )NTr ) r� �initial�open�readr~ r r r� �parse)r! r� �frI r# r# r$ r� � s
zdnssec_policy.loadc C s d| _ d| jj_| jj|� d S )NTr )r� r~ r r r� r� )r! rI r# r# r$ r� � s
zdnssec_policy.setupc K s` |j � }d }|| jkr | j| }|d krBt| jd �}||_d|_|jd kr�|jpZ| jd }x|rr|j rr|j}q^W |r~|jp�d |_|j| jkr�| j|j }nt d��|j
d kr�|jp�| jd }x|d k r�|j
r�|j}q�W |o�|j
|_
|j d k�r:|j�p| jd }x |�r"|j �r"|j}�qW |�r2|j �p6|j |_ |j d k�r�|j�pV| jd }x |j�rv|j �rv|j}�qZW |�r�|j �p�|j |_ |j
d k�r�|j�p�| jd }x |j�r�|j
�r�|j}�q�W |�r�|j
�p�|j
|_
|jd k�r6|j�p�| jd }x |j�r |j �r |j}�qW |�r.|j�p2|j|_|jd k�r�|j�pR| jd }x |j�rr|j �rr|j}�qVW |�r�|j�p�|j|_|jd k�r�|j�p�| jd }x |j�r�|j �r�|j}�q�W |�r�|j�p�|j|_|jd k�r2|j�p�| jd }x |j�r|j �r|j}�q�W |�r*|j�p.|j|_|jd k�r�|j�pN| jd }x |j�rn|j �rn|j}�qRW |�r~|j�p�|j|_|jd k�r�|j�p�| jd }x |j�r�|j �r�|j}�q�W |�r�|j�p�|j|_|jd k�r(|j�p�| jd }x |d k �r|j �r|j}�q�W |�o$|j|_d|k�s>|d �r\|j� \}}|�s\t |��d S |S )N�defaultTzalgorithm not foundZ
novalidate)r+ � zone_policyr � named_policyr\ rb r] r^ r� ry re rf rg rh ri rj rk rm rl rn rq rx ) r! ZzonerD �zr� r^ ZapZvalid�msgr# r# r$ �policy� s�
zdnssec_policy.policyc C s dS )zBpolicylist : init policy
| policylist policyNr# )r! r� r# r# r$ � p_policylist
s zdnssec_policy.p_policylistc C s
d| _ dS )zinit :FN)r� )r! r� r# r# r$ �p_init s zdnssec_policy.p_initc C s dS )zTpolicy : alg_policy
| zone_policy
| named_policyNr# )r! r� r# r# r$ �p_policy s zdnssec_policy.p_policyc C s |d |d< dS )zAname : STR
| KEYTYPE
| DATESUFFIXr' r Nr# )r! r� r# r# r$ �p_name s zdnssec_policy.p_namec C s, |d j � |d< tjd|d �s(td��dS )zcdomain : STR
| QSTRING
| KEYTYPE
| DATESUFFIXr' r z^[\w.-][\w.-]*$zinvalid domainN)�stripr( r) ry )r! r� r# r# r$ �p_domain s zdnssec_policy.p_domainc C s t � | _dS )z new_policy :N)rO �current)r! r� r# r# r$ � p_new_policy* s zdnssec_policy.p_new_policyc C s( |d | j _d| j _| j | j|d < dS )zFalg_policy : ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMI� TN)r� r\ rd r� )r! r� r# r# r$ � p_alg_policy. s zdnssec_policy.p_alg_policyc C s8 |d j d�| j_d| j_| j| j|d j d�j� < dS )z=zone_policy : ZONE domain new_policy policy_option_group SEMIr� �.TN)�rstripr� r\ rc r� r+ )r! r� r# r# r$ �
p_zone_policy5 s zdnssec_policy.p_zone_policyc C s$ |d | j _| j | j|d j� < dS )z>named_policy : POLICY name new_policy policy_option_group SEMIr� N)r� r\ r� r+ )r! r� r# r# r$ �p_named_policy< s z dnssec_policy.p_named_policyc C s |d |d< dS )zduration : NUMBERr' r Nr# )r! r� r# r# r$ � p_duration_1B s zdnssec_policy.p_duration_1c C s d|d< dS )zduration : NONENr r# )r! r� r# r# r$ � p_duration_2G s zdnssec_policy.p_duration_2c C s� |d dkr |d d |d< n�|d dkr<|d d |d< n�|d dkrZ|d d |d< n||d d
krx|d d |d< n^|d d kr�|d d
|d< n@|d dkr�|d d |d< n"|d dkr�|d |d< nt d��dS )z duration : NUMBER DATESUFFIXr� �yr' i�3�r �moi �' �wi�: �di�Q �hi Zmi�< �szinvalid durationN)ry )r! r� r# r# r$ � p_duration_3L s zdnssec_policy.p_duration_3c C s dS )z6policy_option_group : LBRACE policy_option_list RBRACENr# )r! r� r# r# r$ �p_policy_option_group_ s z#dnssec_policy.p_policy_option_groupc C s dS )zmpolicy_option_list : policy_option SEMI
| policy_option_list policy_option SEMINr# )r! r� r# r# r$ �p_policy_option_listc s z"dnssec_policy.p_policy_option_listc C s dS )a� policy_option : parent_option
| directory_option
| coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keysize_option
| algorithm_option
| keyttl_option
| standby_optionNr# )r! r� r# r# r$ �p_policy_optionh s z dnssec_policy.p_policy_optionc C s dS )z0alg_option_group : LBRACE alg_option_list RBRACENr# )r! r� r# r# r$ �p_alg_option_groupu s z dnssec_policy.p_alg_option_groupc C s dS )z^alg_option_list : alg_option SEMI
| alg_option_list alg_option SEMINr# )r! r� r# r# r$ �p_alg_option_listy s z dnssec_policy.p_alg_option_listc C s dS )a alg_option : coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keyttl_option
| keysize_option
| standby_optionNr# )r! r� r# r# r$ � p_alg_option~ s zdnssec_policy.p_alg_optionc C s | j |d j� | j_dS )zparent_option : POLICY namer� N)r� r+ r� r^ )r! r� r# r# r$ �p_parent_option� s z dnssec_policy.p_parent_optionc C s |d | j _dS )z$directory_option : DIRECTORY QSTRINGr� N)r� re )r! r� r# r# r$ �p_directory_option� s z dnssec_policy.p_directory_optionc C s |d | j _dS )z#coverage_option : COVERAGE durationr� N)r� rf )r! r� r# r# r$ �p_coverage_option� s z dnssec_policy.p_coverage_optionc C s* |d dkr|d | j _n |d | j _dS )z0rollperiod_option : ROLL_PERIOD KEYTYPE durationr� �KSK� N)r� ri rj )r! r� r# r# r$ �p_rollperiod_option� s z!dnssec_policy.p_rollperiod_optionc C s* |d dkr|d | j _n |d | j _dS )z0prepublish_option : PRE_PUBLISH KEYTYPE durationr� r� r� N)r� rk rm )r! r� r# r# r$ �p_prepublish_option� s z!dnssec_policy.p_prepublish_optionc C s* |d dkr|d | j _n |d | j _dS )z2postpublish_option : POST_PUBLISH KEYTYPE durationr� r� r� N)r� rl rn )r! r� r# r# r$ �p_postpublish_option� s z"dnssec_policy.p_postpublish_optionc C s* |d dkr|d | j _n |d | j _dS )z(keysize_option : KEY_SIZE KEYTYPE NUMBERr� r� r� N)r� rg rh )r! r� r# r# r$ �p_keysize_option� s z dnssec_policy.p_keysize_optionc C s* |d dkr|d | j _n |d | j _dS )z'standby_option : STANDBY KEYTYPE NUMBERr� r� r� N)r� ro rp )r! r� r# r# r$ �p_standby_option� s z dnssec_policy.p_standby_optionc C s |d | j _dS )z keyttl_option : KEYTTL durationr� N)r� rq )r! r� r# r# r$ �p_keyttl_option� s z dnssec_policy.p_keyttl_optionc C s |d | j _dS )z$algorithm_option : ALGORITHM ALGNAMEr� N)r� r] )r! r� r# r# r$ �p_algorithm_option� s z dnssec_policy.p_algorithm_optionc C sd |r.t d| jpd| jrdnd|j|jf � n2| js`td| jp@d| jrJdnd|rV|jpXdf ��d S )Nz %s%s%d:syntax error near '%s'r_ �:z %s%s%d:unexpected end of inputr )r8 r� r r r� ry )r! r� r# r# r$ �p_error� s zdnssec_policy.p_error)N)*rK rL rM r� r� r� r� r� r� rF r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ rz , sN
_
h
rz �__main__r' rC r� )r{ r� T)r| r{ r� znonexistent.zone) r( Zply.lexrC Zply.yaccr �stringr r rO � Exceptionry rz rK �sys�argvr� �filer� rI �closer~ rJ Zppr8 r� r� �e�argsr# r# r# r$ �<module> s6
` 4 !
__pycache__/keydict.cpython-36.opt-1.pyc 0000644 00000005013 15173300435 0013775 0 ustar 00 3
�!�i! � @ s: d dl mZ ddlmZ d dlZd dlZG dd� d�ZdS )� )� defaultdict� )�dnskeyNc @ sn e Zd ZdZedd� �ZdZg Zddd�Zdd� Z d d
� Z
d d � Z d
d� Z dd� Z
dd� Zdd� Zdd� ZdS )�keydictz> A dictionary of keys, indexed by name, algorithm, and key id c C s t t�S )N)r �dict� r r � /usr/lib/python3.6/keydict.py�<lambda> s zkeydict.<lambda>Nc K s� |j dd �| _|j dd �}|s:|j dd �p,d}| j|� nXxV|D ]N}d|krb|d d k rb|d }n|rr|j|�jptd}| j||�s@| jj|� q@W d S )NZkeyttl�zones�path�.)�get�_defttl�readallZpolicyZ directory�readone�_missing�append)�selfZdp�kwargsr
r �zoner r r �__init__ s
zkeydict.__init__c C sL t j tjj|d��}x2|D ]*}t||| j�}|| j|j |j |j < qW d S )Nz *.private)
�glob�osr �joinr r �_keydict�name�alg�keyid)r r �files�infile�keyr r r r , s
zkeydict.readallc C s� |j d�s|d7 }d| d }tjtjj||��}d}xR|D ]J}t||| j�}|j|krZq<|dkrh|jnd}|| j | |j
|j < d}q<W |S )Nr �Kz
+*.privateFT) �endswithr r r r r r �fullnamer r r r ) r r r �matchr �foundr r Zkeynamer r r r 3 s
zkeydict.readonec c sJ xD| j j� D ]6\}}x,|j� D ] \}}x|j� D ]
}|V q0W q W q W d S )N)r �items�values)r r �
algorithmsr �keysr r r r �__iter__D s zkeydict.__iter__c C s
| j | S )N)r )r r r r r � __getitem__J s zkeydict.__getitem__c C s
| j j� S )N)r r) )r r r r r
M s z
keydict.zonesc C s | j | j� S )N)r r) )r r r r r r( P s zkeydict.algorithmsc C s | j | | j� S )N)r r) )r r r r r r r) S s z keydict.keysc C s | j S )N)r )r r r r �missingV s zkeydict.missing)N)�__name__�
__module__� __qualname__�__doc__r r r r r r r r* r+ r
r( r) r, r r r r r s
r )� collectionsr � r r r r r r r r �<module> s __pycache__/rndc.cpython-36.pyc 0000644 00000012000 15173300435 0012322 0 ustar 00 3
�!�i+ � @ sX d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZG dd� de �Z
dS )� )� OrderedDictNc @ sl e Zd ZdZddddddd�Zd d
� Zd d � Zd dd�Zdd� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
d S ) �rndcz RNDC protocol client library� � � � � � )�md5Zsha1Zsha224Zsha256Zsha384Zsha512c C sb || _ |j� }|jd�r$|dd� }|| _tt|�| _tj|�| _ t
j dd�| _ d| _
| j� dS )z�Creates a persistent connection to RNDC and logs in
host - (ip, port) tuple
algo - HMAC algorithm: one of md5, sha1, sha224, sha256, sha384, sha512
(with optional prefix 'hmac-')
secret - HMAC secret, base64 encodedzhmac-� Nr � � i )�host�lower�
startswith�algo�getattr�hashlib�hlalgo�base64� b64decode�secret�randomZrandint�ser�nonce�_rndc__connect_login)�selfr r r � r �/usr/lib/python3.6/rndc.py�__init__$ s
z
rndc.__init__c C s t | j|d�d �S )z�Call a RNDC command, all parsing is done on the server side
cmd - a complete string with a command (eg 'reload zone example.com')
)�type�_data)�dict�_rndc__command)r �cmdr r r �call5 s z rndc.callFc C s t � }�x |j� D ]�\}}|r(|dkr(q|tjdt|��|jd� 7 }t|�tkrt|tjddt|��|jd� 7 }qt|�tkr�|tjddt|��| 7 }qt|�t kr�|tjddt|��| 7 }qt|�t kr�| j
|�}|tjddt|��| 7 }qt dt|� ��qW |S )N�_auth�B�asciiz>BIr � z#Cannot serialize element of type %s) � bytearray�items�struct�pack�len�encoder �str�bytesr �_rndc__serialize_dict�NotImplementedError)r �data� ignore_auth�rv�k�vZsdr r r Z__serialize_dict; s" "
zrndc.__serialize_dictc O s, | j d7 _ ttj� �}t||�}t� }t� |d< t� |d< t| j �|d d< t|�|d d< t|d �|d d< | jd k r�| j|d d< ||d < | j|d
d �}tj| j || j
�j � }t j
|�}| jd kr�tjd
|�|d d< n"ttjd| j| j |��|d d< | j|�}tjdt|�d d�| }|S )Nr r& �_ctrlZ_serZ_tim�< Z_exp�_noncer! T)r5 r
Z22s�hmd5ZB88s�hshaz>II� )r �int�timer r0 r r2 �hmac�newr r �digestr Z b64encoder r, r- r* � _rndc__algosr. ) r �args�kwargsZnowr4 �d�msg�hash�bhashr r r Z__prep_messageO s,
zrndc.__prep_messagec C s� | j d k r |d d | j kr dS | jdkr8|d d }n|d d dd � }t|�tkrb|jd �}|d
d t|�d 7 }tj|�}| j|d d
�}t j
| j || j �j
� }||kS )Nr9 r; Fr
r& r< r= r r( �=r> T)r5 )r r r r1 �decoder. r r r2 rA rB r r rC )r rH rJ Z remote_hashZmy_msgZmy_hashr r r Z __verify_msgj s
zrndc.__verify_msgc O s� | j ||�}| jj|�}|t|�kr,td��| jjd�}t|�dkrLtd��tjd|�\}}|dkrptd| ��|d8 }| jj|tj �}t|�|kr�td��t
|�t kr�t |�}| j
|�}| j|�s�td ��|S )
NzCannot send the message� zCan't read response headerz>IIr zWrong message version %dr> zCan't read response datazAuthentication failure)�_rndc__prep_message�socket�sendr. �IOErrorZrecvr, �unpackr3 Z MSG_WAITALLr r0 r* �_rndc__parse_message�_rndc__verify_msg) r rE rF rH Zsent�headerZlength�versionr4 r r r Z __commandy s(
zrndc.__commandc C s2 t j| j�| _ d | _| jdd�}|d d | _d S )NZnull)r r9 r; )rO Zcreate_connectionr r r# )r rH r r r Z__connect_login� s zrndc.__connect_loginc C s� d}|| }|d7 }|||| � j d�}||7 }|| }|d7 }tjd|||d � �d }|d7 }|||| � }||7 }||d � }|dkr�|||fS |dkr�t� } x(t|�dkr�| j|�\}
} }| | |
< q�W || |fS td| ��d S )Nr r r( z>Ir> r) zUnknown element type %d)rL r, rR r r. �_rndc__parse_elementr3 ) r �input�posZlabellen�labelr Zdatalenr4 �restrG Zilabel�valuer r r Z__parse_element� s*
zrndc.__parse_elementc C s8 t � }d }x(t|�dkr2| j|�\}}}|||< q W |S )Nr )r r. rW )r rX r6 ZhdatarZ r\ r r r Z__parse_message� s zrndc.__parse_messageN)F)�__name__�
__module__� __qualname__�__doc__rD r r% r2 rN rT r# r rW rS r r r r r s
r ) � collectionsr r@ r, r rA r r rO �objectr r r r r �<module> s __pycache__/dnskey.cpython-36.opt-1.pyc 0000644 00000032530 15173300435 0013642 0 ustar 00 3
�!�i @ � @ sJ d dl Z d dlZd dlZd dlmZmZ G dd� de�ZG dd� d�ZdS )� N)�Popen�PIPEc s e Zd Z� fdd�Z� ZS )�TimePastc s t t| �jd|||f � d S )Nz'%s time for key %s (%d) is already past)�superr �__init__)�self�key�prop�value)� __class__� � /usr/lib/python3.6/dnskey.pyr s zTimePast.__init__)�__name__�
__module__� __qualname__r �
__classcell__r r )r r
r s r c @ s� e Zd ZdZdqZdrZdsZdtd!d"�Zd#d$� Zd%d&� Z e
dud'd(��Z d)d*� Z e
d+d,� �Ze
d-d.� �Zdvd/d0�Ze
d1d2� �Ze
d3d4� �Ze
d5d6� �Ze
d7d8� �Zd9d:� Zd;d<� Zd=d>� Zd?d@� ZdAdB� ZdCdD� Zej� fdEdF�Z dGdH� Z ej� fdIdJ�Z dKdL� Z ej� fdMdN�Z dOdP� Z!ej� fdQdR�Z"dSdT� Z#ej� fdUdV�Z$dWdX� Z%ej� fdYdZ�Z&d[d\� Z'ej� fd]d^�Z(d_d`� Z)dadb� Z*dcdd� Z+dedf� Z,dgdh� Z-didj� Z.dwdkdl�Z/dxdmdn�Z0e
dodp� �Z1d S )y�dnskeyztAn individual DNSSEC key. Identified by path, name, algorithm, keyid.
Contains a dictionary of metadata events.�Created�Publish�Activate�Inactive�Delete�Revoke� DSPublish� SyncPublish�
SyncDeleteN�-P�-A�-I�-D�-R�-Psync�-Dsync�RSAMD5�DH�DSA�ECC�RSASHA1�NSEC3DSA� NSEC3RSASHA1� RSASHA256� RSASHA512�ECCGOST�ECDSAP256SHA256�ECDSAP384SHA384�ED25519�ED448c C s� t |t�r:t|�dkr:|p d| _|\}}}| j||||� |pLtjj|�pLd| _tjj|�}|j d�\}}}|dd� }t
|�}t
|j d�d �}| j||||� d S )N� �.�+� r ���) �
isinstance�tuple�len�_dir� fromtuple�os�path�dirname�basename�split�int)r r Z directory�keyttl�name�alg�keyidr r r
r & s
zdnskey.__init__c s� |j d�r|}|jd�}n|d }d|||f }| j| jr@tjpBd | d }| j| jr^tjp`d | d }|| _|| _t|�| _t|�| _ || _
t |d�} x�| D ]z� � d dkr�q�� j � }
|
s�q�|
d j
� dkr�d
} || _nd} |s�t|
d �n|| _t|
| �d @ d k�rd| _q�d| _q�W | j� t |d�} t� | _t� | _t� | _t� | _t� | _t� | _t� | _d | _x�| D ]�� � j� � � �sv� d dk�r��qv� fdd�dD �t� �g }
tdd� |
D ��}� d |� j� }� |d � j d�j� }|| j|< �qvW x�t j D ]�}d| j|< || jk�rn| j | j| �}|| j|< | j |�| j|< | j!|�| j|< | j| | j|< n(d | j|< d | j|< d | j|< d | j|< �qW | j� d S )Nr2 z
K%s+%03d+%05d� z.keyz.private�rr �;r4 �in�ch�hsr1 � TFZrUz!#c s g | ]}� j |��qS r )�find)�.0�c)�liner r
�
<listcomp>l s z$dnskey.fromtuple.<locals>.<listcomp>z:= c S s g | ]}|dkr|�qS )r4 r5 r )rM �posr r r
rP m s )rH rI rJ )"�endswith�rstripr9 r; �sep�keystrrB r@ rC rD �fullname�openr? �lower�ttl�close�dictZmetadata�_changed�_delete�_times�_fmttime� _timestamps� _original�_origttl�stripr8 �min�lstripr �_PROPS� parsetime�
formattime�
epochfromtime)r rB rC rD rA rV rU Zkey_fileZ private_fileZkfp�tokensZseptokenZpfpZ punctuation�foundr
r �tr )rO r
r: 5 sv
zdnskey.fromtuplec K sr |j dd�}g }d}| jd k r0|dt| j�g7 }xlttjtj�D ]Z\}}| s@| j| r\q@d}|| j krx| j | rxd}|r�dn| j
| } ||| g7 }d}q@W |�rn|d| j g| | j g }
|s�t
ddj|
� � y0t|
ttd �} | j� \} }
|
�r tt|
���W n8 tk
�r: } ztd
|t|�f ��W Y d d }~X nX d | _x*tjD ] }| j| | j|< d| j|< �qJW d S ) N�quietFTz-LZnonez-Kz# � )�stdout�stderrzunable to run %s: %s)�getrb �strrY �zipr rf �_OPTSr\ r] r_ r9 rU �print�joinr r � communicate� Exceptionr` ra )r Z settime_bin�kwargsrm �cmd�firstr �opt�deleteZwhenZfullcmd�pro rp �er r r
�commit� s<
" z
dnskey.commitc K sL | j dd�} |dd|dt|�g}
|r0|
d|g7 }
|r>|
jd� |rN|
d|g7 }
|rb|
d t|�g7 }
| r�tj| �}|
d
tj|�g7 }
|
r�tj|
�}|
d tj|
�g7 }
|
j|� | s�td d
j|
� � t|
t t d�}|j
� \}}|r�t dt|� ��y"|j � d j
d�}t|||�}|S t k
�rF } zt dt|� ��W Y d d }~X nX d S )Nrm Fz-qz-Kz-Lz-rz-fkz-az-bz-Pz-Az# rn )ro rp zunable to generate key: r �asciiz!unable to parse generated key: %s)rq rr �appendr �
timefromepochrh ru rv r r rw rx �
splitlines�decode)�cls�
keygen_bin� randomdevZkeys_dirrB rC ZkeysizerT rY �publish�activatery rm �
keygen_cmdrl r~ ro rp rU �newkeyr r r r
�generate� s:
zdnskey.generatec
K s� |j dd�}| j� s td| ��|dd| jd| jg}| jrL|dt| j�g7 }|r\|d|g7 }|rp|d t|�g7 }|s�td
d j|� � t |t
t
d �}|j � \}} | r�td
| ��y&|j � d j
d�}
t|
| j| j�} | S td| ��Y nX d S )Nrm Fz'predecessor key %s has no inactive datez-qz-Kz-Sz-Lz-rz-iz# rn )ro rp zunable to generate key: r r� z'unable to generate successor for key %s)rq �inactiverx r9 rU rY rr ru rv r r rw r� r� r ) r r� r� Z
prepublishry rm r� r~ ro rp rU r� r r r
�generate_successor� s, zdnskey.generate_successorc C s0 d }| t ttj��kr tj| }|r(|S d| S )Nz%03d)�ranger8 r � _ALGNAMES)rC rB r r r
�algstr� s
z
dnskey.algstrc C s6 | sd S | j � } y tjj| �S tk
r0 d S X d S )N)�upperr r� �index�
ValueError)rC r r r
�algnum� s z
dnskey.algnumc C s | j |p | j�S )N)r� rC )r rC r r r
�algname s zdnskey.algnamec C s
t j| �S )N)�timeZgmtime)�secsr r r
r� s zdnskey.timefromepochc C s t j| d�S )Nz %Y%m%d%H%M%S)r� Zstrptime)�stringr r r
rg s zdnskey.parsetimec C s
t j| �S )N)�calendarZtimegm)rl r r r
ri s zdnskey.epochfromtimec C s t jd| �S )Nz %Y%m%d%H%M%S)r� Zstrftime)rl r r r
rh s zdnskey.formattimec K s� |j dd�}| j| |kr d S | j| d k rR| j| |k rR| rRt| || j| ��|d kr�| j| d krldnd| j|< d| j|< d | j|< d | j|< d | j|< d S | j|�}|| j|< || j|< | j |�| j|< | j| | j| kr�dnd| j|< d S )N�forceFT)
rq r` ra r r\ r] r^ r_ r� rh )r r r� �nowry r� rl r r r
�setmeta s$
zdnskey.setmetac C s
| j | S )N)r^ )r r r r r
�gettime2 s zdnskey.gettimec C s
| j | S )N)r_ )r r r r r
�
getfmttime5 s zdnskey.getfmttimec C s
| j | S )N)r` )r r r r r
� gettimestamp8 s zdnskey.gettimestampc C s
| j d S )Nr )r` )r r r r
�created; s zdnskey.createdc C s
| j d S )Nr )r` )r r r r
� syncpublish> s zdnskey.syncpublishc K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
�setsyncpublishA s zdnskey.setsyncpublishc C s
| j d S )Nr )r` )r r r r
r� D s zdnskey.publishc K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
�
setpublishG s zdnskey.setpublishc C s
| j d S )Nr )r` )r r r r
r� J s zdnskey.activatec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setactivateM s zdnskey.setactivatec C s
| j d S )Nr )r` )r r r r
�revokeP s z
dnskey.revokec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setrevokeS s zdnskey.setrevokec C s
| j d S )Nr )r` )r r r r
r� V s zdnskey.inactivec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setinactiveY s zdnskey.setinactivec C s
| j d S )Nr )r` )r r r r
r} \ s z
dnskey.deletec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setdelete_ s zdnskey.setdeletec C s
| j d S )Nr )r` )r r r r
�
syncdeleteb s zdnskey.syncdeletec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
�
setsyncdeletee s zdnskey.setsyncdeletec C sR |d ks| j |krd S | jd kr0| j | _|| _ n | j|krHd | _|| _ n|| _ d S )N)rY rb )r rY r r r
�setttlh s
z
dnskey.setttlc C s | j r
dS dS )N�KSK�ZSK)rT )r r r r
�keytypet s zdnskey.keytypec C s d| j | j� | jf S )Nz
%s/%s/%05d)rB r� rD )r r r r
�__str__w s zdnskey.__str__c C s" d| j | j� | j| jrdndf S )Nz%s/%s/%05d (%s)r� r� )rB r� rD rT )r r r r
�__repr__{ s zdnskey.__repr__c C s | j � p| j� p| j� S )N)r� r� r� )r r r r
�date� s z dnskey.datec C s@ | j |j kr| j |j k S | j|jkr0| j|jk S | j� |j� k S )N)rB rC r� )r �otherr r r
�__lt__� s
z
dnskey.__lt__c C s� dd� }|s|}t tj� �}| j� }| j� }|s4dS |sT||krP|dt| � � dS ||krh||krhdS ||kr�|dt| �tj| j�p�df � dS ||k r�|dt| � � dS | jd k r�|| | jk r�|d t| �tj| j�p�df � dS dS )
Nc _ s d S )Nr )�argsry r r r
�noop� s z!dnskey.check_prepub.<locals>.noopFzFWARNING: Key %s is scheduled for
activation but not for publication.Tz�WARNING: %s is scheduled to be
published and activated at the same time. This
could result in a coverage gap if the zone was
previously signed. Activation should be at least
%s after publication.zone DNSKEY TTLz0WARNING: Key %s is active before it is publishedz�WARNING: Key %s is activated too soon
after publication; this could result in coverage
gaps due to resolver caches containing old data.
Activation should be at least %s after
publication.)r@ r� r� r� �reprr �durationrY )r �outputr� r� �ar~ r r r
� check_prepub� s< zdnskey.check_prepubc C s� dd� }|d kr|}|d kr"| j }|d kr>|dt| � � d }tj� }| j� }| j� }|s^dS |s~||krz|dt| � � dS ||k r�||k r�dS ||k r�|d t| � � dS || |k r�|d
t| �tj|�f � dS dS )
Nc _ s d S )Nr )r� ry r r r
r� � s z"dnskey.check_postpub.<locals>.noopz"WARNING: Key %s using default TTL.�< � FzEWARNING: Key %s is scheduled for
deletion but not for inactivation.Tz@WARNING: Key %s is scheduled for
deletion before inactivation.z�WARNING: Key %s scheduled for
deletion too soon after deactivation; this may
result in coverage gaps due to resolver caches
containing old data. Deletion should be at least
%s after inactivation.i i�Q )rY r� r� r} r� r r� )r r� Ztimespanr� r� �d�ir r r
�
check_postpub� s: zdnskey.check_postpubc C sz | sd S dddd d d g}g }xR|D ]J}| |d | |d }} |d kr"|j d
||d |d krbdndf � q"W dj|�S ) N�yearr� r� im �month� �day�hour�minute�secondr4 r z%d %s%s�srE z, i i�Q �3�)r� r� i i�Q � �' )r� r� i �Q )r� r� � )r� r� )r� r� )r� r4 )r� rv )r� Zunitsr� Zunit�vr r r
r� � s
(zdnskey.duration) r r r r r r r r r ) Nr r r r r Nr! r" )Nr# r$ r% r& r' r( r) r* Nr+ Nr, r- r. r/ r0 )NN)NN)N)N)NN)2r r r �__doc__rf rt r� r r: r� � classmethodr� r� � staticmethodr� r� r� r� rg ri rh r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r} r� r� r� r� r� r� r� r� r� r� r� r� r r r r
r sb
M% *
1
-r ) r; r� r� �
subprocessr r rx r r r r r r
�<module> s
__pycache__/coverage.cpython-36.pyc 0000644 00000014323 15173300436 0013202 0 ustar 00 3
�!�i�& � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z dZ d dl
mZmZmZmZmZmZ dd� Zdad d
� Zd d � Zd
d� Zddd�Zdd� Zdd� ZdS )� )�print_functionN)� defaultdictzdnssec-coverage)�dnskey� eventlist�keydict�keyevent�keyzone�utilsc O s t | |� tjd� d S )N� )�print�sys�exit)�args�kwargs� r � /usr/lib/python3.6/coverage.py�fatal s
r Tc O sJ d|kr |d }|j dd� nd}tr,dan |r8td� | rFt| |� dS )zuoutput text, adding a vertical space this is *not* the first
first section being printed since a call to vreset()�skipNTF� )�pop�
_firstliner )r r r r r r �output' s r c C s da dS )zreset vertical spacingTN)r r r r r �vreset8 s r c C s� | j � } yt| �S tk
r$ Y nX tjd�}|j| �}|sJtd| ��|j� \}}t|�}|j� }|jd�rx|d S |jd�r�|d S |jd�r�|d S |jd �r�|d
S |jd �r�|d S |jd
�r�|d S |jd�r�|S td| ��dS )z� convert a formatted time (e.g., 1y, 6mo, 15mi, etc) into seconds
:param s: String with some text representing a time interval
:return: Integer with the number of seconds in the time interval
z([0-9][0-9]*)\s*([A-Za-z]*)zCannot parse %s�yi�3��moi �' �wi�: �di�Q �hi Zmi�< �szInvalid suffix %sN) �strip�int�
ValueError�re�compile�match�groups�lower�
startswith)r �r�m�nZunitr r r �
parse_timeA s6
r, c C s� |}| s(t jj|� s(t j|t j� r�t jd }|s>t jj}xB|jt j�D ]2}t jj || �}t jj|�rzt j|t j�rzP d}qLW |S )a1 find the location of a specified command. if a default is supplied
and it works, we use it; otherwise we search PATH for a match.
:param command: string with a command to look for in the path
:param default: default location to use
:return: detected location for the desired command
�PATHN)
�os�path�isfile�access�X_OK�environ�defpath�split�pathsep�join)Zcommand�defaultZfpathr/ Z directoryr r r �set_pathk s $
r9 c 0 C sD t dtjjtjd�d��} tjtd d d�}|j dt
dddFd � |j d d
dt
ddd� |j ddt
ddd� |j ddt
ddd� |j dd t
d dd� |j d d d t
d!dd� |j d"d#| t
d$d
d� |j d%d&t
d'd(dd)� |j d*d+d,d-d.d/� |j d0d1d,d-d2d/� |j d3d4d5d,d-d6d/� |j d7d8d9tj d:� |j � }|j
�rJ|j�rJtd;� n*|j
�sZ|j�rn|j
�rfd<nd=|_nd|_|j�r�t|j�d>k�r�td?� d@dA� |jD �|_y |j�r�t|j�}||_W n tk
�r� Y nX y |j�r�t|j�}||_W n tk
�r Y nX y |j�r(t|j�}||_W n tk
�r@ Y nX y<|j�r||j}t|j�}|dBk�rnd|_ntj� | |_W n tk
�r� Y nX |j�r�|j�r�|S |j�r*|j�r*y:t|jdB |j|j �}|j�p�|j|_|j�p�|j|_W n4 t k
�r( } zt dC|j |� W Y dd}~X nX |j�s@t dD� dE|_|S )Gz8Read command line arguments, set global 'args' structureznamed-compilezoneZsbinz: checks future zDNSKEY coverage for a zone)� description�zone�*Nzzone(s) to checkz%(default: all zones in the directory))�type�nargsr8 �helpz-Kr/ �.z&a directory containing keys to process�dir)�destr8 r= r? �metavarz-f�filenamezzone master file�file)rB r= r? rC z-m�maxttlz the longest TTL in the zone(s)�timez-d�keyttlzthe DNSKEY TTLz-r�resignZ1944000z:the RRSIG refresh interval in seconds [default: 22.5 days]z-c� compilezonezpath to 'named-compilezone'z-l�
checklimit�0zDLength of time to check for DNSSEC coverage [default: 0 (unlimited)])rB r= r8 r? rC z-z�no_ksk�
store_trueFz#Only check zone-signing keys (ZSKs))rB �actionr8 r? z-k�no_zskz"Only check key-signing keys (KSKs)z-Dz--debugZ
debug_modezTurn on debugging outputz-vz --version�version)rO rQ z)ERROR: -z and -k cannot be used together.ZKSKZZSKr
z)ERROR: -f can only be used with one zone.c S s4 g | ],}t |�d kr,|d dkr,|dd� n|�qS )r
r@ N���rR )�len)�.0�xr r r �
<listcomp>� s z parse_args.<locals>.<listcomp>r z"Unable to load zone data from %s: z�WARNING: Maximum TTL value was not specified. Using 1 week
(604800 seconds); re-run with the -m option to get more
accurate results.i�: z5zone(s) to check(default: all zones in the directory)) r9 r. r/ r7 r �prefix�argparse�ArgumentParser�prog� add_argument�strrQ �
parse_argsrP rM r �keytyperD rS r; rF r, r" rH rI rK rG r rJ � Exceptionr r ) rJ �parserr r* �kr) Zlimr; �er r r r] � s�
"r] c ( C sp t � } td� yt| j| j| jd�}W n2 tk
rX } ztdt|� � W Y d d }~X nX x<|D ]4}|j t
� |j r�|j t
� q`|j t
| j
| j � q`W t
d� t� y t|�}W n2 tk
r� } ztdt|� � W Y d d }~X nX d}| j�s|jd | j| jt
��sXd}nJxH| jD ]>}y |j|| j| jt
��s6d}W n t
d| � Y nX �qW tj|�rfd nd
� d S ) Nz;PHASE 1--Loading keys to check for internal timing problems)r/ ZzonesrH z'ERROR: Unable to build key dictionary: z9PHASE 2--Scanning future key events for coverage failuresz#ERROR: Unable to build event list: FTz&ERROR: Coverage check failed for zone r
r )r] r r r/ r; rH r_ r r\ Z check_prepubr �sepZ
check_postpubrF rI r r Zcoverager^ rK r r
)r Zkdrb �keyZelist�errorsr; r r r �main� s: "
"
rf )N) Z
__future__r r. r rX Zglobr# rG Zcalendar�pprint� collectionsr rZ Ziscr r r r r r r r r r r, r9 r] rf r r r r �<module> s& *
x __pycache__/dnskey.cpython-36.pyc 0000644 00000032530 15173300436 0012704 0 ustar 00 3
�!�i @ � @ sJ d dl Z d dlZd dlZd dlmZmZ G dd� de�ZG dd� d�ZdS )� N)�Popen�PIPEc s e Zd Z� fdd�Z� ZS )�TimePastc s t t| �jd|||f � d S )Nz'%s time for key %s (%d) is already past)�superr �__init__)�self�key�prop�value)� __class__� � /usr/lib/python3.6/dnskey.pyr s zTimePast.__init__)�__name__�
__module__� __qualname__r �
__classcell__r r )r r
r s r c @ s� e Zd ZdZdqZdrZdsZdtd!d"�Zd#d$� Zd%d&� Z e
dud'd(��Z d)d*� Z e
d+d,� �Ze
d-d.� �Zdvd/d0�Ze
d1d2� �Ze
d3d4� �Ze
d5d6� �Ze
d7d8� �Zd9d:� Zd;d<� Zd=d>� Zd?d@� ZdAdB� ZdCdD� Zej� fdEdF�Z dGdH� Z ej� fdIdJ�Z dKdL� Z ej� fdMdN�Z dOdP� Z!ej� fdQdR�Z"dSdT� Z#ej� fdUdV�Z$dWdX� Z%ej� fdYdZ�Z&d[d\� Z'ej� fd]d^�Z(d_d`� Z)dadb� Z*dcdd� Z+dedf� Z,dgdh� Z-didj� Z.dwdkdl�Z/dxdmdn�Z0e
dodp� �Z1d S )y�dnskeyztAn individual DNSSEC key. Identified by path, name, algorithm, keyid.
Contains a dictionary of metadata events.�Created�Publish�Activate�Inactive�Delete�Revoke� DSPublish� SyncPublish�
SyncDeleteN�-P�-A�-I�-D�-R�-Psync�-Dsync�RSAMD5�DH�DSA�ECC�RSASHA1�NSEC3DSA� NSEC3RSASHA1� RSASHA256� RSASHA512�ECCGOST�ECDSAP256SHA256�ECDSAP384SHA384�ED25519�ED448c C s� t |t�r:t|�dkr:|p d| _|\}}}| j||||� |pLtjj|�pLd| _tjj|�}|j d�\}}}|dd� }t
|�}t
|j d�d �}| j||||� d S )N� �.�+� r ���) �
isinstance�tuple�len�_dir� fromtuple�os�path�dirname�basename�split�int)r r Z directory�keyttl�name�alg�keyidr r r
r & s
zdnskey.__init__c s� |j d�r|}|jd�}n|d }d|||f }| j| jr@tjpBd | d }| j| jr^tjp`d | d }|| _|| _t|�| _t|�| _ || _
t |d�} x�| D ]z� � d dkr�q�� j � }
|
s�q�|
d j
� dkr�d
} || _nd} |s�t|
d �n|| _t|
| �d @ d k�rd| _q�d| _q�W | j� t |d�} t� | _t� | _t� | _t� | _t� | _t� | _t� | _d | _x�| D ]�� � j� � � �sv� d dk�r��qv� fdd�dD �t� �g }
tdd� |
D ��}� d |� j� }� |d � j d�j� }|| j|< �qvW x�t j D ]�}d| j|< || jk�rn| j | j| �}|| j|< | j |�| j|< | j!|�| j|< | j| | j|< n(d | j|< d | j|< d | j|< d | j|< �qW | j� d S )Nr2 z
K%s+%03d+%05d� z.keyz.private�rr �;r4 �in�ch�hsr1 � TFZrUz!#c s g | ]}� j |��qS r )�find)�.0�c)�liner r
�
<listcomp>l s z$dnskey.fromtuple.<locals>.<listcomp>z:= c S s g | ]}|dkr|�qS )r4 r5 r )rM �posr r r
rP m s )rH rI rJ )"�endswith�rstripr9 r; �sep�keystrrB r@ rC rD �fullname�openr? �lower�ttl�close�dictZmetadata�_changed�_delete�_times�_fmttime� _timestamps� _original�_origttl�stripr8 �min�lstripr �_PROPS� parsetime�
formattime�
epochfromtime)r rB rC rD rA rV rU Zkey_fileZ private_fileZkfp�tokensZseptokenZpfpZ punctuation�foundr
r �tr )rO r
r: 5 sv
zdnskey.fromtuplec K sr |j dd�}g }d}| jd k r0|dt| j�g7 }xlttjtj�D ]Z\}}| s@| j| r\q@d}|| j krx| j | rxd}|r�dn| j
| } ||| g7 }d}q@W |�rn|d| j g| | j g }
|s�t
ddj|
� � y0t|
ttd �} | j� \} }
|
�r tt|
���W n8 tk
�r: } ztd
|t|�f ��W Y d d }~X nX d | _x*tjD ] }| j| | j|< d| j|< �qJW d S ) N�quietFTz-LZnonez-Kz# � )�stdout�stderrzunable to run %s: %s)�getrb �strrY �zipr rf �_OPTSr\ r] r_ r9 rU �print�joinr r � communicate� Exceptionr` ra )r Z settime_bin�kwargsrm �cmd�firstr �opt�deleteZwhenZfullcmd�pro rp �er r r
�commit� s<
" z
dnskey.commitc K sL | j dd�} |dd|dt|�g}
|r0|
d|g7 }
|r>|
jd� |rN|
d|g7 }
|rb|
d t|�g7 }
| r�tj| �}|
d
tj|�g7 }
|
r�tj|
�}|
d tj|
�g7 }
|
j|� | s�td d
j|
� � t|
t t d�}|j
� \}}|r�t dt|� ��y"|j � d j
d�}t|||�}|S t k
�rF } zt dt|� ��W Y d d }~X nX d S )Nrm Fz-qz-Kz-Lz-rz-fkz-az-bz-Pz-Az# rn )ro rp zunable to generate key: r �asciiz!unable to parse generated key: %s)rq rr �appendr �
timefromepochrh ru rv r r rw rx �
splitlines�decode)�cls�
keygen_bin� randomdevZkeys_dirrB rC ZkeysizerT rY �publish�activatery rm �
keygen_cmdrl r~ ro rp rU �newkeyr r r r
�generate� s:
zdnskey.generatec
K s� |j dd�}| j� s td| ��|dd| jd| jg}| jrL|dt| j�g7 }|r\|d|g7 }|rp|d t|�g7 }|s�td
d j|� � t |t
t
d �}|j � \}} | r�td
| ��y&|j � d j
d�}
t|
| j| j�} | S td| ��Y nX d S )Nrm Fz'predecessor key %s has no inactive datez-qz-Kz-Sz-Lz-rz-iz# rn )ro rp zunable to generate key: r r� z'unable to generate successor for key %s)rq �inactiverx r9 rU rY rr ru rv r r rw r� r� r ) r r� r� Z
prepublishry rm r� r~ ro rp rU r� r r r
�generate_successor� s, zdnskey.generate_successorc C s0 d }| t ttj��kr tj| }|r(|S d| S )Nz%03d)�ranger8 r � _ALGNAMES)rC rB r r r
�algstr� s
z
dnskey.algstrc C s6 | sd S | j � } y tjj| �S tk
r0 d S X d S )N)�upperr r� �index�
ValueError)rC r r r
�algnum� s z
dnskey.algnumc C s | j |p | j�S )N)r� rC )r rC r r r
�algname s zdnskey.algnamec C s
t j| �S )N)�timeZgmtime)�secsr r r
r� s zdnskey.timefromepochc C s t j| d�S )Nz %Y%m%d%H%M%S)r� Zstrptime)�stringr r r
rg s zdnskey.parsetimec C s
t j| �S )N)�calendarZtimegm)rl r r r
ri s zdnskey.epochfromtimec C s t jd| �S )Nz %Y%m%d%H%M%S)r� Zstrftime)rl r r r
rh s zdnskey.formattimec K s� |j dd�}| j| |kr d S | j| d k rR| j| |k rR| rRt| || j| ��|d kr�| j| d krldnd| j|< d| j|< d | j|< d | j|< d | j|< d S | j|�}|| j|< || j|< | j |�| j|< | j| | j| kr�dnd| j|< d S )N�forceFT)
rq r` ra r r\ r] r^ r_ r� rh )r r r� �nowry r� rl r r r
�setmeta s$
zdnskey.setmetac C s
| j | S )N)r^ )r r r r r
�gettime2 s zdnskey.gettimec C s
| j | S )N)r_ )r r r r r
�
getfmttime5 s zdnskey.getfmttimec C s
| j | S )N)r` )r r r r r
� gettimestamp8 s zdnskey.gettimestampc C s
| j d S )Nr )r` )r r r r
�created; s zdnskey.createdc C s
| j d S )Nr )r` )r r r r
� syncpublish> s zdnskey.syncpublishc K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
�setsyncpublishA s zdnskey.setsyncpublishc C s
| j d S )Nr )r` )r r r r
r� D s zdnskey.publishc K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
�
setpublishG s zdnskey.setpublishc C s
| j d S )Nr )r` )r r r r
r� J s zdnskey.activatec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setactivateM s zdnskey.setactivatec C s
| j d S )Nr )r` )r r r r
�revokeP s z
dnskey.revokec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setrevokeS s zdnskey.setrevokec C s
| j d S )Nr )r` )r r r r
r� V s zdnskey.inactivec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setinactiveY s zdnskey.setinactivec C s
| j d S )Nr )r` )r r r r
r} \ s z
dnskey.deletec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
� setdelete_ s zdnskey.setdeletec C s
| j d S )Nr )r` )r r r r
�
syncdeleteb s zdnskey.syncdeletec K s | j d||f|� d S )Nr )r� )r r� r� ry r r r
�
setsyncdeletee s zdnskey.setsyncdeletec C sR |d ks| j |krd S | jd kr0| j | _|| _ n | j|krHd | _|| _ n|| _ d S )N)rY rb )r rY r r r
�setttlh s
z
dnskey.setttlc C s | j r
dS dS )N�KSK�ZSK)rT )r r r r
�keytypet s zdnskey.keytypec C s d| j | j� | jf S )Nz
%s/%s/%05d)rB r� rD )r r r r
�__str__w s zdnskey.__str__c C s" d| j | j� | j| jrdndf S )Nz%s/%s/%05d (%s)r� r� )rB r� rD rT )r r r r
�__repr__{ s zdnskey.__repr__c C s | j � p| j� p| j� S )N)r� r� r� )r r r r
�date� s z dnskey.datec C s@ | j |j kr| j |j k S | j|jkr0| j|jk S | j� |j� k S )N)rB rC r� )r �otherr r r
�__lt__� s
z
dnskey.__lt__c C s� dd� }|s|}t tj� �}| j� }| j� }|s4dS |sT||krP|dt| � � dS ||krh||krhdS ||kr�|dt| �tj| j�p�df � dS ||k r�|dt| � � dS | jd k r�|| | jk r�|d t| �tj| j�p�df � dS dS )
Nc _ s d S )Nr )�argsry r r r
�noop� s z!dnskey.check_prepub.<locals>.noopFzFWARNING: Key %s is scheduled for
activation but not for publication.Tz�WARNING: %s is scheduled to be
published and activated at the same time. This
could result in a coverage gap if the zone was
previously signed. Activation should be at least
%s after publication.zone DNSKEY TTLz0WARNING: Key %s is active before it is publishedz�WARNING: Key %s is activated too soon
after publication; this could result in coverage
gaps due to resolver caches containing old data.
Activation should be at least %s after
publication.)r@ r� r� r� �reprr �durationrY )r �outputr� r� �ar~ r r r
� check_prepub� s< zdnskey.check_prepubc C s� dd� }|d kr|}|d kr"| j }|d kr>|dt| � � d }tj� }| j� }| j� }|s^dS |s~||krz|dt| � � dS ||k r�||k r�dS ||k r�|d t| � � dS || |k r�|d
t| �tj|�f � dS dS )
Nc _ s d S )Nr )r� ry r r r
r� � s z"dnskey.check_postpub.<locals>.noopz"WARNING: Key %s using default TTL.�< � FzEWARNING: Key %s is scheduled for
deletion but not for inactivation.Tz@WARNING: Key %s is scheduled for
deletion before inactivation.z�WARNING: Key %s scheduled for
deletion too soon after deactivation; this may
result in coverage gaps due to resolver caches
containing old data. Deletion should be at least
%s after inactivation.i i�Q )rY r� r� r} r� r r� )r r� Ztimespanr� r� �d�ir r r
�
check_postpub� s: zdnskey.check_postpubc C sz | sd S dddd d d g}g }xR|D ]J}| |d | |d }} |d kr"|j d
||d |d krbdndf � q"W dj|�S ) N�yearr� r� im �month� �day�hour�minute�secondr4 r z%d %s%s�srE z, i i�Q �3�)r� r� i i�Q � �' )r� r� i �Q )r� r� � )r� r� )r� r� )r� r4 )r� rv )r� Zunitsr� Zunit�vr r r
r� � s
(zdnskey.duration) r r r r r r r r r ) Nr r r r r Nr! r" )Nr# r$ r% r& r' r( r) r* Nr+ Nr, r- r. r/ r0 )NN)NN)N)N)NN)2r r r �__doc__rf rt r� r r: r� � classmethodr� r� � staticmethodr� r� r� r� rg ri rh r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r} r� r� r� r� r� r� r� r� r� r� r� r� r r r r
r sb
M% *
1
-r ) r; r� r� �
subprocessr r rx r r r r r r
�<module> s
__pycache__/keyseries.cpython-36.pyc 0000644 00000010705 15173300437 0013413 0 ustar 00 3
�!�i" � @ sF d dl mZ ddlT ddlT ddlT ddlT d dlZG dd� d�ZdS )� )� defaultdict� )�*Nc @ sl e Zd Zedd� �Zedd� �Ze� ZdZdZ e
j
� dfdd�Z dd� Z d d
� Z
d d � Ze
j
� fd
d�ZdS )� keyseriesc C s t t�S )N)r �list� r r � /usr/lib/python3.6/keyseries.py�<lambda> s zkeyseries.<lambda>c C s t t�S )N)r r r r r r r s Nc C s� || _ || _t|j� �| _x�|j� D ]�}| jj|� x�|| j� D ]�\}}xh|j� D ]\}|j r�|j
� op|j
� |k s�| j | | j |� qT|j
� o�|j
� |k sT| j
| | j |� qTW | j | | j� | j
| | j� qBW q$W d S )N)�_kdict�_context�setZmissing�_zones�zones�add�items�values�sep�delete�_K�append�_Z�sort)�selfZkdict�now�context�zone�alg�keys�kr r r �__init__ s zkeyseries.__init__c c sb x\| j D ]R}xL| j| jgD ]<}||kr(qx,|| j� D ] \}}x|D ]
}|V qDW q6W qW qW d S )N)r
r r r )r r �
collectionr r �keyr r r �__iter__. s
zkeyseries.__iter__c C s" x | D ]}t dt|� � qW d S )Nz%s)�print�repr)r r r r r �dump7 s
zkeyseries.dumpc K s� |j dd�}|sd S |d }|jr>|j}|jp0d }|jp:d } n|j}|jpLd
}|jpVd} |j� }
|j � } |
sv|
|kr�|j
|� |}
| s�| |kr�|j |� |} |j � } d}
|s�|j
d|� |jd|� �n�| s�| | | k�r| �r(| | || |
k�r(|j
| | f|� |j| | | f|� n�| �s`|j
|| |
f|� |j|| | |
f|� n�| |k �rln�| | | k�r�|j
| | f|� |j| | | f|� np| | || |
k�r�|j
| | f|� |j| | | f|� n0|j
|| |
f|� |j|| | |
f|� n�|j� }| �s8| | ||
k�rL|j| | f|� nN|�sj|j|| |
f|� n0|||
k �rzn || | k �r�|j| | f|� |j|jk�r�|j|j� |}x�|dd � D ]�}|�s |j
d|� |j d|� |j
d|� |jd|� |j|jk�r�|j|j� �q�|j � } | | }
|j | f|� |j
|
f|� |j
| | f|� |j| | | f|� |j| | f|� |j|jk�r�|j|j� |}�q�W x�|�r>|j � �r>|j � ||j k �r>|j| jd f|� |j| jd | jd
|f|�}|j
|j � | f|� |j|j � | f|� |j|� |}�q�W |j
d|� |jd|� x"|D ]}|j| jd f|� �q^W d S )N�forceFr � i�Q i, r Z settime_path� keygen_path� randomdevi �' i �' i �' i �' )N)N)N)N)N)N)N)N)�getr Zksk_rollperiodZksk_prepublishZksk_postpublishZzsk_rollperiodZzsk_prepublishZzsk_postpublishZpublishZactivateZ
setpublishZ setactivateZinactiveZ setinactiveZ setdeleter �keyttlZttlZsetttlZcoverageZcommitr Zgenerate_successorr )r r �policyr �kwargsr& r! ZrpZprepubZpostpub�p�a�iZfudge�d�prevr r r � fixseries; s�
zkeyseries.fixseriesc K s� |j d| j�}|j d| jj dd ��}|j dd�}�x�|D �]�}g }|j|�} |pX| jpXd}| j}
tj|
�} d|ks||d r�t| j | | �dkr�tj
| jd | jd
|||
| j d| j p�d f|�} | j | | j
| � |j
| j | � d |ks�|d �rht| j| | �dk�rXtj
| jd | jd
|||
| jd
| j �p<d f|�} | j| | j
| � |j
| j| � x�|D ]�}
x||
j� D ]p\}}|| k�r��q|y| j|| |f|� W n@ tk
�r� } z"td|tj| �t|�f ��W Y d d }~X nX �q|W �qnW q8W d S )Nr �dirZ keys_pathr& F�.Zkskr r( r) i ZzskTz %s/%s: %s)r* r
r r, Z directory� algorithm�dnskey�algnum�lenr ZgenerateZ zsk_keysizer+ r r Z ksk_keysizer r3 � ExceptionZalgstr�str)r Zpoliciesr r- r Zkeys_dirr& r � collectionsr, r r8 r r r6 r �er r r �enforce_policy� sL
zkeyseries.enforce_policy)�__name__�
__module__� __qualname__r r r r r
r
r �timer r" r% r3 r> r r r r r s vr )r< r r7 ZkeydictZkeyeventr, rB r r r r r �<module> s __pycache__/eventlist.cpython-36.pyc 0000644 00000007327 15173300437 0013433 0 ustar 00 3
�!�i� � @ s6 d dl mZ ddlT ddlT ddlT G dd� d�ZdS )� )� defaultdict� )�*c @ s` e Zd Zedd� �Zedd� �Ze� ZdZdd� Z ddd�Z
d d
� Z e d d � �Z
e d
d� �ZdS )� eventlistc C s t t�S )N)r �list� r r � /usr/lib/python3.6/eventlist.py�<lambda> s zeventlist.<lambda>c C s t t�S )N)r r r r r r r s Nc
C s ddddddg}|| _ x�|j� D ]�}| jj|� x�|| j� D ]�\}}xj|j� D ]^}xX|D ]P}|j|�}|snqZt|||�} |jr�| j | | j
| � qZ| j | | j
| � qZW qPW t | j | | dd� d �| j | |< t | j | | d
d� d �| j | |< q>W q W d S ) NZ SyncPublishZPublishZ
SyncDeleteZActivateZInactiveZDeletec S s | j S )N)�when)�eventr r r r + s z$eventlist.__init__.<locals>.<lambda>)�keyc S s | j S )N)r
)r r r r r - s )
�_kdictZzones�_zones�add�items�valuesZgettime�keyevent�sep�_K�append�_Z�sorted)
�selfZkdictZ
properties�zone�alg�keys�kZprop�t�er r r �__init__ s&
zeventlist.__init__c C s dd� }|s|}|r |dkr dnd}|r4|dkr4dnd}d }} d}
|rb|| j krb|d| � dS |r�d}
|s~| j|d||�}|s�| j|d||�} n`x^| j D ]T} | r�| | jj� kr�d}
| j| d||�}| r�| | jj� kr�d}
| j| d||�} q�W |
�s|d� dS |�o| S ) Nc _ s d S )Nr )�args�kwargsr r r �noop2 s z eventlist.coverage.<locals>.noop�KSKTFZZSKz!ERROR: No key events found for %szERROR: No key events found)r � checkzoner r r ) r r �keytype�until�outputr" Zno_zskZno_kskZkokZzok�found�zr r r �coverage1 s6 zeventlist.coveragec C sx d}|dkr| j | }n
| j| }xP|j� D ]D}|d||tj|�f � tj|| |||�}|rh|d� |on|}q,W |S )NTr# z9Checking scheduled %s events for zone %s, algorithm %s...zNo errors found)r r r �dnskeyZalgstrr �checkset) r r r% r& r' ZallokZkzr �okr r r r$ T s
zeventlist.checkzonec C sR | sd S |d| d j � d dd� x(| D ] }|d|jt|j�f dd� q*W d S )Nz r �:F)�skipz
%s: %s)ZshowtimeZwhat�reprr )�eventsetr' r r r r �showsetf s
zeventlist.showsetc
C sN t � }t � }d}xZ| D ]R}d}| s4|d j|jkr>|j|� |d j|jkr|j|� t � }|j|� qW |rz|j|� |s�|d| � dS d }} x�|D ]�}|r�tj|d j�|kr�|dtjdtj|�� � dS x |D ]}|j|| �\}} q�W t j
||� |�s|d| � dS | �s,|d| � dS | j |�s�|d | � dS q�W dS )
NFTr zERROR: No %s events foundzIgnoring events after %sz%a %b %d %H:%M:%S UTC %Yz*ERROR: No %s's are active after this eventz-ERROR: No %s's are published after this eventz=ERROR: No %s's are both active and published after this event) r r
r ZcalendarZtimegmZtimeZstrftimeZgmtimeZstatusr r2 � intersection)
r1 r% r& r' �groups�groupZ eventsfoundr ZactiveZ publishedr r r r, n sL
zeventlist.checkset)N)�__name__�
__module__� __qualname__r r r �setr r
r r* r$ � staticmethodr2 r, r r r r r s
# r N)� collectionsr r+ Zkeydictr r r r r r �<module> s __pycache__/parsetab.cpython-36.opt-1.pyc 0000644 00000015224 15173300440 0014143 0 ustar 00 3
�"�i} � ; @ s
d Z dZdZddddddd d
d d d
g d ddd d d d d d d d g fddddddd d
d d d
g d ddd d d d d d d d g fddddddd d
dd d dd
ddgd ddd d d d d dd d dd d d gfddddd d
d d d
g dd d d d d d d d g fddgd d gfdddgd d d gfdd gd!d"gfddd#d$d%d&d'dgdd(d)d*d+d,d-d(gfdddd.gdd/d/d0gfd d1d d!dddd d(d/d2ddg
d! d! d
d d1 d d! d d d d3ddg
fd d(d/d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLd.dMdNdOdPdQd"d d0dRdSdTdUdVg*d d d d d d
dWd= d> dX d# d$ d% dY dd4 d3 d5 d d6 d dZ d7 d8 d9 d: d[d d d( dC d2 dd& d' dD d/ d d? d@ dA dB g*fd3ddZddWdd[dgdXdXdXdXd; d d< d gfd3ddZddWdd[dgd#d#d#d#d; d d< d gfd3ddZddWdd[dgd$d$d$d$d; d d< d gfd3ddZddWdd[dgd%d%d%d%d; d d< d gfd3ddZddWdd[dgdYdYdYdYd; d d< d gfd3ddZddWdd[dgd&d&d&d&d; d d< d gfd3ddZddWdd[dgd'd'd'd'd; d d< d gfddddgd d d d gfddddgddd d gfdZddWdd[dgdJdOd; d d< d gfdXdYd)d*d+d,d-gd.d.d.d.d.dUdVgfdXdYd)d*d+gdMdMdMdMdMgfd\�Zi ZxXej� D ]L\ZZx@eed ed �D ]*\Z Z
e ek �r�i ee < e
ee e< �q�W �q�W [dgdgfdgdgfddgdd
gfddgddgfddgddgfddgd d gfdgd1gfddgddQgfd d1dgd2ddgfd2gd4gfddgd5d6gfd3gdZgfd3dZgd7dKgfd3ddZdgd8dBd8dBgfd3ddZdgd9dCd9dCgfd3ddZdgd:dDd:dDgfd3ddZdgd;dEd;dEgfd3ddZdgd<dHd<dHgfd3ddZdgd=dFd=dFgfd3ddZdgd>dId>dIgfdgdgfddgd?dPgfddgd@d@gfddgdAdAgfddgdGdGgfdXdYd)d*d+gdLdNdRdSdTgfd]�Z i Z xXe j� D ]L\ZZx@eed ed �D ]*\Z Z
e e k �r�i e e < e
e e e< �q�W �q�W [ d^d_dd`d`d`fdadbddcdddefdfdbddcdddgfdhdiddjdddkfdldmddndddofdpdmddndddqfdrdmddndddsfdtduddvdddwfdxduddvdddyfdzduddvddd{fd|d}dd~dddfd�d}dd~ddd�fd�d}dd~ddd�fd�d}dd~ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�d�d dd�dfg6Z
d`S ( z3.8ZLALRZ C2FE91AF256AF1CCEB499107DA2CFE7E� � � � � � � �
� �. �> � � � � � � �/ �M �X � �; � � �= � �P �
� �< � �O �( �) �* �, �- � �E �F �G �I �J �C � �R � � � � � � � � �! �" �# �$ �% �& �0 �1 �2 �3 �4 �5 �6 �7 �8 �9 �: �? �@ �B �D �H �K �L �N �S �T �U �V �W �A �' �+ � �Q )ZALGORITHM_POLICYZZONEZPOLICYz$endZALGNAMEZSTRZQSTRINGZKEYTYPEZ
DATESUFFIX�LBRACE�SEMIZCOVERAGEZ ROLL_PERIODZ PRE_PUBLISHZ POST_PUBLISHZKEYTTLZKEY_SIZEZSTANDBYZ DIRECTORYZ ALGORITHM�RBRACE�NUMBERZNONE)�
policylist�init�policy�
alg_policy� zone_policy� named_policy�domain�name�
new_policy�alg_option_group�policy_option_group�alg_option_list�
alg_option�coverage_option�rollperiod_option�prepublish_option�postpublish_option�
keyttl_option�keysize_option�standby_option�policy_option_list�
policy_option�
parent_option�directory_option�algorithm_option�durationzS' -> policylistzS'Nzpolicylist -> init policyr^ Z p_policylistz policy.pyi z policylist -> policylist policyi zinit -> <empty>r_ Zp_initi zpolicy -> alg_policyr` Zp_policyi zpolicy -> zone_policyi zpolicy -> named_policyi z name -> STRre Zp_namei zname -> KEYTYPEi zname -> DATESUFFIXi z
domain -> STRrd Zp_domaini! zdomain -> QSTRINGi" zdomain -> KEYTYPEi# zdomain -> DATESUFFIXi$ znew_policy -> <empty>rf Z p_new_policyi+ zGalg_policy -> ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMIra Z p_alg_policyi/ z>zone_policy -> ZONE domain new_policy policy_option_group SEMIrb Z
p_zone_policyi6 z?named_policy -> POLICY name new_policy policy_option_group SEMIrc Zp_named_policyi= zduration -> NUMBERrw Z p_duration_1iC zduration -> NONEZ p_duration_2iH z duration -> NUMBER DATESUFFIXZ p_duration_3iM z7policy_option_group -> LBRACE policy_option_list RBRACErh Zp_policy_option_groupi` z(policy_option_list -> policy_option SEMIrr Zp_policy_option_listid z;policy_option_list -> policy_option_list policy_option SEMIie z policy_option -> parent_optionrs Zp_policy_optionii z!policy_option -> directory_optionij z policy_option -> coverage_optionik z"policy_option -> rollperiod_optionil z"policy_option -> prepublish_optionim z#policy_option -> postpublish_optionin z policy_option -> keysize_optionio z!policy_option -> algorithm_optionip z policy_option -> keyttl_optioniq z policy_option -> standby_optionir z1alg_option_group -> LBRACE alg_option_list RBRACErg Zp_alg_option_groupiv z"alg_option_list -> alg_option SEMIri Zp_alg_option_listiz z2alg_option_list -> alg_option_list alg_option SEMIi{ z alg_option -> coverage_optionrj Z p_alg_optioni z alg_option -> rollperiod_optioni� z alg_option -> prepublish_optioni� z alg_option -> postpublish_optioni� zalg_option -> keyttl_optioni� z alg_option -> keysize_optioni� z alg_option -> standby_optioni� z parent_option -> POLICY namert Zp_parent_optioni� z%directory_option -> DIRECTORY QSTRINGru Zp_directory_optioni� z$coverage_option -> COVERAGE durationrk Zp_coverage_optioni� z1rollperiod_option -> ROLL_PERIOD KEYTYPE durationrl Zp_rollperiod_optioni� z1prepublish_option -> PRE_PUBLISH KEYTYPE durationrm Zp_prepublish_optioni� z3postpublish_option -> POST_PUBLISH KEYTYPE durationrn Zp_postpublish_optioni� z)keysize_option -> KEY_SIZE KEYTYPE NUMBERrp Zp_keysize_optioni� z(standby_option -> STANDBY KEYTYPE NUMBERrq Zp_standby_optioni� z keyttl_option -> KEYTTL durationro Zp_keyttl_optioni� z%algorithm_option -> ALGORITHM ALGNAMErv Zp_algorithm_optioni� )Z _tabversionZ
_lr_methodZ
_lr_signatureZ_lr_action_itemsZ
_lr_action�itemsZ_kZ_v�zipZ_xZ_yZ_lr_goto_itemsZ_lr_gotoZ_lr_productions� rz rz � /usr/lib/python3.6/parsetab.py�<module> s� � � � � � � � __pycache__/utils.cpython-36.opt-1.pyc 0000644 00000002303 15173300440 0013474 0 ustar 00 3
�!�i� � @ sT d dl Z e jdkr"d dlZd dlZd dd�Zdd� ZdZe jdkrHd Zned
�ZdS ) � N�nt� c
C s t jdkrt jjd| �S tj}d}tj}d }d}ytj||d|�}W n d}Y nX |s�d}|tj B }ytj||d|�}W n d}Y nX |s�d}|tj
B }ytj||d|�}W n d}Y nX |r�ytj |d�\}} W n d}Y nX tj |� |�rt jj|| �S t jjtj
� | �S )Nr z/usrzSoftware\ISC\BINDTr FZ
InstallDir)�os�name�path�join�win32con�HKEY_LOCAL_MACHINEZKEY_READ�win32apiZ RegOpenKeyExZKEY_WOW64_64KEYZKEY_WOW64_32KEYZRegQueryValueExZ RegCloseKeyZGetSystemDirectory)
ZbindirZhklmZ bind_subkeyZsamZh_keyZ key_foundZsam64Zsam32Z
named_base�_� r �/usr/lib/python3.6/utils.py�prefix sD
r c C s2 t jdkr d| jdd� d S d| jdd� d S )Nr �"z"\"�'z'\'')r r �replace)�sr r r
�
shellquote= s
r z"9.11.36-RedHat-9.11.36-16.el8_10.7z/etcZetc)r )r r r r
r r �versionZ
sysconfdirr r r r
�<module> s
)
__pycache__/__init__.cpython-36.pyc 0000644 00000000744 15173300441 0013144 0 ustar 00 3
�!�i� �
@ sj d ddddddddd d
d d g
Z d
dlT d
dlT d
dlT d
dlT d
dlT d
dlT d
dlT d
dlT d
dl T dS )ZcheckdsZcoverageZkeymgrZdnskeyZ eventlistZkeydictZkeyeventZ keyseriesZkeyzoneZpolicyZparsetabZrndcZutils� )�*N)
�__all__Z
isc.dnskeyZ
isc.eventlistZ isc.keydictZ isc.keyeventZ
isc.keyseriesZ isc.keyzoneZ
isc.policyZisc.rndcZ isc.utils� r r � /usr/lib/python3.6/__init__.py�<module> s
__pycache__/eventlist.cpython-36.opt-1.pyc 0000644 00000007327 15173300442 0014366 0 ustar 00 3
�!�i� � @ s6 d dl mZ ddlT ddlT ddlT G dd� d�ZdS )� )� defaultdict� )�*c @ s` e Zd Zedd� �Zedd� �Ze� ZdZdd� Z ddd�Z
d d
� Z e d d � �Z
e d
d� �ZdS )� eventlistc C s t t�S )N)r �list� r r � /usr/lib/python3.6/eventlist.py�<lambda> s zeventlist.<lambda>c C s t t�S )N)r r r r r r r s Nc
C s ddddddg}|| _ x�|j� D ]�}| jj|� x�|| j� D ]�\}}xj|j� D ]^}xX|D ]P}|j|�}|snqZt|||�} |jr�| j | | j
| � qZ| j | | j
| � qZW qPW t | j | | dd� d �| j | |< t | j | | d
d� d �| j | |< q>W q W d S ) NZ SyncPublishZPublishZ
SyncDeleteZActivateZInactiveZDeletec S s | j S )N)�when)�eventr r r r + s z$eventlist.__init__.<locals>.<lambda>)�keyc S s | j S )N)r
)r r r r r - s )
�_kdictZzones�_zones�add�items�valuesZgettime�keyevent�sep�_K�append�_Z�sorted)
�selfZkdictZ
properties�zone�alg�keys�kZprop�t�er r r �__init__ s&
zeventlist.__init__c C s dd� }|s|}|r |dkr dnd}|r4|dkr4dnd}d }} d}
|rb|| j krb|d| � dS |r�d}
|s~| j|d||�}|s�| j|d||�} n`x^| j D ]T} | r�| | jj� kr�d}
| j| d||�}| r�| | jj� kr�d}
| j| d||�} q�W |
�s|d� dS |�o| S ) Nc _ s d S )Nr )�args�kwargsr r r �noop2 s z eventlist.coverage.<locals>.noop�KSKTFZZSKz!ERROR: No key events found for %szERROR: No key events found)r � checkzoner r r ) r r �keytype�until�outputr" Zno_zskZno_kskZkokZzok�found�zr r r �coverage1 s6 zeventlist.coveragec C sx d}|dkr| j | }n
| j| }xP|j� D ]D}|d||tj|�f � tj|| |||�}|rh|d� |on|}q,W |S )NTr# z9Checking scheduled %s events for zone %s, algorithm %s...zNo errors found)r r r �dnskeyZalgstrr �checkset) r r r% r& r' ZallokZkzr �okr r r r$ T s
zeventlist.checkzonec C sR | sd S |d| d j � d dd� x(| D ] }|d|jt|j�f dd� q*W d S )Nz r �:F)�skipz
%s: %s)ZshowtimeZwhat�reprr )�eventsetr' r r r r �showsetf s
zeventlist.showsetc
C sN t � }t � }d}xZ| D ]R}d}| s4|d j|jkr>|j|� |d j|jkr|j|� t � }|j|� qW |rz|j|� |s�|d| � dS d }} x�|D ]�}|r�tj|d j�|kr�|dtjdtj|�� � dS x |D ]}|j|| �\}} q�W t j
||� |�s|d| � dS | �s,|d| � dS | j |�s�|d | � dS q�W dS )
NFTr zERROR: No %s events foundzIgnoring events after %sz%a %b %d %H:%M:%S UTC %Yz*ERROR: No %s's are active after this eventz-ERROR: No %s's are published after this eventz=ERROR: No %s's are both active and published after this event) r r
r ZcalendarZtimegmZtimeZstrftimeZgmtimeZstatusr r2 � intersection)
r1 r% r& r' �groups�groupZ eventsfoundr ZactiveZ publishedr r r r, n sL
zeventlist.checkset)N)�__name__�
__module__� __qualname__r r r �setr r
r r* r$ � staticmethodr2 r, r r r r r s
# r N)� collectionsr r+ Zkeydictr r r r r r �<module> s __pycache__/checkds.cpython-36.opt-1.pyc 0000644 00000010272 15173300442 0013746 0 ustar 00 3
�!�i& � @ sh d dl Z d dlZd dlZd dlmZmZ d dlmZmZ dZ G dd� d�Z
d
dd�Z d d
� Z d d � Z
dS )� N)�Popen�PIPE)�prefix�versionzdnssec-checkdsc @ sP e Zd Zddddd�ZdZdZdZdZdZdZ d Z
dd
d �Z d d
� Z dd� Z
dS )�SECRRzSHA-1zSHA-256ZGOSTzSHA-384)� � � � � �INNr c C s� |st �t|�tk r$|jd�j� }n|j� }t|�dk r<t �|r�d| _|j� | _|d j� j d�jd�}|j
� |jd�}|j
� xDt|�dkr�t|�dkr�|d |d kr�|dd � }|dd � }q�W |r�t �|j
� dj |�| _ | j d | j d | _
nd| _|d j� | _
|dd � }|d j� dk�rJ|d j� | _|dd � }n(t|d �| _|d j� | _|d d � }|d j� | jk�r�t d |d j� | jf ��tt|dd
� �\| _| _| _dj |d
d � �j� | _d S )N�ascii� �DLVr �.r �DSr �CH�HSr z%s does not match %sr
r )r r r )� Exception�type�str�decode�split�len�rrtype�lower�dlvname�strip�reverse�join�parent�rrname�upper�rrclass�int�ttl�map�keyid�keyalg�hashalg�digest)�selfZrrtextr Zfieldsr �dlv� r- � /usr/lib/python3.6/checkds.py�__init__$ sH
* zSECRR.__init__c C s$ d| j | j| j| j| j| j| jf S )Nz%s %s %s %d %d %d %s)r! r# r r' r( r) r* )r+ r- r- r. �__repr__S s zSECRR.__repr__c C s | j � |j � kS )N)r0 )r+ �otherr- r- r. �__eq__X s z SECRR.__eq__)N)�__name__�
__module__� __qualname__�hashalgsr! r# r' r( r) r* r% r/ r0 r2 r- r- r- r. r s
/r c
C s& g }|j ddd|rdndd|r*| d | n| g}t|td�j� \}}x6|j� D ]*}t|�tk rh|jd �}|jt ||�� qNW t
|d
d � d �}g } |r�|j d
|g}|r�|d|g7 }|j| � t|td�j� \}}ndt|j ddddd| gtd�j� \}
}|j d
dg}|�r|d|g7 }|j| � t|ttd�j|
�\}}x:|j� D ].}t|�tk �rZ|jd �}| jt ||�� �q>W t | �dk �r�t
d� dS d} xv| D ]n} | |k�r�t
d| j| jjd�| j| jt j| j f � d} n,t
d| j| jjd�| j| jt j| j f � �q�W | �s"t
d|�rdnd � | S )Nz+noallz+answerz-tr, Zdsz-qr )�stdoutr
c S s | j | j| jfS )N)r' r( r) )�rrr- r- r. �<lambda>m s zcheck.<locals>.<lambda>)�keyz-fz-lZdnskey�-)�stdinr7 r z$No DNSKEY records found in zone apexFz,%s for KSK %s/%03d/%05d (%s) found in parentTz0%s for KSK %s/%03d/%05d (%s) missing from parentz'No %s records were found for any DNSKEYr r )�digr r Z communicate�
splitlinesr r r �appendr �sorted� dsfromkeyr �printr r! r r( r' r6 r) )
�zone�args�
masterfile� lookasideZrrlist�cmd�fp�_�lineZklistZintods�foundr8 r- r- r. �checkc sV
rL c C s� t jtd d�} d}tjdkr"dnd}| jdtdd� | jd d
d td d
� | jdddtdd
� | jdddtjjt |�d�tdd� | jdddtjjt |�d�tdd� | jd d d t
d � | j � }|j j
d �|_ |jr�|jj
d �|_|S )!Nz: checks DS coverage)� description�bin�ntZsbinrC z
zone to check)r �helpz-fz--filerE zzone master file)�destr rP z-lz --lookasiderF zDLV lookaside zonez-dz--digr= z
path to 'dig')rQ �defaultr rP z-Dz --dsfromkeyrA zdnssec-dsfromkeyzpath to 'dnssec-dsfromkey'z-vz --versionr )�actionr r )�argparse�ArgumentParser�prog�os�name� add_argumentr �pathr r r �
parse_argsrC r rF )�parserZbindirZsbindirrD r- r- r. r[ � s,
r[ c C s. t � } t| j| | j| j�}t|r$dnd� d S )Nr r )r[ rL rC rE rF �exit)rD rK r- r- r. �main� s r^ )NN)rT rW �sys�
subprocessr r Z isc.utilsr r rV r rL r[ r^ r- r- r- r. �<module> s I
; __pycache__/parsetab.cpython-36.pyc 0000644 00000015224 15173300443 0013207 0 ustar 00 3
�"�i} � ; @ s
d Z dZdZddddddd d
d d d
g d ddd d d d d d d d g fddddddd d
d d d
g d ddd d d d d d d d g fddddddd d
dd d dd
ddgd ddd d d d d dd d dd d d gfddddd d
d d d
g dd d d d d d d d g fddgd d gfdddgd d d gfdd gd!d"gfddd#d$d%d&d'dgdd(d)d*d+d,d-d(gfdddd.gdd/d/d0gfd d1d d!dddd d(d/d2ddg
d! d! d
d d1 d d! d d d d3ddg
fd d(d/d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLd.dMdNdOdPdQd"d d0dRdSdTdUdVg*d d d d d d
dWd= d> dX d# d$ d% dY dd4 d3 d5 d d6 d dZ d7 d8 d9 d: d[d d d( dC d2 dd& d' dD d/ d d? d@ dA dB g*fd3ddZddWdd[dgdXdXdXdXd; d d< d gfd3ddZddWdd[dgd#d#d#d#d; d d< d gfd3ddZddWdd[dgd$d$d$d$d; d d< d gfd3ddZddWdd[dgd%d%d%d%d; d d< d gfd3ddZddWdd[dgdYdYdYdYd; d d< d gfd3ddZddWdd[dgd&d&d&d&d; d d< d gfd3ddZddWdd[dgd'd'd'd'd; d d< d gfddddgd d d d gfddddgddd d gfdZddWdd[dgdJdOd; d d< d gfdXdYd)d*d+d,d-gd.d.d.d.d.dUdVgfdXdYd)d*d+gdMdMdMdMdMgfd\�Zi ZxXej� D ]L\ZZx@eed ed �D ]*\Z Z
e ek �r�i ee < e
ee e< �q�W �q�W [dgdgfdgdgfddgdd
gfddgddgfddgddgfddgd d gfdgd1gfddgddQgfd d1dgd2ddgfd2gd4gfddgd5d6gfd3gdZgfd3dZgd7dKgfd3ddZdgd8dBd8dBgfd3ddZdgd9dCd9dCgfd3ddZdgd:dDd:dDgfd3ddZdgd;dEd;dEgfd3ddZdgd<dHd<dHgfd3ddZdgd=dFd=dFgfd3ddZdgd>dId>dIgfdgdgfddgd?dPgfddgd@d@gfddgdAdAgfddgdGdGgfdXdYd)d*d+gdLdNdRdSdTgfd]�Z i Z xXe j� D ]L\ZZx@eed ed �D ]*\Z Z
e e k �r�i e e < e
e e e< �q�W �q�W [ d^d_dd`d`d`fdadbddcdddefdfdbddcdddgfdhdiddjdddkfdldmddndddofdpdmddndddqfdrdmddndddsfdtduddvdddwfdxduddvdddyfdzduddvddd{fd|d}dd~dddfd�d}dd~ddd�fd�d}dd~ddd�fd�d}dd~ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�dd�ddd�fd�d�d�d dd�dfg6Z
d`S ( z3.8ZLALRZ C2FE91AF256AF1CCEB499107DA2CFE7E� � � � � � � �
� �. �> � � � � � � �/ �M �X � �; � � �= � �P �
� �< � �O �( �) �* �, �- � �E �F �G �I �J �C � �R � � � � � � � � �! �" �# �$ �% �& �0 �1 �2 �3 �4 �5 �6 �7 �8 �9 �: �? �@ �B �D �H �K �L �N �S �T �U �V �W �A �' �+ � �Q )ZALGORITHM_POLICYZZONEZPOLICYz$endZALGNAMEZSTRZQSTRINGZKEYTYPEZ
DATESUFFIX�LBRACE�SEMIZCOVERAGEZ ROLL_PERIODZ PRE_PUBLISHZ POST_PUBLISHZKEYTTLZKEY_SIZEZSTANDBYZ DIRECTORYZ ALGORITHM�RBRACE�NUMBERZNONE)�
policylist�init�policy�
alg_policy� zone_policy� named_policy�domain�name�
new_policy�alg_option_group�policy_option_group�alg_option_list�
alg_option�coverage_option�rollperiod_option�prepublish_option�postpublish_option�
keyttl_option�keysize_option�standby_option�policy_option_list�
policy_option�
parent_option�directory_option�algorithm_option�durationzS' -> policylistzS'Nzpolicylist -> init policyr^ Z p_policylistz policy.pyi z policylist -> policylist policyi zinit -> <empty>r_ Zp_initi zpolicy -> alg_policyr` Zp_policyi zpolicy -> zone_policyi zpolicy -> named_policyi z name -> STRre Zp_namei zname -> KEYTYPEi zname -> DATESUFFIXi z
domain -> STRrd Zp_domaini! zdomain -> QSTRINGi" zdomain -> KEYTYPEi# zdomain -> DATESUFFIXi$ znew_policy -> <empty>rf Z p_new_policyi+ zGalg_policy -> ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMIra Z p_alg_policyi/ z>zone_policy -> ZONE domain new_policy policy_option_group SEMIrb Z
p_zone_policyi6 z?named_policy -> POLICY name new_policy policy_option_group SEMIrc Zp_named_policyi= zduration -> NUMBERrw Z p_duration_1iC zduration -> NONEZ p_duration_2iH z duration -> NUMBER DATESUFFIXZ p_duration_3iM z7policy_option_group -> LBRACE policy_option_list RBRACErh Zp_policy_option_groupi` z(policy_option_list -> policy_option SEMIrr Zp_policy_option_listid z;policy_option_list -> policy_option_list policy_option SEMIie z policy_option -> parent_optionrs Zp_policy_optionii z!policy_option -> directory_optionij z policy_option -> coverage_optionik z"policy_option -> rollperiod_optionil z"policy_option -> prepublish_optionim z#policy_option -> postpublish_optionin z policy_option -> keysize_optionio z!policy_option -> algorithm_optionip z policy_option -> keyttl_optioniq z policy_option -> standby_optionir z1alg_option_group -> LBRACE alg_option_list RBRACErg Zp_alg_option_groupiv z"alg_option_list -> alg_option SEMIri Zp_alg_option_listiz z2alg_option_list -> alg_option_list alg_option SEMIi{ z alg_option -> coverage_optionrj Z p_alg_optioni z alg_option -> rollperiod_optioni� z alg_option -> prepublish_optioni� z alg_option -> postpublish_optioni� zalg_option -> keyttl_optioni� z alg_option -> keysize_optioni� z alg_option -> standby_optioni� z parent_option -> POLICY namert Zp_parent_optioni� z%directory_option -> DIRECTORY QSTRINGru Zp_directory_optioni� z$coverage_option -> COVERAGE durationrk Zp_coverage_optioni� z1rollperiod_option -> ROLL_PERIOD KEYTYPE durationrl Zp_rollperiod_optioni� z1prepublish_option -> PRE_PUBLISH KEYTYPE durationrm Zp_prepublish_optioni� z3postpublish_option -> POST_PUBLISH KEYTYPE durationrn Zp_postpublish_optioni� z)keysize_option -> KEY_SIZE KEYTYPE NUMBERrp Zp_keysize_optioni� z(standby_option -> STANDBY KEYTYPE NUMBERrq Zp_standby_optioni� z keyttl_option -> KEYTTL durationro Zp_keyttl_optioni� z%algorithm_option -> ALGORITHM ALGNAMErv Zp_algorithm_optioni� )Z _tabversionZ
_lr_methodZ
_lr_signatureZ_lr_action_itemsZ
_lr_action�itemsZ_kZ_v�zipZ_xZ_yZ_lr_goto_itemsZ_lr_gotoZ_lr_productions� rz rz � /usr/lib/python3.6/parsetab.py�<module> s� � � � � � � � __pycache__/rndc.cpython-36.opt-1.pyc 0000644 00000012000 15173300443 0013260 0 ustar 00 3
�!�i+ � @ sX d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZG dd� de �Z
dS )� )� OrderedDictNc @ sl e Zd ZdZddddddd�Zd d
� Zd d � Zd dd�Zdd� Zdd� Z dd� Z
dd� Z dd� Z dd� Z
d S ) �rndcz RNDC protocol client library� � � � � � )�md5Zsha1Zsha224Zsha256Zsha384Zsha512c C sb || _ |j� }|jd�r$|dd� }|| _tt|�| _tj|�| _ t
j dd�| _ d| _
| j� dS )z�Creates a persistent connection to RNDC and logs in
host - (ip, port) tuple
algo - HMAC algorithm: one of md5, sha1, sha224, sha256, sha384, sha512
(with optional prefix 'hmac-')
secret - HMAC secret, base64 encodedzhmac-� Nr � � i )�host�lower�
startswith�algo�getattr�hashlib�hlalgo�base64� b64decode�secret�randomZrandint�ser�nonce�_rndc__connect_login)�selfr r r � r �/usr/lib/python3.6/rndc.py�__init__$ s
z
rndc.__init__c C s t | j|d�d �S )z�Call a RNDC command, all parsing is done on the server side
cmd - a complete string with a command (eg 'reload zone example.com')
)�type�_data)�dict�_rndc__command)r �cmdr r r �call5 s z rndc.callFc C s t � }�x |j� D ]�\}}|r(|dkr(q|tjdt|��|jd� 7 }t|�tkrt|tjddt|��|jd� 7 }qt|�tkr�|tjddt|��| 7 }qt|�t kr�|tjddt|��| 7 }qt|�t kr�| j
|�}|tjddt|��| 7 }qt dt|� ��qW |S )N�_auth�B�asciiz>BIr � z#Cannot serialize element of type %s) � bytearray�items�struct�pack�len�encoder �str�bytesr �_rndc__serialize_dict�NotImplementedError)r �data� ignore_auth�rv�k�vZsdr r r Z__serialize_dict; s" "
zrndc.__serialize_dictc O s, | j d7 _ ttj� �}t||�}t� }t� |d< t� |d< t| j �|d d< t|�|d d< t|d �|d d< | jd k r�| j|d d< ||d < | j|d
d �}tj| j || j
�j � }t j
|�}| jd kr�tjd
|�|d d< n"ttjd| j| j |��|d d< | j|�}tjdt|�d d�| }|S )Nr r& �_ctrlZ_serZ_tim�< Z_exp�_noncer! T)r5 r
Z22s�hmd5ZB88s�hshaz>II� )r �int�timer r0 r r2 �hmac�newr r �digestr Z b64encoder r, r- r* � _rndc__algosr. ) r �args�kwargsZnowr4 �d�msg�hash�bhashr r r Z__prep_messageO s,
zrndc.__prep_messagec C s� | j d k r |d d | j kr dS | jdkr8|d d }n|d d dd � }t|�tkrb|jd �}|d
d t|�d 7 }tj|�}| j|d d
�}t j
| j || j �j
� }||kS )Nr9 r; Fr
r& r< r= r r( �=r> T)r5 )r r r r1 �decoder. r r r2 rA rB r r rC )r rH rJ Z remote_hashZmy_msgZmy_hashr r r Z __verify_msgj s
zrndc.__verify_msgc O s� | j ||�}| jj|�}|t|�kr,td��| jjd�}t|�dkrLtd��tjd|�\}}|dkrptd| ��|d8 }| jj|tj �}t|�|kr�td��t
|�t kr�t |�}| j
|�}| j|�s�td ��|S )
NzCannot send the message� zCan't read response headerz>IIr zWrong message version %dr> zCan't read response datazAuthentication failure)�_rndc__prep_message�socket�sendr. �IOErrorZrecvr, �unpackr3 Z MSG_WAITALLr r0 r* �_rndc__parse_message�_rndc__verify_msg) r rE rF rH Zsent�headerZlength�versionr4 r r r Z __commandy s(
zrndc.__commandc C s2 t j| j�| _ d | _| jdd�}|d d | _d S )NZnull)r r9 r; )rO Zcreate_connectionr r r# )r rH r r r Z__connect_login� s zrndc.__connect_loginc C s� d}|| }|d7 }|||| � j d�}||7 }|| }|d7 }tjd|||d � �d }|d7 }|||| � }||7 }||d � }|dkr�|||fS |dkr�t� } x(t|�dkr�| j|�\}
} }| | |
< q�W || |fS td| ��d S )Nr r r( z>Ir> r) zUnknown element type %d)rL r, rR r r. �_rndc__parse_elementr3 ) r �input�posZlabellen�labelr Zdatalenr4 �restrG Zilabel�valuer r r Z__parse_element� s*
zrndc.__parse_elementc C s8 t � }d }x(t|�dkr2| j|�\}}}|||< q W |S )Nr )r r. rW )r rX r6 ZhdatarZ r\ r r r Z__parse_message� s zrndc.__parse_messageN)F)�__name__�
__module__� __qualname__�__doc__rD r r% r2 rN rT r# r rW rS r r r r r s
r ) � collectionsr r@ r, r rA r r rO �objectr r r r r �<module> s __pycache__/policy.cpython-36.pyc 0000644 00000046217 15173300444 0012714 0 ustar 00 3
�!�i2g � @ s: d dl Z d dljZd dljZd dlT d dlmZ G dd� d�ZG dd� d�ZG dd � d e �Z
G d
d � d �Z e d k�r6d dl
Z
e
jd
dkr�ee
jd �Zej� Zej� ed
d�Zeje� nxe
jd
dk�r6y4e e
jd ddd�Zeejd � eejd�� W n2 e k
�r4 Z zeejd � W Y ddZ[X nX dS )� N)�*)�copyc
@ s� e Zd Zd3Zed4 Zi ZdZdZdZdZ dZ
d d � Z d d � Z d d!� Z
d"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2S )5� PolicyLex�POLICY�ALGORITHM_POLICY�ZONE� ALGORITHM� DIRECTORY�KEYTTL�KEY_SIZE� ROLL_PERIOD� PRE_PUBLISH� POST_PUBLISH�COVERAGE�STANDBY�NONE�
DATESUFFIX�KEYTYPE�ALGNAME�STR�QSTRING�NUMBER�LBRACE�RBRACE�SEMIz z (//|\#).*z\{z\}�;c C s |j j|jjd�7 _dS )z\n+�
N)�lexer�lineno�value�count)�self�t� r# � /usr/lib/python3.6/policy.py� t_newline7 s zPolicyLex.t_newlinec C s |j j|jjd�7 _dS )z/\*(.|\n)*?\*/r N)r r r r )r! r" r# r# r$ � t_comment; s zPolicyLex.t_commentc C s t jd|j�jd�j� |_|S )z�(?i)(?<=[0-9 \t])(y(?:ears|ear|ea|e)?|mo(?:nths|nth|nt|n)?|w(?:eeks|eek|ee|e)?|d(?:ays|ay|a)?|h(?:ours|our|ou|o)?|mi(?:nutes|nute|nut|nu|n)?|s(?:econds|econd|econ|eco|ec|e)?)\bz (?i)(y|mo|w|d|h|mi|s)([a-z]*)� )�re�matchr �group�lower)r! r" r# r# r$ � t_DATESUFFIX? s zPolicyLex.t_DATESUFFIXc C s |j j� |_ |S )z(?i)\b(KSK|ZSK)\b)r �upper)r! r" r# r# r$ � t_KEYTYPED s zPolicyLex.t_KEYTYPEc C s |j j� |_ |S )z�(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b)r r- )r! r" r# r# r$ � t_ALGNAMEI s zPolicyLex.t_ALGNAMEc C s | j j|jd�|_|S )z[A-Za-z._-][\w._-]*r )� reserved_map�getr �type)r! r" r# r# r$ �t_STRN s zPolicyLex.t_STRc C s& | j j|jd�|_|jdd� |_|S )z"([^"\n]|(\\"))*"r r' ���)r0 r1 r r2 )r! r" r# r# r$ � t_QSTRINGS s zPolicyLex.t_QSTRINGc C s t |j�|_|S )z\d+)�intr )r! r" r# r# r$ �t_NUMBERY s zPolicyLex.t_NUMBERc C s" t d|jd � |jjd� d S )NzIllegal character '%s'r r' )�printr r �skip)r! r" r# r# r$ �t_error^ s zPolicyLex.t_errorc K sb dt t�krtjdd�}n
tdd�}x"| jD ]}|| j|j� j|�< q,W tjf d| i|��| _d S )N� maketrans�_�-�object) �dir�strr; �reservedr0 r+ � translate�lexr )r! �kwargsZtrans�rr# r# r$ �__init__b s
zPolicyLex.__init__c C s. | j j|� x | j j� }|s P t|� qW d S )N)r �input�tokenr8 )r! �textr" r# r# r$ �testk s
zPolicyLex.testN)
r r r r r r
r r r
r r r r ) r r r r r r r r r )�__name__�
__module__� __qualname__rA �tokensr0 Zt_ignoreZt_ignore_olcommentZt_LBRACEZt_RBRACEZt_SEMIr% r& r, r. r/ r3 r5 r7 r: rF rJ r# r# r# r$ r sN r c
@ s� e Zd ZdZdZdZdZdZdZdZ dZ
dZ dZ dZ
dZdZdZdZdZddgddgddgddgddgddgddgdddddd� Zddd�Zd d
� Zd d � Zd
d� Zdd� Zdd� ZdS )�PolicyFNi i i ) �DSA�NSEC3DSA�RSAMD5�RSASHA1� NSEC3RSASHA1� RSASHA256� RSASHA512�ECCGOST�ECDSAP256SHA256�ECDSAP384SHA384�ED25519�ED448c C s || _ || _|| _d S )N)�name� algorithm�parent)r! r\ r] r^ r# r# r$ rF � s zPolicy.__init__c C sF d| j r dp"| jrdp"| jr dp"d| jp*d| jr8| jjp:d| jrRdt| j� d pTd| jp\d| jrlt| j�pnd| j r~t| j �p�d| j
r�t| j
�p�d| j r�t| j �p�d| j r�t| j �p�d| j
r�t| j
�p�d| jr�t| j�p�d| jr�t| j�p�d| jr�t| j�p�d| j�rt| j��pd| j�r(t| j��p*d| j�r>t| j��p@df S ) Na %spolicy %s:
inherits %s
directory %s
algorithm %s
coverage %s
ksk_keysize %s
zsk_keysize %s
ksk_rollperiod %s
zsk_rollperiod %s
ksk_prepublish %s
ksk_postpublish %s
zsk_prepublish %s
zsk_postpublish %s
ksk_standby %s
zsk_standby %s
keyttl %s
z constructed zzone z
algorithm � ZUNKNOWN�None�")�is_constructed�is_zone�is_algr\ r^ � directoryr@ r] �coverage� ksk_keysize� zsk_keysize�ksk_rollperiod�zsk_rollperiod�ksk_prepublish�ksk_postpublish�zsk_prepublish�zsk_postpublish� ksk_standby� zsk_standby�keyttl)r! r# r# r$ �__repr__� s(
zPolicy.__repr__c C s |d | ko|d kS S )Nr r' r# )r! Zkey_sizeZ
size_ranger# r# r$ Z
__verify_size� s zPolicy.__verify_sizec C s | j S )N)r\ )r! r# r# r$ �get_name� s zPolicy.get_namec C s | j S )N)rb )r! r# r# r$ � constructed� s zPolicy.constructedc C s$ | j r:| jdk r:| j| j kr:t| j � dd| j| j f fS | j rj| jdk rj| j| j krjdd| j| j f fS | jr�| jdk r�| j| jkr�dd| j| jf fS | jr�| jdk r�| j| jkr�dd| j| jf fS | j o�| jo�| jo�| j| j | j k�rdd| j| j| j f fS | j�rL| j�rL| j�rL| j| j | jk�rLdd| j| j| jf fS | jdk �r | jj | j�}|dk �r�| j
| j |��s�dd
| j |f fS | j
| j |��s�dd | j |f fS | jd k�r�| j d dk�r�dd | j fS | jd k�r| j d dk�rdd | j fS | jd k�r d| _ d| _ d!S )"zr Check if the values in the policy make sense
:return: True/False if the policy passes validation
NFz6KSK pre-publish period (%d) exceeds rollover period %dz7KSK post-publish period (%d) exceeds rollover period %dz6ZSK pre-publish period (%d) exceeds rollover period %dz7ZSK post-publish period (%d) exceeds rollover period %dz%KSK pre/post-publish periods (%d/%d) z"combined exceed rollover period %dz%ZSK pre/post-publish periods (%d/%d) z&KSK key size %d outside valid range %sz&ZSK key size %d outside valid range %srP rQ �@ r z$KSK key size %d not divisible by 64 zas required for DSAz$ZSK key size %d not divisible by 64 rW rX rY rZ r[ Tr_ zGKSK pre/post-publish periods (%d/%d) combined exceed rollover period %dzGZSK pre/post-publish periods (%d/%d) combined exceed rollover period %d)rP rQ z7KSK key size %d not divisible by 64 as required for DSA)rP rQ z7ZSK key size %d not divisible by 64 as required for DSA)rW rX rY rZ r[ )Tr_ )
ri rk r8 rl rj rm rn r] �valid_key_sz_per_algor1 �_Policy__verify_sizerg rh )r! Z key_sz_ranger# r# r$ �validate� s�
zPolicy.validate)NNN)rK rL rM rc rd rb ri rj rk rm rl rn rg rh ro rp rq rf re rv rF rr rw rs rt rx r# r# r# r$ rO v sD
&rO c @ s e Zd ZdS )�PolicyExceptionN)rK rL rM r# r# r# r$ ry ) s ry c @ s. e Zd Zi Zi Zi ZdZdZdZdEdd�Z dd� Z
dd� Z d d
� Z d d � Z
d
d� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd'd(� Zd)d*� Z d+d,� Z d-d.� Z d/d0� Z d1d2� Z d3d4� Z!d5d6� Z"d7d8� Z#d9d:� Z$d;d<� Z%d=d>� Z&d?d@� Z'dAdB� Z(dCdD� Z)dS )F�
dnssec_policyNTc K s� t � | _| jj| _d|kr"d|d< d|kr2d|d< tjf d| i|��| _| jd� t� }d |_d|_d|_ d|_
t |�| j d< d| j d _d| j d _
d | j d _ t |�| j d
< d
| j d
_d
| j d
_
d | j d
_ t |�| j d < d | j d _d | j d _
t |�| j d < d | j d _d | j d _
t |�| j d
< d
| j d
_d
| j d
_
t |�| j d< d| j d _d| j d _
t |�| j d< d| j d _d| j d _
t |�| j d< d| j d _d| j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
t |�| j d< d| j d _d| j d _
d | j d _ d | j d _
|�r�| j|� d S )N�debugF� write_tables�modulea policy global { algorithm rsasha256;
key-size ksk 2048;
key-size zsk 2048;
roll-period ksk 0;
roll-period zsk 1y;
pre-publish ksk 1mo;
pre-publish zsk 1mo;
post-publish ksk 1mo;
post-publish zsk 1mo;
standby ksk 0;
standby zsk 0;
keyttl 1h;
coverage 6mo; };
policy default { policy global; };Ti rP i rQ rR rS rT rU rV rW rX rY rZ r[ )r �plexrN �yacc�parser�setuprO r] rd rg rh r �
alg_policyr\ �load)r! �filenamerD �pr# r# r$ rF 4 s|
zdnssec_policy.__init__c C sH || _ d| _t|��$}|j� }d| jj_| jj|� W d Q R X d | _ d S )NTr ) r� �initial�open�readr~ r r r� �parse)r! r� �frI r# r# r$ r� � s
zdnssec_policy.loadc C s d| _ d| jj_| jj|� d S )NTr )r� r~ r r r� r� )r! rI r# r# r$ r� � s
zdnssec_policy.setupc K s` |j � }d }|| jkr | j| }|d krBt| jd �}||_d|_|jd kr�|jpZ| jd }x|rr|j rr|j}q^W |r~|jp�d |_|j| jkr�| j|j }nt d��|j
d kr�|jp�| jd }x|d k r�|j
r�|j}q�W |o�|j
|_
|j d k�r:|j�p| jd }x |�r"|j �r"|j}�qW |�r2|j �p6|j |_ |j d k�r�|j�pV| jd }x |j�rv|j �rv|j}�qZW |�r�|j �p�|j |_ |j
d k�r�|j�p�| jd }x |j�r�|j
�r�|j}�q�W |�r�|j
�p�|j
|_
|jd k�r6|j�p�| jd }x |j�r |j �r |j}�qW |�r.|j�p2|j|_|jd k�r�|j�pR| jd }x |j�rr|j �rr|j}�qVW |�r�|j�p�|j|_|jd k�r�|j�p�| jd }x |j�r�|j �r�|j}�q�W |�r�|j�p�|j|_|jd k�r2|j�p�| jd }x |j�r|j �r|j}�q�W |�r*|j�p.|j|_|jd k�r�|j�pN| jd }x |j�rn|j �rn|j}�qRW |�r~|j�p�|j|_|jd k�r�|j�p�| jd }x |j�r�|j �r�|j}�q�W |�r�|j�p�|j|_|jd k�r(|j�p�| jd }x |d k �r|j �r|j}�q�W |�o$|j|_d|k�s>|d �r\|j� \}}|�s\t |��d S |S )N�defaultTzalgorithm not foundZ
novalidate)r+ � zone_policyr � named_policyr\ rb r] r^ r� ry re rf rg rh ri rj rk rm rl rn rq rx ) r! ZzonerD �zr� r^ ZapZvalid�msgr# r# r$ �policy� s�
zdnssec_policy.policyc C s dS )zBpolicylist : init policy
| policylist policyNr# )r! r� r# r# r$ � p_policylist
s zdnssec_policy.p_policylistc C s
d| _ dS )zinit :FN)r� )r! r� r# r# r$ �p_init s zdnssec_policy.p_initc C s dS )zTpolicy : alg_policy
| zone_policy
| named_policyNr# )r! r� r# r# r$ �p_policy s zdnssec_policy.p_policyc C s |d |d< dS )zAname : STR
| KEYTYPE
| DATESUFFIXr' r Nr# )r! r� r# r# r$ �p_name s zdnssec_policy.p_namec C s, |d j � |d< tjd|d �s(td��dS )zcdomain : STR
| QSTRING
| KEYTYPE
| DATESUFFIXr' r z^[\w.-][\w.-]*$zinvalid domainN)�stripr( r) ry )r! r� r# r# r$ �p_domain s zdnssec_policy.p_domainc C s t � | _dS )z new_policy :N)rO �current)r! r� r# r# r$ � p_new_policy* s zdnssec_policy.p_new_policyc C s( |d | j _d| j _| j | j|d < dS )zFalg_policy : ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMI� TN)r� r\ rd r� )r! r� r# r# r$ � p_alg_policy. s zdnssec_policy.p_alg_policyc C s8 |d j d�| j_d| j_| j| j|d j d�j� < dS )z=zone_policy : ZONE domain new_policy policy_option_group SEMIr� �.TN)�rstripr� r\ rc r� r+ )r! r� r# r# r$ �
p_zone_policy5 s zdnssec_policy.p_zone_policyc C s$ |d | j _| j | j|d j� < dS )z>named_policy : POLICY name new_policy policy_option_group SEMIr� N)r� r\ r� r+ )r! r� r# r# r$ �p_named_policy< s z dnssec_policy.p_named_policyc C s |d |d< dS )zduration : NUMBERr' r Nr# )r! r� r# r# r$ � p_duration_1B s zdnssec_policy.p_duration_1c C s d|d< dS )zduration : NONENr r# )r! r� r# r# r$ � p_duration_2G s zdnssec_policy.p_duration_2c C s� |d dkr |d d |d< n�|d dkr<|d d |d< n�|d dkrZ|d d |d< n||d d
krx|d d |d< n^|d d kr�|d d
|d< n@|d dkr�|d d |d< n"|d dkr�|d |d< nt d��dS )z duration : NUMBER DATESUFFIXr� �yr' i�3�r �moi �' �wi�: �di�Q �hi Zmi�< �szinvalid durationN)ry )r! r� r# r# r$ � p_duration_3L s zdnssec_policy.p_duration_3c C s dS )z6policy_option_group : LBRACE policy_option_list RBRACENr# )r! r� r# r# r$ �p_policy_option_group_ s z#dnssec_policy.p_policy_option_groupc C s dS )zmpolicy_option_list : policy_option SEMI
| policy_option_list policy_option SEMINr# )r! r� r# r# r$ �p_policy_option_listc s z"dnssec_policy.p_policy_option_listc C s dS )a� policy_option : parent_option
| directory_option
| coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keysize_option
| algorithm_option
| keyttl_option
| standby_optionNr# )r! r� r# r# r$ �p_policy_optionh s z dnssec_policy.p_policy_optionc C s dS )z0alg_option_group : LBRACE alg_option_list RBRACENr# )r! r� r# r# r$ �p_alg_option_groupu s z dnssec_policy.p_alg_option_groupc C s dS )z^alg_option_list : alg_option SEMI
| alg_option_list alg_option SEMINr# )r! r� r# r# r$ �p_alg_option_listy s z dnssec_policy.p_alg_option_listc C s dS )a alg_option : coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keyttl_option
| keysize_option
| standby_optionNr# )r! r� r# r# r$ � p_alg_option~ s zdnssec_policy.p_alg_optionc C s | j |d j� | j_dS )zparent_option : POLICY namer� N)r� r+ r� r^ )r! r� r# r# r$ �p_parent_option� s z dnssec_policy.p_parent_optionc C s |d | j _dS )z$directory_option : DIRECTORY QSTRINGr� N)r� re )r! r� r# r# r$ �p_directory_option� s z dnssec_policy.p_directory_optionc C s |d | j _dS )z#coverage_option : COVERAGE durationr� N)r� rf )r! r� r# r# r$ �p_coverage_option� s z dnssec_policy.p_coverage_optionc C s* |d dkr|d | j _n |d | j _dS )z0rollperiod_option : ROLL_PERIOD KEYTYPE durationr� �KSK� N)r� ri rj )r! r� r# r# r$ �p_rollperiod_option� s z!dnssec_policy.p_rollperiod_optionc C s* |d dkr|d | j _n |d | j _dS )z0prepublish_option : PRE_PUBLISH KEYTYPE durationr� r� r� N)r� rk rm )r! r� r# r# r$ �p_prepublish_option� s z!dnssec_policy.p_prepublish_optionc C s* |d dkr|d | j _n |d | j _dS )z2postpublish_option : POST_PUBLISH KEYTYPE durationr� r� r� N)r� rl rn )r! r� r# r# r$ �p_postpublish_option� s z"dnssec_policy.p_postpublish_optionc C s* |d dkr|d | j _n |d | j _dS )z(keysize_option : KEY_SIZE KEYTYPE NUMBERr� r� r� N)r� rg rh )r! r� r# r# r$ �p_keysize_option� s z dnssec_policy.p_keysize_optionc C s* |d dkr|d | j _n |d | j _dS )z'standby_option : STANDBY KEYTYPE NUMBERr� r� r� N)r� ro rp )r! r� r# r# r$ �p_standby_option� s z dnssec_policy.p_standby_optionc C s |d | j _dS )z keyttl_option : KEYTTL durationr� N)r� rq )r! r� r# r# r$ �p_keyttl_option� s z dnssec_policy.p_keyttl_optionc C s |d | j _dS )z$algorithm_option : ALGORITHM ALGNAMEr� N)r� r] )r! r� r# r# r$ �p_algorithm_option� s z dnssec_policy.p_algorithm_optionc C sd |r.t d| jpd| jrdnd|j|jf � n2| js`td| jp@d| jrJdnd|rV|jpXdf ��d S )Nz %s%s%d:syntax error near '%s'r_ �:z %s%s%d:unexpected end of inputr )r8 r� r r r� ry )r! r� r# r# r$ �p_error� s zdnssec_policy.p_error)N)*rK rL rM r� r� r� r� r� r� rF r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r# r# r# r$ rz , sN
_
h
rz �__main__r' rC r� )r{ r� T)r| r{ r� znonexistent.zone) r( Zply.lexrC Zply.yaccr �stringr r rO � Exceptionry rz rK �sys�argvr� �filer� rI �closer~ rJ Zppr8 r� r� �e�argsr# r# r# r$ �<module> s6
` 4 !
__pycache__/checkds.cpython-36.pyc 0000644 00000010272 15173300444 0013011 0 ustar 00 3
�!�i& � @ sh d dl Z d dlZd dlZd dlmZmZ d dlmZmZ dZ G dd� d�Z
d
dd�Z d d
� Z d d � Z
dS )� N)�Popen�PIPE)�prefix�versionzdnssec-checkdsc @ sP e Zd Zddddd�ZdZdZdZdZdZdZ d Z
dd
d �Z d d
� Z dd� Z
dS )�SECRRzSHA-1zSHA-256ZGOSTzSHA-384)� � � � � �INNr c C s� |st �t|�tk r$|jd�j� }n|j� }t|�dk r<t �|r�d| _|j� | _|d j� j d�jd�}|j
� |jd�}|j
� xDt|�dkr�t|�dkr�|d |d kr�|dd � }|dd � }q�W |r�t �|j
� dj |�| _ | j d | j d | _
nd| _|d j� | _
|dd � }|d j� dk�rJ|d j� | _|dd � }n(t|d �| _|d j� | _|d d � }|d j� | jk�r�t d |d j� | jf ��tt|dd
� �\| _| _| _dj |d
d � �j� | _d S )N�ascii� �DLVr �.r �DSr �CH�HSr z%s does not match %sr
r )r r r )� Exception�type�str�decode�split�len�rrtype�lower�dlvname�strip�reverse�join�parent�rrname�upper�rrclass�int�ttl�map�keyid�keyalg�hashalg�digest)�selfZrrtextr Zfieldsr �dlv� r- � /usr/lib/python3.6/checkds.py�__init__$ sH
* zSECRR.__init__c C s$ d| j | j| j| j| j| j| jf S )Nz%s %s %s %d %d %d %s)r! r# r r' r( r) r* )r+ r- r- r. �__repr__S s zSECRR.__repr__c C s | j � |j � kS )N)r0 )r+ �otherr- r- r. �__eq__X s z SECRR.__eq__)N)�__name__�
__module__� __qualname__�hashalgsr! r# r' r( r) r* r% r/ r0 r2 r- r- r- r. r s
/r c
C s& g }|j ddd|rdndd|r*| d | n| g}t|td�j� \}}x6|j� D ]*}t|�tk rh|jd �}|jt ||�� qNW t
|d
d � d �}g } |r�|j d
|g}|r�|d|g7 }|j| � t|td�j� \}}ndt|j ddddd| gtd�j� \}
}|j d
dg}|�r|d|g7 }|j| � t|ttd�j|
�\}}x:|j� D ].}t|�tk �rZ|jd �}| jt ||�� �q>W t | �dk �r�t
d� dS d} xv| D ]n} | |k�r�t
d| j| jjd�| j| jt j| j f � d} n,t
d| j| jjd�| j| jt j| j f � �q�W | �s"t
d|�rdnd � | S )Nz+noallz+answerz-tr, Zdsz-qr )�stdoutr
c S s | j | j| jfS )N)r' r( r) )�rrr- r- r. �<lambda>m s zcheck.<locals>.<lambda>)�keyz-fz-lZdnskey�-)�stdinr7 r z$No DNSKEY records found in zone apexFz,%s for KSK %s/%03d/%05d (%s) found in parentTz0%s for KSK %s/%03d/%05d (%s) missing from parentz'No %s records were found for any DNSKEYr r )�digr r Z communicate�
splitlinesr r r �appendr �sorted� dsfromkeyr �printr r! r r( r' r6 r) )
�zone�args�
masterfile� lookasideZrrlist�cmd�fp�_�lineZklistZintods�foundr8 r- r- r. �checkc sV
rL c C s� t jtd d�} d}tjdkr"dnd}| jdtdd� | jd d
d td d
� | jdddtdd
� | jdddtjjt |�d�tdd� | jdddtjjt |�d�tdd� | jd d d t
d � | j � }|j j
d �|_ |jr�|jj
d �|_|S )!Nz: checks DS coverage)� description�bin�ntZsbinrC z
zone to check)r �helpz-fz--filerE zzone master file)�destr rP z-lz --lookasiderF zDLV lookaside zonez-dz--digr= z
path to 'dig')rQ �defaultr rP z-Dz --dsfromkeyrA zdnssec-dsfromkeyzpath to 'dnssec-dsfromkey'z-vz --versionr )�actionr r )�argparse�ArgumentParser�prog�os�name� add_argumentr �pathr r r �
parse_argsrC r rF )�parserZbindirZsbindirrD r- r- r. r[ � s,
r[ c C s. t � } t| j| | j| j�}t|r$dnd� d S )Nr r )r[ rL rC rE rF �exit)rD rK r- r- r. �main� s r^ )NN)rT rW �sys�
subprocessr r Z isc.utilsr r rV r rL r[ r^ r- r- r- r. �<module> s I
; __pycache__/keyzone.cpython-36.pyc 0000644 00000002344 15173300445 0013073 0 ustar 00 3
�!�i� � @ sJ d dl Z d dlZd dlZd dlmZmZ G dd� de�ZG dd� d�ZdS )� N)�Popen�PIPEc @ s e Zd ZdS )�KeyZoneExceptionN)�__name__�
__module__� __qualname__� r r � /usr/lib/python3.6/keyzone.pyr s r c @ s e Zd ZdZdd� ZdS )�keyzonez/reads a zone file to find data relevant to keysc
C s� d | _ d | _|sd S | s8tjj|� s8tj|tj� rDtd��d S d }}t|dd||gt t d�j
� \}}xv|j � D ]j}t |�t
k r�|jd�}tjd|�r�qv|j� } | s�t| d �|kr�t| d �}| d d krvt| d �}qvW || _|| _ d S )
Nz "named-compilezone" not foundz-o�-)�stdout�stderr�asciiz ^[:space:]*;� � ZDNSKEY)�maxttl�keyttl�os�path�isfile�access�X_OKr r r Z communicate�
splitlines�type�str�decode�re�search�split�int)
�self�name�filenameZczpathr r �fp�_�lineZfieldsr r r �__init__ s.
zkeyzone.__init__N)r r r �__doc__r& r r r r r
s r
) r �sysr �
subprocessr r � Exceptionr r
r r r r �<module> s
__pycache__/__init__.cpython-36.opt-1.pyc 0000644 00000000744 15173300445 0014107 0 ustar 00 3
�!�i� �
@ sj d ddddddddd d
d d g
Z d
dlT d
dlT d
dlT d
dlT d
dlT d
dlT d
dlT d
dlT d
dl T dS )ZcheckdsZcoverageZkeymgrZdnskeyZ eventlistZkeydictZkeyeventZ keyseriesZkeyzoneZpolicyZparsetabZrndcZutils� )�*N)
�__all__Z
isc.dnskeyZ
isc.eventlistZ isc.keydictZ isc.keyeventZ
isc.keyseriesZ isc.keyzoneZ
isc.policyZisc.rndcZ isc.utils� r r � /usr/lib/python3.6/__init__.py�<module> s
__pycache__/keyevent.cpython-36.pyc 0000644 00000003500 15173300446 0013235 0 ustar 00 3
�!�i � @ s d dl Z G dd� d�ZdS )� Nc @ s4 e Zd ZdZd dd�Zdd� Zdd� Zd d d
�ZdS )
�keyeventz� A discrete key event, e.g., Publish, Activate, Inactive, Delete,
etc. Stores the date of the event, and identifying information
about the key to which the event will occur.Nc C s@ || _ |p|j|�| _|| _|j| _|j| _|j| _|j| _d S )N) �whatZgettime�when�key�sep�name�zone�alg�keyid)�selfr r r � r � /usr/lib/python3.6/keyevent.py�__init__ s zkeyevent.__init__c C s t | j| j| j| j| j| jf�S )N)�reprr r r
r r r )r r r r
�__repr__ s zkeyevent.__repr__c C s t jd| j�S )Nz%a %b %d %H:%M:%S UTC %Y)�timeZstrftimer )r r r r
�showtime$ s zkeyevent.showtimec C s� dd� }|s|}|st � }|s$t � }| jdkr<|j| j� n�| jdkrT|j| j� n�| jdkr�| j|kr||dt| j� � q�|j| j� nl| jdkr�| j|kr�|j| j� q�|dt| j� � n6| jd kr�| j|kr�|j| j� | j|kr�|j| j� ||fS )
Nc _ s d S )Nr )�args�kwargsr r r
�noop* s z keyevent.status.<locals>.noopZActivateZPublishZInactivez= WARNING: %s scheduled to become inactive before it is activeZDeletez@WARNING: key %s is scheduled for deletion before it is publishedZRevoke)�setr �addr
r r �remove)r ZactiveZ published�outputr r r r
�status) s6
zkeyevent.status)N)N)�__name__�
__module__� __qualname__�__doc__r r r r r r r r
r s
r )r r r r r r
�<module> s __pycache__/keymgr.cpython-36.pyc 0000644 00000010165 15173300446 0012706 0 ustar 00 3
�!�ik � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z dZ d dl
mZmZmZmZmZmZ dd� Zddd �Zd
d � Zd d
� ZdS )� )�print_functionN)� defaultdictz
dnssec-keymgr)�dnskey�keydict� keyseries�policy�parsetab�utilsc O s t | |� tjd� d S )N� )�print�sys�exit)�args�kwargs� r � /usr/lib/python3.6/keymgr.py�fatal s
r c C s� |}| s(t jj|� s(t j|t j� r�t jd }|s>t jj}xB|jt j�D ]2}|t j | }t jj|�rzt j|t j�rzP d}qLW |S )a2 find the location of a specified command. If a default is supplied,
exists and it's an executable, we use it; otherwise we search PATH
for an alternative.
:param command: command to look for
:param default: default value to use
:return: PATH with the location of a suitable binary
�PATHN)
�os�path�isfile�access�X_OK�environ�defpath�split�pathsep�sep)Zcommand�defaultZfpathr Z directoryr r r �set_path s $
r c C s� t dtjjtjd�d��} t dtjjtjd�d��}tjtd d�}|j dt
ddd;d � |j d d
t
ddd� |j ddt
ddd� |j dd| t
dd
d� |j ddt
ddd
d � |j d d |t
d d
d� |j d d!d"d#d$d%� |j d&d'd"d#d(d%� |j d)d*d+d"d#d<d%� |j d.d/d0d"d#d1d%� |j d2d3d4tj d5� |j � }|j
�rJ|j�rJtd6� |jdk�r^td7� |jdk�rrtd8� |jdk �r�tjj|j��s�td9|j � n(tjjtjd:�|_tjj|j��s�d|_|S )=zc Read command line arguments, returns 'args' object
:return: args object properly prepared
z
dnssec-keygenZsbinzdnssec-settimezA: schedule DNSSEC key rollovers according to a pre-defined policy)� description�zone�*Nz.Zone(s) to which the policy should be applied z%(default: all zones in the directory))�type�nargsr �helpz-Kr zDirectory containing keys�dir)�destr# r% �metavarz-c�
policyfilezPolicy definition file�filez-g�keygenzPath to 'dnssec-keygen')r' r r# r% r( z-r� randomdevz@Path to a file containing random data to pass to 'dnssec-keygen')r' r# r r% r( z-s�settimezPath to 'dnssec-settime'z-k�no_zsk�
store_trueFz,Only apply policy to key-signing keys (KSKs))r' �actionr r% z-z�no_kskz-Only apply policy to zone-signing keys (ZSKs)z-fz--force�forcez Force updates to key events z even if they are in the pastz-qz--quiet�quietzUpdate keys silentlyz-vz --version�version)r0 r4 z)ERROR: -z and -k cannot be used together.z ERROR: dnssec-keygen not foundz ERROR: dnssec-settime not foundz!ERROR: Policy file "%s" not foundzdnssec-policy.confzSZone(s) to which the policy should be applied (default: all zones in the directory)z8Force updates to key events even if they are in the past)r r r �joinr �prefix�argparse�ArgumentParser�prog� add_argument�strr4 �
parse_argsr. r1 r r+ r- r) �existsZ
sysconfdir)r+ r- �parserr r r r r< 6 sb
r< c : C sH t � } | j| j| j| jd�}ytj| j�}W n2 tk
r^ } zt dt
|� � W Y d d }~X nX yt || j| j d�}W n2 tk
r� } zt dt
|� � W Y d d }~X nX yt
||d�}W n2 tk
r� } zt dt
|� � W Y d d }~X nX y |j|| j| j| j| jd� W n4 tk
�rB } zt dt
|� � W Y d d }~X nX d S ) N)Z keygen_pathZ settime_pathZ keys_pathr, z Unable to load DNSSEC policy: )r Zzonesz Unable to build key dictionary: )�contextz Unable to build key series: )ZkskZzskr2 r3 zUnable to apply policy: )r< r+ r- r r, r Z
dnssec_policyr) � Exceptionr r; r r! r Zenforce_policyr. r1 r2 r3 )r r? Zdp�eZkdZksr r r �main} s,
"""rB )N)Z
__future__r r r r7 Zglob�reZtimeZcalendar�pprint� collectionsr r9 Ziscr r r r r r r r r< rB r r r r �<module> s @
G __pycache__/keyzone.cpython-36.opt-1.pyc 0000644 00000002344 15173300447 0014034 0 ustar 00 3
�!�i� � @ sJ d dl Z d dlZd dlZd dlmZmZ G dd� de�ZG dd� d�ZdS )� N)�Popen�PIPEc @ s e Zd ZdS )�KeyZoneExceptionN)�__name__�
__module__� __qualname__� r r � /usr/lib/python3.6/keyzone.pyr s r c @ s e Zd ZdZdd� ZdS )�keyzonez/reads a zone file to find data relevant to keysc
C s� d | _ d | _|sd S | s8tjj|� s8tj|tj� rDtd��d S d }}t|dd||gt t d�j
� \}}xv|j � D ]j}t |�t
k r�|jd�}tjd|�r�qv|j� } | s�t| d �|kr�t| d �}| d d krvt| d �}qvW || _|| _ d S )
Nz "named-compilezone" not foundz-o�-)�stdout�stderr�asciiz ^[:space:]*;� � ZDNSKEY)�maxttl�keyttl�os�path�isfile�access�X_OKr r r Z communicate�
splitlines�type�str�decode�re�search�split�int)
�self�name�filenameZczpathr r �fp�_�lineZfieldsr r r �__init__ s.
zkeyzone.__init__N)r r r �__doc__r& r r r r r
s r
) r �sysr �
subprocessr r � Exceptionr r
r r r r �<module> s
__pycache__/keymgr.cpython-36.opt-1.pyc 0000644 00000010165 15173300447 0013646 0 ustar 00 3
�!�ik � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z dZ d dl
mZmZmZmZmZmZ dd� Zddd �Zd
d � Zd d
� ZdS )� )�print_functionN)� defaultdictz
dnssec-keymgr)�dnskey�keydict� keyseries�policy�parsetab�utilsc O s t | |� tjd� d S )N� )�print�sys�exit)�args�kwargs� r � /usr/lib/python3.6/keymgr.py�fatal s
r c C s� |}| s(t jj|� s(t j|t j� r�t jd }|s>t jj}xB|jt j�D ]2}|t j | }t jj|�rzt j|t j�rzP d}qLW |S )a2 find the location of a specified command. If a default is supplied,
exists and it's an executable, we use it; otherwise we search PATH
for an alternative.
:param command: command to look for
:param default: default value to use
:return: PATH with the location of a suitable binary
�PATHN)
�os�path�isfile�access�X_OK�environ�defpath�split�pathsep�sep)Zcommand�defaultZfpathr Z directoryr r r �set_path s $
r c C s� t dtjjtjd�d��} t dtjjtjd�d��}tjtd d�}|j dt
ddd;d � |j d d
t
ddd� |j ddt
ddd� |j dd| t
dd
d� |j ddt
ddd
d � |j d d |t
d d
d� |j d d!d"d#d$d%� |j d&d'd"d#d(d%� |j d)d*d+d"d#d<d%� |j d.d/d0d"d#d1d%� |j d2d3d4tj d5� |j � }|j
�rJ|j�rJtd6� |jdk�r^td7� |jdk�rrtd8� |jdk �r�tjj|j��s�td9|j � n(tjjtjd:�|_tjj|j��s�d|_|S )=zc Read command line arguments, returns 'args' object
:return: args object properly prepared
z
dnssec-keygenZsbinzdnssec-settimezA: schedule DNSSEC key rollovers according to a pre-defined policy)� description�zone�*Nz.Zone(s) to which the policy should be applied z%(default: all zones in the directory))�type�nargsr �helpz-Kr zDirectory containing keys�dir)�destr# r% �metavarz-c�
policyfilezPolicy definition file�filez-g�keygenzPath to 'dnssec-keygen')r' r r# r% r( z-r� randomdevz@Path to a file containing random data to pass to 'dnssec-keygen')r' r# r r% r( z-s�settimezPath to 'dnssec-settime'z-k�no_zsk�
store_trueFz,Only apply policy to key-signing keys (KSKs))r' �actionr r% z-z�no_kskz-Only apply policy to zone-signing keys (ZSKs)z-fz--force�forcez Force updates to key events z even if they are in the pastz-qz--quiet�quietzUpdate keys silentlyz-vz --version�version)r0 r4 z)ERROR: -z and -k cannot be used together.z ERROR: dnssec-keygen not foundz ERROR: dnssec-settime not foundz!ERROR: Policy file "%s" not foundzdnssec-policy.confzSZone(s) to which the policy should be applied (default: all zones in the directory)z8Force updates to key events even if they are in the past)r r r �joinr �prefix�argparse�ArgumentParser�prog� add_argument�strr4 �
parse_argsr. r1 r r+ r- r) �existsZ
sysconfdir)r+ r- �parserr r r r r< 6 sb
r< c : C sH t � } | j| j| j| jd�}ytj| j�}W n2 tk
r^ } zt dt
|� � W Y d d }~X nX yt || j| j d�}W n2 tk
r� } zt dt
|� � W Y d d }~X nX yt
||d�}W n2 tk
r� } zt dt
|� � W Y d d }~X nX y |j|| j| j| j| jd� W n4 tk
�rB } zt dt
|� � W Y d d }~X nX d S ) N)Z keygen_pathZ settime_pathZ keys_pathr, z Unable to load DNSSEC policy: )r Zzonesz Unable to build key dictionary: )�contextz Unable to build key series: )ZkskZzskr2 r3 zUnable to apply policy: )r< r+ r- r r, r Z
dnssec_policyr) � Exceptionr r; r r! r Zenforce_policyr. r1 r2 r3 )r r? Zdp�eZkdZksr r r �main} s,
"""rB )N)Z
__future__r r r r7 Zglob�reZtimeZcalendar�pprint� collectionsr r9 Ziscr r r r r r r r r< rB r r r r �<module> s @
G __pycache__/coverage.cpython-36.opt-1.pyc 0000644 00000014323 15173300447 0014143 0 ustar 00 3
�!�i�& � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z dZ d dl
mZmZmZmZmZmZ dd� Zdad d
� Zd d � Zd
d� Zddd�Zdd� Zdd� ZdS )� )�print_functionN)� defaultdictzdnssec-coverage)�dnskey� eventlist�keydict�keyevent�keyzone�utilsc O s t | |� tjd� d S )N� )�print�sys�exit)�args�kwargs� r � /usr/lib/python3.6/coverage.py�fatal s
r Tc O sJ d|kr |d }|j dd� nd}tr,dan |r8td� | rFt| |� dS )zuoutput text, adding a vertical space this is *not* the first
first section being printed since a call to vreset()�skipNTF� )�pop�
_firstliner )r r r r r r �output' s r c C s da dS )zreset vertical spacingTN)r r r r r �vreset8 s r c C s� | j � } yt| �S tk
r$ Y nX tjd�}|j| �}|sJtd| ��|j� \}}t|�}|j� }|jd�rx|d S |jd�r�|d S |jd�r�|d S |jd �r�|d
S |jd �r�|d S |jd
�r�|d S |jd�r�|S td| ��dS )z� convert a formatted time (e.g., 1y, 6mo, 15mi, etc) into seconds
:param s: String with some text representing a time interval
:return: Integer with the number of seconds in the time interval
z([0-9][0-9]*)\s*([A-Za-z]*)zCannot parse %s�yi�3��moi �' �wi�: �di�Q �hi Zmi�< �szInvalid suffix %sN) �strip�int�
ValueError�re�compile�match�groups�lower�
startswith)r �r�m�nZunitr r r �
parse_timeA s6
r, c C s� |}| s(t jj|� s(t j|t j� r�t jd }|s>t jj}xB|jt j�D ]2}t jj || �}t jj|�rzt j|t j�rzP d}qLW |S )a1 find the location of a specified command. if a default is supplied
and it works, we use it; otherwise we search PATH for a match.
:param command: string with a command to look for in the path
:param default: default location to use
:return: detected location for the desired command
�PATHN)
�os�path�isfile�access�X_OK�environ�defpath�split�pathsep�join)Zcommand�defaultZfpathr/ Z directoryr r r �set_pathk s $
r9 c 0 C sD t dtjjtjd�d��} tjtd d d�}|j dt
dddFd � |j d d
dt
ddd� |j ddt
ddd� |j ddt
ddd� |j dd t
d dd� |j d d d t
d!dd� |j d"d#| t
d$d
d� |j d%d&t
d'd(dd)� |j d*d+d,d-d.d/� |j d0d1d,d-d2d/� |j d3d4d5d,d-d6d/� |j d7d8d9tj d:� |j � }|j
�rJ|j�rJtd;� n*|j
�sZ|j�rn|j
�rfd<nd=|_nd|_|j�r�t|j�d>k�r�td?� d@dA� |jD �|_y |j�r�t|j�}||_W n tk
�r� Y nX y |j�r�t|j�}||_W n tk
�r Y nX y |j�r(t|j�}||_W n tk
�r@ Y nX y<|j�r||j}t|j�}|dBk�rnd|_ntj� | |_W n tk
�r� Y nX |j�r�|j�r�|S |j�r*|j�r*y:t|jdB |j|j �}|j�p�|j|_|j�p�|j|_W n4 t k
�r( } zt dC|j |� W Y dd}~X nX |j�s@t dD� dE|_|S )Gz8Read command line arguments, set global 'args' structureznamed-compilezoneZsbinz: checks future zDNSKEY coverage for a zone)� description�zone�*Nzzone(s) to checkz%(default: all zones in the directory))�type�nargsr8 �helpz-Kr/ �.z&a directory containing keys to process�dir)�destr8 r= r? �metavarz-f�filenamezzone master file�file)rB r= r? rC z-m�maxttlz the longest TTL in the zone(s)�timez-d�keyttlzthe DNSKEY TTLz-r�resignZ1944000z:the RRSIG refresh interval in seconds [default: 22.5 days]z-c� compilezonezpath to 'named-compilezone'z-l�
checklimit�0zDLength of time to check for DNSSEC coverage [default: 0 (unlimited)])rB r= r8 r? rC z-z�no_ksk�
store_trueFz#Only check zone-signing keys (ZSKs))rB �actionr8 r? z-k�no_zskz"Only check key-signing keys (KSKs)z-Dz--debugZ
debug_modezTurn on debugging outputz-vz --version�version)rO rQ z)ERROR: -z and -k cannot be used together.ZKSKZZSKr
z)ERROR: -f can only be used with one zone.c S s4 g | ],}t |�d kr,|d dkr,|dd� n|�qS )r
r@ N���rR )�len)�.0�xr r r �
<listcomp>� s z parse_args.<locals>.<listcomp>r z"Unable to load zone data from %s: z�WARNING: Maximum TTL value was not specified. Using 1 week
(604800 seconds); re-run with the -m option to get more
accurate results.i�: z5zone(s) to check(default: all zones in the directory)) r9 r. r/ r7 r �prefix�argparse�ArgumentParser�prog� add_argument�strrQ �
parse_argsrP rM r �keytyperD rS r; rF r, r" rH rI rK rG r rJ � Exceptionr r ) rJ �parserr r* �kr) Zlimr; �er r r r] � s�
"r] c ( C sp t � } td� yt| j| j| jd�}W n2 tk
rX } ztdt|� � W Y d d }~X nX x<|D ]4}|j t
� |j r�|j t
� q`|j t
| j
| j � q`W t
d� t� y t|�}W n2 tk
r� } ztdt|� � W Y d d }~X nX d}| j�s|jd | j| jt
��sXd}nJxH| jD ]>}y |j|| j| jt
��s6d}W n t
d| � Y nX �qW tj|�rfd nd
� d S ) Nz;PHASE 1--Loading keys to check for internal timing problems)r/ ZzonesrH z'ERROR: Unable to build key dictionary: z9PHASE 2--Scanning future key events for coverage failuresz#ERROR: Unable to build event list: FTz&ERROR: Coverage check failed for zone r
r )r] r r r/ r; rH r_ r r\ Z check_prepubr �sepZ
check_postpubrF rI r r Zcoverager^ rK r r
)r Zkdrb �keyZelist�errorsr; r r r �main� s: "
"
rf )N) Z
__future__r r. r rX Zglobr# rG Zcalendar�pprint� collectionsr rZ Ziscr r r r r r r r r r r, r9 r] rf r r r r �<module> s& *
x __pycache__/utils.cpython-36.pyc 0000644 00000002303 15173300450 0012536 0 ustar 00 3
�!�i� � @ sT d dl Z e jdkr"d dlZd dlZd dd�Zdd� ZdZe jdkrHd Zned
�ZdS ) � N�nt� c
C s t jdkrt jjd| �S tj}d}tj}d }d}ytj||d|�}W n d}Y nX |s�d}|tj B }ytj||d|�}W n d}Y nX |s�d}|tj
B }ytj||d|�}W n d}Y nX |r�ytj |d�\}} W n d}Y nX tj |� |�rt jj|| �S t jjtj
� | �S )Nr z/usrzSoftware\ISC\BINDTr FZ
InstallDir)�os�name�path�join�win32con�HKEY_LOCAL_MACHINEZKEY_READ�win32apiZ RegOpenKeyExZKEY_WOW64_64KEYZKEY_WOW64_32KEYZRegQueryValueExZ RegCloseKeyZGetSystemDirectory)
ZbindirZhklmZ bind_subkeyZsamZh_keyZ key_foundZsam64Zsam32Z
named_base�_� r �/usr/lib/python3.6/utils.py�prefix sD
r c C s2 t jdkr d| jdd� d S d| jdd� d S )Nr �"z"\"�'z'\'')r r �replace)�sr r r
�
shellquote= s
r z"9.11.36-RedHat-9.11.36-16.el8_10.7z/etcZetc)r )r r r r
r r �versionZ
sysconfdirr r r r
�<module> s
)
__pycache__/keydict.cpython-36.pyc 0000644 00000005013 15173300450 0013033 0 ustar 00 3
�!�i! � @ s: d dl mZ ddlmZ d dlZd dlZG dd� d�ZdS )� )� defaultdict� )�dnskeyNc @ sn e Zd ZdZedd� �ZdZg Zddd�Zdd� Z d d
� Z
d d � Z d
d� Z dd� Z
dd� Zdd� Zdd� ZdS )�keydictz> A dictionary of keys, indexed by name, algorithm, and key id c C s t t�S )N)r �dict� r r � /usr/lib/python3.6/keydict.py�<lambda> s zkeydict.<lambda>Nc K s� |j dd �| _|j dd �}|s:|j dd �p,d}| j|� nXxV|D ]N}d|krb|d d k rb|d }n|rr|j|�jptd}| j||�s@| jj|� q@W d S )NZkeyttl�zones�path�.)�get�_defttl�readallZpolicyZ directory�readone�_missing�append)�selfZdp�kwargsr
r �zoner r r �__init__ s
zkeydict.__init__c C sL t j tjj|d��}x2|D ]*}t||| j�}|| j|j |j |j < qW d S )Nz *.private)
�glob�osr �joinr r �_keydict�name�alg�keyid)r r �files�infile�keyr r r r , s
zkeydict.readallc C s� |j d�s|d7 }d| d }tjtjj||��}d}xR|D ]J}t||| j�}|j|krZq<|dkrh|jnd}|| j | |j
|j < d}q<W |S )Nr �Kz
+*.privateFT) �endswithr r r r r r �fullnamer r r r ) r r r �matchr �foundr r Zkeynamer r r r 3 s
zkeydict.readonec c sJ xD| j j� D ]6\}}x,|j� D ] \}}x|j� D ]
}|V q0W q W q W d S )N)r �items�values)r r �
algorithmsr �keysr r r r �__iter__D s zkeydict.__iter__c C s
| j | S )N)r )r r r r r � __getitem__J s zkeydict.__getitem__c C s
| j j� S )N)r r) )r r r r r
M s z
keydict.zonesc C s | j | j� S )N)r r) )r r r r r r( P s zkeydict.algorithmsc C s | j | | j� S )N)r r) )r r r r r r r) S s z keydict.keysc C s | j S )N)r )r r r r �missingV s zkeydict.missing)N)�__name__�
__module__� __qualname__�__doc__r r r r r r r r* r+ r
r( r) r, r r r r r s
r )� collectionsr � r r r r r r r r �<module> s __pycache__/keyseries.cpython-36.opt-1.pyc 0000644 00000010705 15173300450 0014345 0 ustar 00 3
�!�i" � @ sF d dl mZ ddlT ddlT ddlT ddlT d dlZG dd� d�ZdS )� )� defaultdict� )�*Nc @ sl e Zd Zedd� �Zedd� �Ze� ZdZdZ e
j
� dfdd�Z dd� Z d d
� Z
d d � Ze
j
� fd
d�ZdS )� keyseriesc C s t t�S )N)r �list� r r � /usr/lib/python3.6/keyseries.py�<lambda> s zkeyseries.<lambda>c C s t t�S )N)r r r r r r r s Nc C s� || _ || _t|j� �| _x�|j� D ]�}| jj|� x�|| j� D ]�\}}xh|j� D ]\}|j r�|j
� op|j
� |k s�| j | | j |� qT|j
� o�|j
� |k sT| j
| | j |� qTW | j | | j� | j
| | j� qBW q$W d S )N)�_kdict�_context�setZmissing�_zones�zones�add�items�values�sep�delete�_K�append�_Z�sort)�selfZkdict�now�context�zone�alg�keys�kr r r �__init__ s zkeyseries.__init__c c sb x\| j D ]R}xL| j| jgD ]<}||kr(qx,|| j� D ] \}}x|D ]
}|V qDW q6W qW qW d S )N)r
r r r )r r �
collectionr r �keyr r r �__iter__. s
zkeyseries.__iter__c C s" x | D ]}t dt|� � qW d S )Nz%s)�print�repr)r r r r r �dump7 s
zkeyseries.dumpc K s� |j dd�}|sd S |d }|jr>|j}|jp0d }|jp:d } n|j}|jpLd
}|jpVd} |j� }
|j � } |
sv|
|kr�|j
|� |}
| s�| |kr�|j |� |} |j � } d}
|s�|j
d|� |jd|� �n�| s�| | | k�r| �r(| | || |
k�r(|j
| | f|� |j| | | f|� n�| �s`|j
|| |
f|� |j|| | |
f|� n�| |k �rln�| | | k�r�|j
| | f|� |j| | | f|� np| | || |
k�r�|j
| | f|� |j| | | f|� n0|j
|| |
f|� |j|| | |
f|� n�|j� }| �s8| | ||
k�rL|j| | f|� nN|�sj|j|| |
f|� n0|||
k �rzn || | k �r�|j| | f|� |j|jk�r�|j|j� |}x�|dd � D ]�}|�s |j
d|� |j d|� |j
d|� |jd|� |j|jk�r�|j|j� �q�|j � } | | }
|j | f|� |j
|
f|� |j
| | f|� |j| | | f|� |j| | f|� |j|jk�r�|j|j� |}�q�W x�|�r>|j � �r>|j � ||j k �r>|j| jd f|� |j| jd | jd
|f|�}|j
|j � | f|� |j|j � | f|� |j|� |}�q�W |j
d|� |jd|� x"|D ]}|j| jd f|� �q^W d S )N�forceFr � i�Q i, r Z settime_path� keygen_path� randomdevi �' i �' i �' i �' )N)N)N)N)N)N)N)N)�getr Zksk_rollperiodZksk_prepublishZksk_postpublishZzsk_rollperiodZzsk_prepublishZzsk_postpublishZpublishZactivateZ
setpublishZ setactivateZinactiveZ setinactiveZ setdeleter �keyttlZttlZsetttlZcoverageZcommitr Zgenerate_successorr )r r �policyr �kwargsr& r! ZrpZprepubZpostpub�p�a�iZfudge�d�prevr r r � fixseries; s�
zkeyseries.fixseriesc K s� |j d| j�}|j d| jj dd ��}|j dd�}�x�|D �]�}g }|j|�} |pX| jpXd}| j}
tj|
�} d|ks||d r�t| j | | �dkr�tj
| jd | jd
|||
| j d| j p�d f|�} | j | | j
| � |j
| j | � d |ks�|d �rht| j| | �dk�rXtj
| jd | jd
|||
| jd
| j �p<d f|�} | j| | j
| � |j
| j| � x�|D ]�}
x||
j� D ]p\}}|| k�r��q|y| j|| |f|� W n@ tk
�r� } z"td|tj| �t|�f ��W Y d d }~X nX �q|W �qnW q8W d S )Nr �dirZ keys_pathr& F�.Zkskr r( r) i ZzskTz %s/%s: %s)r* r
r r, Z directory� algorithm�dnskey�algnum�lenr ZgenerateZ zsk_keysizer+ r r Z ksk_keysizer r3 � ExceptionZalgstr�str)r Zpoliciesr r- r Zkeys_dirr& r � collectionsr, r r8 r r r6 r �er r r �enforce_policy� sL
zkeyseries.enforce_policy)�__name__�
__module__� __qualname__r r r r r
r
r �timer r" r% r3 r> r r r r r s vr )r< r r7 ZkeydictZkeyeventr, rB r r r r r �<module> s utils.py 0000644 00000004240 15173300450 0006254 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
import os
# These routines permit platform-independent location of BIND 9 tools
if os.name == 'nt':
import win32con
import win32api
def prefix(bindir=''):
if os.name != 'nt':
return os.path.join('/usr', bindir)
hklm = win32con.HKEY_LOCAL_MACHINE
bind_subkey = "Software\\ISC\\BIND"
sam = win32con.KEY_READ
h_key = None
key_found = True
# can fail if the registry redirected for 32/64 bits
try:
h_key = win32api.RegOpenKeyEx(hklm, bind_subkey, 0, sam)
except:
key_found = False
# retry for 32 bit python with 64 bit bind9
if not key_found:
key_found = True
sam64 = sam | win32con.KEY_WOW64_64KEY
try:
h_key = win32api.RegOpenKeyEx(hklm, bind_subkey, 0, sam64)
except:
key_found = False
# retry 64 bit python with 32 bit bind9
if not key_found:
key_found = True
sam32 = sam | win32con.KEY_WOW64_32KEY
try:
h_key = win32api.RegOpenKeyEx(hklm, bind_subkey, 0, sam32)
except:
key_found = False
if key_found:
try:
(named_base, _) = win32api.RegQueryValueEx(h_key, "InstallDir")
except:
key_found = False
win32api.RegCloseKey(h_key)
if key_found:
return os.path.join(named_base, bindir)
return os.path.join(win32api.GetSystemDirectory(), bindir)
def shellquote(s):
if os.name == 'nt':
return '"' + s.replace('"', '"\\"') + '"'
return "'" + s.replace("'", "'\\''") + "'"
version = '9.11.36-RedHat-9.11.36-16.el8_10.7'
if os.name != 'nt':
sysconfdir = '/etc'
else:
sysconfdir = prefix('etc')
policy.py 0000644 00000063462 15173300451 0006427 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
import re
import ply.lex as lex
import ply.yacc as yacc
from string import *
from copy import copy
############################################################################
# PolicyLex: a lexer for the policy file syntax.
############################################################################
class PolicyLex:
reserved = ('POLICY',
'ALGORITHM_POLICY',
'ZONE',
'ALGORITHM',
'DIRECTORY',
'KEYTTL',
'KEY_SIZE',
'ROLL_PERIOD',
'PRE_PUBLISH',
'POST_PUBLISH',
'COVERAGE',
'STANDBY',
'NONE')
tokens = reserved + ('DATESUFFIX',
'KEYTYPE',
'ALGNAME',
'STR',
'QSTRING',
'NUMBER',
'LBRACE',
'RBRACE',
'SEMI')
reserved_map = {}
t_ignore = ' \t'
t_ignore_olcomment = r'(//|\#).*'
t_LBRACE = r'\{'
t_RBRACE = r'\}'
t_SEMI = r';';
def t_newline(self, t):
r'\n+'
t.lexer.lineno += t.value.count("\n")
def t_comment(self, t):
r'/\*(.|\n)*?\*/'
t.lexer.lineno += t.value.count('\n')
def t_DATESUFFIX(self, t):
r'(?i)(?<=[0-9 \t])(y(?:ears|ear|ea|e)?|mo(?:nths|nth|nt|n)?|w(?:eeks|eek|ee|e)?|d(?:ays|ay|a)?|h(?:ours|our|ou|o)?|mi(?:nutes|nute|nut|nu|n)?|s(?:econds|econd|econ|eco|ec|e)?)\b'
t.value = re.match(r'(?i)(y|mo|w|d|h|mi|s)([a-z]*)', t.value).group(1).lower()
return t
def t_KEYTYPE(self, t):
r'(?i)\b(KSK|ZSK)\b'
t.value = t.value.upper()
return t
def t_ALGNAME(self, t):
r'(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b'
t.value = t.value.upper()
return t
def t_STR(self, t):
r'[A-Za-z._-][\w._-]*'
t.type = self.reserved_map.get(t.value, "STR")
return t
def t_QSTRING(self, t):
r'"([^"\n]|(\\"))*"'
t.type = self.reserved_map.get(t.value, "QSTRING")
t.value = t.value[1:-1]
return t
def t_NUMBER(self, t):
r'\d+'
t.value = int(t.value)
return t
def t_error(self, t):
print("Illegal character '%s'" % t.value[0])
t.lexer.skip(1)
def __init__(self, **kwargs):
if 'maketrans' in dir(str):
trans = str.maketrans('_', '-')
else:
trans = maketrans('_', '-')
for r in self.reserved:
self.reserved_map[r.lower().translate(trans)] = r
self.lexer = lex.lex(object=self, **kwargs)
def test(self, text):
self.lexer.input(text)
while True:
t = self.lexer.token()
if not t:
break
print(t)
############################################################################
# Policy: this object holds a set of DNSSEC policy settings.
############################################################################
class Policy:
is_zone = False
is_alg = False
is_constructed = False
ksk_rollperiod = None
zsk_rollperiod = None
ksk_prepublish = None
zsk_prepublish = None
ksk_postpublish = None
zsk_postpublish = None
ksk_keysize = None
zsk_keysize = None
ksk_standby = None
zsk_standby = None
keyttl = None
coverage = None
directory = None
valid_key_sz_per_algo = {'DSA': [512, 1024],
'NSEC3DSA': [512, 1024],
'RSAMD5': [512, 4096],
'RSASHA1': [512, 4096],
'NSEC3RSASHA1': [512, 4096],
'RSASHA256': [512, 4096],
'RSASHA512': [512, 4096],
'ECCGOST': None,
'ECDSAP256SHA256': None,
'ECDSAP384SHA384': None,
'ED25519': None,
'ED448': None}
def __init__(self, name=None, algorithm=None, parent=None):
self.name = name
self.algorithm = algorithm
self.parent = parent
pass
def __repr__(self):
return ("%spolicy %s:\n"
"\tinherits %s\n"
"\tdirectory %s\n"
"\talgorithm %s\n"
"\tcoverage %s\n"
"\tksk_keysize %s\n"
"\tzsk_keysize %s\n"
"\tksk_rollperiod %s\n"
"\tzsk_rollperiod %s\n"
"\tksk_prepublish %s\n"
"\tksk_postpublish %s\n"
"\tzsk_prepublish %s\n"
"\tzsk_postpublish %s\n"
"\tksk_standby %s\n"
"\tzsk_standby %s\n"
"\tkeyttl %s\n"
%
((self.is_constructed and 'constructed ' or \
self.is_zone and 'zone ' or \
self.is_alg and 'algorithm ' or ''),
self.name or 'UNKNOWN',
self.parent and self.parent.name or 'None',
self.directory and ('"' + str(self.directory) + '"') or 'None',
self.algorithm or 'None',
self.coverage and str(self.coverage) or 'None',
self.ksk_keysize and str(self.ksk_keysize) or 'None',
self.zsk_keysize and str(self.zsk_keysize) or 'None',
self.ksk_rollperiod and str(self.ksk_rollperiod) or 'None',
self.zsk_rollperiod and str(self.zsk_rollperiod) or 'None',
self.ksk_prepublish and str(self.ksk_prepublish) or 'None',
self.ksk_postpublish and str(self.ksk_postpublish) or 'None',
self.zsk_prepublish and str(self.zsk_prepublish) or 'None',
self.zsk_postpublish and str(self.zsk_postpublish) or 'None',
self.ksk_standby and str(self.ksk_standby) or 'None',
self.zsk_standby and str(self.zsk_standby) or 'None',
self.keyttl and str(self.keyttl) or 'None'))
def __verify_size(self, key_size, size_range):
return (size_range[0] <= key_size <= size_range[1])
def get_name(self):
return self.name
def constructed(self):
return self.is_constructed
def validate(self):
""" Check if the values in the policy make sense
:return: True/False if the policy passes validation
"""
if self.ksk_rollperiod and \
self.ksk_prepublish is not None and \
self.ksk_prepublish > self.ksk_rollperiod:
print(self.ksk_rollperiod)
return (False,
('KSK pre-publish period (%d) exceeds rollover period %d'
% (self.ksk_prepublish, self.ksk_rollperiod)))
if self.ksk_rollperiod and \
self.ksk_postpublish is not None and \
self.ksk_postpublish > self.ksk_rollperiod:
return (False,
('KSK post-publish period (%d) exceeds rollover period %d'
% (self.ksk_postpublish, self.ksk_rollperiod)))
if self.zsk_rollperiod and \
self.zsk_prepublish is not None and \
self.zsk_prepublish >= self.zsk_rollperiod:
return (False,
('ZSK pre-publish period (%d) exceeds rollover period %d'
% (self.zsk_prepublish, self.zsk_rollperiod)))
if self.zsk_rollperiod and \
self.zsk_postpublish is not None and \
self.zsk_postpublish >= self.zsk_rollperiod:
return (False,
('ZSK post-publish period (%d) exceeds rollover period %d'
% (self.zsk_postpublish, self.zsk_rollperiod)))
if self.ksk_rollperiod and \
self.ksk_prepublish and self.ksk_postpublish and \
self.ksk_prepublish + self.ksk_postpublish >= self.ksk_rollperiod:
return (False,
(('KSK pre/post-publish periods (%d/%d) ' +
'combined exceed rollover period %d') %
(self.ksk_prepublish,
self.ksk_postpublish,
self.ksk_rollperiod)))
if self.zsk_rollperiod and \
self.zsk_prepublish and self.zsk_postpublish and \
self.zsk_prepublish + self.zsk_postpublish >= self.zsk_rollperiod:
return (False,
(('ZSK pre/post-publish periods (%d/%d) ' +
'combined exceed rollover period %d') %
(self.zsk_prepublish,
self.zsk_postpublish,
self.zsk_rollperiod)))
if self.algorithm is not None:
# Validate the key size
key_sz_range = self.valid_key_sz_per_algo.get(self.algorithm)
if key_sz_range is not None:
# Verify KSK
if not self.__verify_size(self.ksk_keysize, key_sz_range):
return False, 'KSK key size %d outside valid range %s' \
% (self.ksk_keysize, key_sz_range)
# Verify ZSK
if not self.__verify_size(self.zsk_keysize, key_sz_range):
return False, 'ZSK key size %d outside valid range %s' \
% (self.zsk_keysize, key_sz_range)
# Specific check for DSA keys
if self.algorithm in ['DSA', 'NSEC3DSA'] and \
self.ksk_keysize % 64 != 0:
return False, \
('KSK key size %d not divisible by 64 ' +
'as required for DSA') % self.ksk_keysize
if self.algorithm in ['DSA', 'NSEC3DSA'] and \
self.zsk_keysize % 64 != 0:
return False, \
('ZSK key size %d not divisible by 64 ' +
'as required for DSA') % self.zsk_keysize
if self.algorithm in ['ECCGOST', \
'ECDSAP256SHA256', \
'ECDSAP384SHA384', \
'ED25519', \
'ED448']:
self.ksk_keysize = None
self.zsk_keysize = None
return True, ''
############################################################################
# dnssec_policy:
# This class reads a dnssec.policy file and creates a dictionary of
# DNSSEC policy rules from which a policy for a specific zone can
# be generated.
############################################################################
class PolicyException(Exception):
pass
class dnssec_policy:
alg_policy = {}
named_policy = {}
zone_policy = {}
current = None
filename = None
initial = True
def __init__(self, filename=None, **kwargs):
self.plex = PolicyLex()
self.tokens = self.plex.tokens
if 'debug' not in kwargs:
kwargs['debug'] = False
if 'write_tables' not in kwargs:
kwargs['write_tables'] = False
self.parser = yacc.yacc(module=self, **kwargs)
# set defaults
self.setup('''policy global { algorithm rsasha256;
key-size ksk 2048;
key-size zsk 2048;
roll-period ksk 0;
roll-period zsk 1y;
pre-publish ksk 1mo;
pre-publish zsk 1mo;
post-publish ksk 1mo;
post-publish zsk 1mo;
standby ksk 0;
standby zsk 0;
keyttl 1h;
coverage 6mo; };
policy default { policy global; };''')
p = Policy()
p.algorithm = None
p.is_alg = True
p.ksk_keysize = 2048;
p.zsk_keysize = 2048;
# set default algorithm policies
# these need a lower default key size:
self.alg_policy['DSA'] = copy(p)
self.alg_policy['DSA'].algorithm = "DSA"
self.alg_policy['DSA'].name = "DSA"
self.alg_policy['DSA'].ksk_keysize = 1024;
self.alg_policy['NSEC3DSA'] = copy(p)
self.alg_policy['NSEC3DSA'].algorithm = "NSEC3DSA"
self.alg_policy['NSEC3DSA'].name = "NSEC3DSA"
self.alg_policy['NSEC3DSA'].ksk_keysize = 1024;
# these can use default settings
self.alg_policy['RSAMD5'] = copy(p)
self.alg_policy['RSAMD5'].algorithm = "RSAMD5"
self.alg_policy['RSAMD5'].name = "RSAMD5"
self.alg_policy['RSASHA1'] = copy(p)
self.alg_policy['RSASHA1'].algorithm = "RSASHA1"
self.alg_policy['RSASHA1'].name = "RSASHA1"
self.alg_policy['NSEC3RSASHA1'] = copy(p)
self.alg_policy['NSEC3RSASHA1'].algorithm = "NSEC3RSASHA1"
self.alg_policy['NSEC3RSASHA1'].name = "NSEC3RSASHA1"
self.alg_policy['RSASHA256'] = copy(p)
self.alg_policy['RSASHA256'].algorithm = "RSASHA256"
self.alg_policy['RSASHA256'].name = "RSASHA256"
self.alg_policy['RSASHA512'] = copy(p)
self.alg_policy['RSASHA512'].algorithm = "RSASHA512"
self.alg_policy['RSASHA512'].name = "RSASHA512"
self.alg_policy['ECCGOST'] = copy(p)
self.alg_policy['ECCGOST'].algorithm = "ECCGOST"
self.alg_policy['ECCGOST'].name = "ECCGOST"
self.alg_policy['ECDSAP256SHA256'] = copy(p)
self.alg_policy['ECDSAP256SHA256'].algorithm = "ECDSAP256SHA256"
self.alg_policy['ECDSAP256SHA256'].name = "ECDSAP256SHA256"
self.alg_policy['ECDSAP256SHA256'].ksk_keysize = None;
self.alg_policy['ECDSAP256SHA256'].zsk_keysize = None;
self.alg_policy['ECDSAP384SHA384'] = copy(p)
self.alg_policy['ECDSAP384SHA384'].algorithm = "ECDSAP384SHA384"
self.alg_policy['ECDSAP384SHA384'].name = "ECDSAP384SHA384"
self.alg_policy['ECDSAP384SHA384'].ksk_keysize = None;
self.alg_policy['ECDSAP384SHA384'].zsk_keysize = None;
self.alg_policy['ED25519'] = copy(p)
self.alg_policy['ED25519'].algorithm = "ED25519"
self.alg_policy['ED25519'].name = "ED25519"
self.alg_policy['ED25519'].ksk_keysize = None;
self.alg_policy['ED25519'].zsk_keysize = None;
self.alg_policy['ED448'] = copy(p)
self.alg_policy['ED448'].algorithm = "ED448"
self.alg_policy['ED448'].name = "ED448"
self.alg_policy['ED448'].ksk_keysize = None;
self.alg_policy['ED448'].zsk_keysize = None;
if filename:
self.load(filename)
def load(self, filename):
self.filename = filename
self.initial = True
with open(filename) as f:
text = f.read()
self.plex.lexer.lineno = 0
self.parser.parse(text)
self.filename = None
def setup(self, text):
self.initial = True
self.plex.lexer.lineno = 0
self.parser.parse(text)
def policy(self, zone, **kwargs):
z = zone.lower()
p = None
if z in self.zone_policy:
p = self.zone_policy[z]
if p is None:
p = copy(self.named_policy['default'])
p.name = zone
p.is_constructed = True
if p.algorithm is None:
parent = p.parent or self.named_policy['default']
while parent and not parent.algorithm:
parent = parent.parent
p.algorithm = parent and parent.algorithm or None
if p.algorithm in self.alg_policy:
ap = self.alg_policy[p.algorithm]
else:
raise PolicyException('algorithm not found')
if p.directory is None:
parent = p.parent or self.named_policy['default']
while parent is not None and not parent.directory:
parent = parent.parent
p.directory = parent and parent.directory
if p.coverage is None:
parent = p.parent or self.named_policy['default']
while parent and not parent.coverage:
parent = parent.parent
p.coverage = parent and parent.coverage or ap.coverage
if p.ksk_keysize is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.ksk_keysize:
parent = parent.parent
p.ksk_keysize = parent and parent.ksk_keysize or ap.ksk_keysize
if p.zsk_keysize is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.zsk_keysize:
parent = parent.parent
p.zsk_keysize = parent and parent.zsk_keysize or ap.zsk_keysize
if p.ksk_rollperiod is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.ksk_rollperiod:
parent = parent.parent
p.ksk_rollperiod = parent and \
parent.ksk_rollperiod or ap.ksk_rollperiod
if p.zsk_rollperiod is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.zsk_rollperiod:
parent = parent.parent
p.zsk_rollperiod = parent and \
parent.zsk_rollperiod or ap.zsk_rollperiod
if p.ksk_prepublish is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.ksk_prepublish:
parent = parent.parent
p.ksk_prepublish = parent and \
parent.ksk_prepublish or ap.ksk_prepublish
if p.zsk_prepublish is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.zsk_prepublish:
parent = parent.parent
p.zsk_prepublish = parent and \
parent.zsk_prepublish or ap.zsk_prepublish
if p.ksk_postpublish is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.ksk_postpublish:
parent = parent.parent
p.ksk_postpublish = parent and \
parent.ksk_postpublish or ap.ksk_postpublish
if p.zsk_postpublish is None:
parent = p.parent or self.named_policy['default']
while parent.parent and not parent.zsk_postpublish:
parent = parent.parent
p.zsk_postpublish = parent and \
parent.zsk_postpublish or ap.zsk_postpublish
if p.keyttl is None:
parent = p.parent or self.named_policy['default']
while parent is not None and not parent.keyttl:
parent = parent.parent
p.keyttl = parent and parent.keyttl
if 'novalidate' not in kwargs or not kwargs['novalidate']:
(valid, msg) = p.validate()
if not valid:
raise PolicyException(msg)
return None
return p
def p_policylist(self, p):
'''policylist : init policy
| policylist policy'''
pass
def p_init(self, p):
"init :"
self.initial = False
def p_policy(self, p):
'''policy : alg_policy
| zone_policy
| named_policy'''
pass
def p_name(self, p):
'''name : STR
| KEYTYPE
| DATESUFFIX'''
p[0] = p[1]
pass
def p_domain(self, p):
'''domain : STR
| QSTRING
| KEYTYPE
| DATESUFFIX'''
p[0] = p[1].strip()
if not re.match(r'^[\w.-][\w.-]*$', p[0]):
raise PolicyException('invalid domain')
pass
def p_new_policy(self, p):
"new_policy :"
self.current = Policy()
def p_alg_policy(self, p):
"alg_policy : ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMI"
self.current.name = p[2]
self.current.is_alg = True
self.alg_policy[p[2]] = self.current
pass
def p_zone_policy(self, p):
"zone_policy : ZONE domain new_policy policy_option_group SEMI"
self.current.name = p[2].rstrip('.')
self.current.is_zone = True
self.zone_policy[p[2].rstrip('.').lower()] = self.current
pass
def p_named_policy(self, p):
"named_policy : POLICY name new_policy policy_option_group SEMI"
self.current.name = p[2]
self.named_policy[p[2].lower()] = self.current
pass
def p_duration_1(self, p):
"duration : NUMBER"
p[0] = p[1]
pass
def p_duration_2(self, p):
"duration : NONE"
p[0] = None
pass
def p_duration_3(self, p):
"duration : NUMBER DATESUFFIX"
if p[2] == "y":
p[0] = p[1] * 31536000 # year
elif p[2] == "mo":
p[0] = p[1] * 2592000 # month
elif p[2] == "w":
p[0] = p[1] * 604800 # week
elif p[2] == "d":
p[0] = p[1] * 86400 # day
elif p[2] == "h":
p[0] = p[1] * 3600 # hour
elif p[2] == "mi":
p[0] = p[1] * 60 # minute
elif p[2] == "s":
p[0] = p[1] # second
else:
raise PolicyException('invalid duration')
def p_policy_option_group(self, p):
"policy_option_group : LBRACE policy_option_list RBRACE"
pass
def p_policy_option_list(self, p):
'''policy_option_list : policy_option SEMI
| policy_option_list policy_option SEMI'''
pass
def p_policy_option(self, p):
'''policy_option : parent_option
| directory_option
| coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keysize_option
| algorithm_option
| keyttl_option
| standby_option'''
pass
def p_alg_option_group(self, p):
"alg_option_group : LBRACE alg_option_list RBRACE"
pass
def p_alg_option_list(self, p):
'''alg_option_list : alg_option SEMI
| alg_option_list alg_option SEMI'''
pass
def p_alg_option(self, p):
'''alg_option : coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keyttl_option
| keysize_option
| standby_option'''
pass
def p_parent_option(self, p):
"parent_option : POLICY name"
self.current.parent = self.named_policy[p[2].lower()]
def p_directory_option(self, p):
"directory_option : DIRECTORY QSTRING"
self.current.directory = p[2]
def p_coverage_option(self, p):
"coverage_option : COVERAGE duration"
self.current.coverage = p[2]
def p_rollperiod_option(self, p):
"rollperiod_option : ROLL_PERIOD KEYTYPE duration"
if p[2] == "KSK":
self.current.ksk_rollperiod = p[3]
else:
self.current.zsk_rollperiod = p[3]
def p_prepublish_option(self, p):
"prepublish_option : PRE_PUBLISH KEYTYPE duration"
if p[2] == "KSK":
self.current.ksk_prepublish = p[3]
else:
self.current.zsk_prepublish = p[3]
def p_postpublish_option(self, p):
"postpublish_option : POST_PUBLISH KEYTYPE duration"
if p[2] == "KSK":
self.current.ksk_postpublish = p[3]
else:
self.current.zsk_postpublish = p[3]
def p_keysize_option(self, p):
"keysize_option : KEY_SIZE KEYTYPE NUMBER"
if p[2] == "KSK":
self.current.ksk_keysize = p[3]
else:
self.current.zsk_keysize = p[3]
def p_standby_option(self, p):
"standby_option : STANDBY KEYTYPE NUMBER"
if p[2] == "KSK":
self.current.ksk_standby = p[3]
else:
self.current.zsk_standby = p[3]
def p_keyttl_option(self, p):
"keyttl_option : KEYTTL duration"
self.current.keyttl = p[2]
def p_algorithm_option(self, p):
"algorithm_option : ALGORITHM ALGNAME"
self.current.algorithm = p[2]
def p_error(self, p):
if p:
print("%s%s%d:syntax error near '%s'" %
(self.filename or "", ":" if self.filename else "",
p.lineno, p.value))
else:
if not self.initial:
raise PolicyException("%s%s%d:unexpected end of input" %
(self.filename or "", ":" if self.filename else "",
p and p.lineno or 0))
if __name__ == "__main__":
import sys
if sys.argv[1] == "lex":
file = open(sys.argv[2])
text = file.read()
file.close()
plex = PolicyLex(debug=1)
plex.test(text)
elif sys.argv[1] == "parse":
try:
pp = dnssec_policy(sys.argv[2], write_tables=True, debug=True)
print(pp.named_policy['default'])
print(pp.policy("nonexistent.zone"))
except Exception as e:
print(e.args[0])
__init__.py 0000644 00000001651 15173300451 0006657 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
__all__ = ['checkds', 'coverage', 'keymgr', 'dnskey', 'eventlist',
'keydict', 'keyevent', 'keyseries', 'keyzone', 'policy',
'parsetab', 'rndc', 'utils']
from isc.dnskey import *
from isc.eventlist import *
from isc.keydict import *
from isc.keyevent import *
from isc.keyseries import *
from isc.keyzone import *
from isc.policy import *
from isc.rndc import *
from isc.utils import *
keyevent.py 0000644 00000005413 15173300451 0006752 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
import time
########################################################################
# Class keyevent
########################################################################
class keyevent:
""" A discrete key event, e.g., Publish, Activate, Inactive, Delete,
etc. Stores the date of the event, and identifying information
about the key to which the event will occur."""
def __init__(self, what, key, when=None):
self.what = what
self.when = when or key.gettime(what)
self.key = key
self.sep = key.sep
self.zone = key.name
self.alg = key.alg
self.keyid = key.keyid
def __repr__(self):
return repr((self.when, self.what, self.keyid, self.sep,
self.zone, self.alg))
def showtime(self):
return time.strftime("%a %b %d %H:%M:%S UTC %Y", self.when)
# update sets of active and published keys, based on
# the contents of this keyevent
def status(self, active, published, output = None):
def noop(*args, **kwargs): pass
if not output:
output = noop
if not active:
active = set()
if not published:
published = set()
if self.what == "Activate":
active.add(self.keyid)
elif self.what == "Publish":
published.add(self.keyid)
elif self.what == "Inactive":
if self.keyid not in active:
output("\tWARNING: %s scheduled to become inactive "
"before it is active"
% repr(self.key))
else:
active.remove(self.keyid)
elif self.what == "Delete":
if self.keyid in published:
published.remove(self.keyid)
else:
output("WARNING: key %s is scheduled for deletion "
"before it is published" % repr(self.key))
elif self.what == "Revoke":
# We don't need to worry about the logic of this one;
# just stop counting this key as either active or published
if self.keyid in published:
published.remove(self.keyid)
if self.keyid in active:
active.remove(self.keyid)
return active, published
keyseries.py 0000644 00000021022 15173300451 0007115 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
from collections import defaultdict
from .dnskey import *
from .keydict import *
from .keyevent import *
from .policy import *
import time
class keyseries:
_K = defaultdict(lambda: defaultdict(list))
_Z = defaultdict(lambda: defaultdict(list))
_zones = set()
_kdict = None
_context = None
def __init__(self, kdict, now=time.time(), context=None):
self._kdict = kdict
self._context = context
self._zones = set(kdict.missing())
for zone in kdict.zones():
self._zones.add(zone)
for alg, keys in kdict[zone].items():
for k in keys.values():
if k.sep:
if not (k.delete() and k.delete() < now):
self._K[zone][alg].append(k)
else:
if not (k.delete() and k.delete() < now):
self._Z[zone][alg].append(k)
self._K[zone][alg].sort()
self._Z[zone][alg].sort()
def __iter__(self):
for zone in self._zones:
for collection in [self._K, self._Z]:
if zone not in collection:
continue
for alg, keys in collection[zone].items():
for key in keys:
yield key
def dump(self):
for k in self:
print("%s" % repr(k))
def fixseries(self, keys, policy, now, **kwargs):
force = kwargs.get('force', False)
if not keys:
return
# handle the first key
key = keys[0]
if key.sep:
rp = policy.ksk_rollperiod
prepub = policy.ksk_prepublish or (30 * 86400)
postpub = policy.ksk_postpublish or (30 * 86400)
else:
rp = policy.zsk_rollperiod
prepub = policy.zsk_prepublish or (30 * 86400)
postpub = policy.zsk_postpublish or (30 * 86400)
# the first key should be published and active
p = key.publish()
a = key.activate()
if not p or p > now:
key.setpublish(now)
p = now
if not a or a > now:
key.setactivate(now)
a = now
i = key.inactive()
fudge = 300
if not rp:
key.setinactive(None, **kwargs)
key.setdelete(None, **kwargs)
elif not i or a + rp != i:
if not i and a + rp > now + prepub + fudge:
key.setinactive(a + rp, **kwargs)
key.setdelete(a + rp + postpub, **kwargs)
elif not i:
key.setinactive(now + prepub + fudge, **kwargs)
key.setdelete(now + prepub + postpub + fudge, **kwargs)
elif i < now:
pass
elif a + rp > i:
key.setinactive(a + rp, **kwargs)
key.setdelete(a + rp + postpub, **kwargs)
elif a + rp > now + prepub + fudge:
key.setinactive(a + rp, **kwargs)
key.setdelete(a + rp + postpub, **kwargs)
else:
key.setinactive(now + prepub + fudge, **kwargs)
key.setdelete(now + prepub + postpub + fudge, **kwargs)
else:
d = key.delete()
if not d or i + postpub > now + fudge:
key.setdelete(i + postpub, **kwargs)
elif not d:
key.setdelete(now + postpub + fudge, **kwargs)
elif d < now + fudge:
pass
elif d < i + postpub:
key.setdelete(i + postpub, **kwargs)
if policy.keyttl != key.ttl:
key.setttl(policy.keyttl)
# handle all the subsequent keys
prev = key
for key in keys[1:]:
# if no rollperiod, then all keys after the first in
# the series kept inactive.
# (XXX: we need to change this to allow standby keys)
if not rp:
key.setpublish(None, **kwargs)
key.setactivate(None, **kwargs)
key.setinactive(None, **kwargs)
key.setdelete(None, **kwargs)
if policy.keyttl != key.ttl:
key.setttl(policy.keyttl)
continue
# otherwise, ensure all dates are set correctly based on
# the initial key
a = prev.inactive()
p = a - prepub
key.setactivate(a, **kwargs)
key.setpublish(p, **kwargs)
key.setinactive(a + rp, **kwargs)
key.setdelete(a + rp + postpub, **kwargs)
prev.setdelete(a + postpub, **kwargs)
if policy.keyttl != key.ttl:
key.setttl(policy.keyttl)
prev = key
# if we haven't got sufficient coverage, create successor key(s)
while rp and prev.inactive() and \
prev.inactive() < now + policy.coverage:
# commit changes to predecessor: a successor can only be
# generated if Inactive has been set in the predecessor key
prev.commit(self._context['settime_path'], **kwargs)
key = prev.generate_successor(self._context['keygen_path'],
self._context['randomdev'],
prepub, **kwargs)
key.setinactive(key.activate() + rp, **kwargs)
key.setdelete(key.inactive() + postpub, **kwargs)
keys.append(key)
prev = key
# last key? we already know we have sufficient coverage now, so
# disable the inactivation of the final key (if it was set),
# ensuring that if dnssec-keymgr isn't run again, the last key
# in the series will at least remain usable.
prev.setinactive(None, **kwargs)
prev.setdelete(None, **kwargs)
# commit changes
for key in keys:
key.commit(self._context['settime_path'], **kwargs)
def enforce_policy(self, policies, now=time.time(), **kwargs):
# If zones is provided as a parameter, use that list.
# If not, use what we have in this object
zones = kwargs.get('zones', self._zones)
keys_dir = kwargs.get('dir', self._context.get('keys_path', None))
force = kwargs.get('force', False)
for zone in zones:
collections = []
policy = policies.policy(zone)
keys_dir = keys_dir or policy.directory or '.'
alg = policy.algorithm
algnum = dnskey.algnum(alg)
if 'ksk' not in kwargs or not kwargs['ksk']:
if len(self._Z[zone][algnum]) == 0:
k = dnskey.generate(self._context['keygen_path'],
self._context['randomdev'],
keys_dir, zone, alg,
policy.zsk_keysize, False,
policy.keyttl or 3600,
**kwargs)
self._Z[zone][algnum].append(k)
collections.append(self._Z[zone])
if 'zsk' not in kwargs or not kwargs['zsk']:
if len(self._K[zone][algnum]) == 0:
k = dnskey.generate(self._context['keygen_path'],
self._context['randomdev'],
keys_dir, zone, alg,
policy.ksk_keysize, True,
policy.keyttl or 3600,
**kwargs)
self._K[zone][algnum].append(k)
collections.append(self._K[zone])
for collection in collections:
for algorithm, keys in collection.items():
if algorithm != algnum:
continue
try:
self.fixseries(keys, policy, now, **kwargs)
except Exception as e:
raise Exception('%s/%s: %s' %
(zone, dnskey.algstr(algnum), str(e)))
coverage.py 0000644 00000023375 15173300451 0006722 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
from __future__ import print_function
import os
import sys
import argparse
import glob
import re
import time
import calendar
import pprint
from collections import defaultdict
prog = 'dnssec-coverage'
from isc import dnskey, eventlist, keydict, keyevent, keyzone, utils
############################################################################
# print a fatal error and exit
############################################################################
def fatal(*args, **kwargs):
print(*args, **kwargs)
sys.exit(1)
############################################################################
# output:
############################################################################
_firstline = True
def output(*args, **kwargs):
"""output text, adding a vertical space this is *not* the first
first section being printed since a call to vreset()"""
global _firstline
if 'skip' in kwargs:
skip = kwargs['skip']
kwargs.pop('skip', None)
else:
skip = True
if _firstline:
_firstline = False
elif skip:
print('')
if args:
print(*args, **kwargs)
def vreset():
"""reset vertical spacing"""
global _firstline
_firstline = True
############################################################################
# parse_time
############################################################################
def parse_time(s):
""" convert a formatted time (e.g., 1y, 6mo, 15mi, etc) into seconds
:param s: String with some text representing a time interval
:return: Integer with the number of seconds in the time interval
"""
s = s.strip()
# if s is an integer, we're done already
try:
return int(s)
except ValueError:
pass
# try to parse as a number with a suffix indicating unit of time
r = re.compile(r'([0-9][0-9]*)\s*([A-Za-z]*)')
m = r.match(s)
if not m:
raise ValueError("Cannot parse %s" % s)
n, unit = m.groups()
n = int(n)
unit = unit.lower()
if unit.startswith('y'):
return n * 31536000
elif unit.startswith('mo'):
return n * 2592000
elif unit.startswith('w'):
return n * 604800
elif unit.startswith('d'):
return n * 86400
elif unit.startswith('h'):
return n * 3600
elif unit.startswith('mi'):
return n * 60
elif unit.startswith('s'):
return n
else:
raise ValueError("Invalid suffix %s" % unit)
############################################################################
# set_path:
############################################################################
def set_path(command, default=None):
""" find the location of a specified command. if a default is supplied
and it works, we use it; otherwise we search PATH for a match.
:param command: string with a command to look for in the path
:param default: default location to use
:return: detected location for the desired command
"""
fpath = default
if not fpath or not os.path.isfile(fpath) or not os.access(fpath, os.X_OK):
path = os.environ["PATH"]
if not path:
path = os.path.defpath
for directory in path.split(os.pathsep):
fpath = os.path.join(directory, command)
if os.path.isfile(fpath) and os.access(fpath, os.X_OK):
break
fpath = None
return fpath
############################################################################
# parse_args:
############################################################################
def parse_args():
"""Read command line arguments, set global 'args' structure"""
compilezone = set_path('named-compilezone',
os.path.join(utils.prefix('sbin'),
'named-compilezone'))
parser = argparse.ArgumentParser(description=prog + ': checks future ' +
'DNSKEY coverage for a zone')
parser.add_argument('zone', type=str, nargs='*', default=None,
help='zone(s) to check' +
'(default: all zones in the directory)')
parser.add_argument('-K', dest='path', default='.', type=str,
help='a directory containing keys to process',
metavar='dir')
parser.add_argument('-f', dest='filename', type=str,
help='zone master file', metavar='file')
parser.add_argument('-m', dest='maxttl', type=str,
help='the longest TTL in the zone(s)',
metavar='time')
parser.add_argument('-d', dest='keyttl', type=str,
help='the DNSKEY TTL', metavar='time')
parser.add_argument('-r', dest='resign', default='1944000',
type=str, help='the RRSIG refresh interval '
'in seconds [default: 22.5 days]',
metavar='time')
parser.add_argument('-c', dest='compilezone',
default=compilezone, type=str,
help='path to \'named-compilezone\'',
metavar='path')
parser.add_argument('-l', dest='checklimit',
type=str, default='0',
help='Length of time to check for '
'DNSSEC coverage [default: 0 (unlimited)]',
metavar='time')
parser.add_argument('-z', dest='no_ksk',
action='store_true', default=False,
help='Only check zone-signing keys (ZSKs)')
parser.add_argument('-k', dest='no_zsk',
action='store_true', default=False,
help='Only check key-signing keys (KSKs)')
parser.add_argument('-D', '--debug', dest='debug_mode',
action='store_true', default=False,
help='Turn on debugging output')
parser.add_argument('-v', '--version', action='version',
version=utils.version)
args = parser.parse_args()
if args.no_zsk and args.no_ksk:
fatal("ERROR: -z and -k cannot be used together.")
elif args.no_zsk or args.no_ksk:
args.keytype = "KSK" if args.no_zsk else "ZSK"
else:
args.keytype = None
if args.filename and len(args.zone) > 1:
fatal("ERROR: -f can only be used with one zone.")
# strip trailing dots if any
args.zone = [x[:-1] if (len(x) > 1 and x[-1] == '.') else x
for x in args.zone]
# convert from time arguments to seconds
try:
if args.maxttl:
m = parse_time(args.maxttl)
args.maxttl = m
except ValueError:
pass
try:
if args.keyttl:
k = parse_time(args.keyttl)
args.keyttl = k
except ValueError:
pass
try:
if args.resign:
r = parse_time(args.resign)
args.resign = r
except ValueError:
pass
try:
if args.checklimit:
lim = args.checklimit
r = parse_time(args.checklimit)
if r == 0:
args.checklimit = None
else:
args.checklimit = time.time() + r
except ValueError:
pass
# if we've got the values we need from the command line, stop now
if args.maxttl and args.keyttl:
return args
# load keyttl and maxttl data from zonefile
if args.zone and args.filename:
try:
zone = keyzone(args.zone[0], args.filename, args.compilezone)
args.maxttl = args.maxttl or zone.maxttl
args.keyttl = args.maxttl or zone.keyttl
except Exception as e:
print("Unable to load zone data from %s: " % args.filename, e)
if not args.maxttl:
output("WARNING: Maximum TTL value was not specified. Using 1 week\n"
"\t (604800 seconds); re-run with the -m option to get more\n"
"\t accurate results.")
args.maxttl = 604800
return args
############################################################################
# Main
############################################################################
def main():
args = parse_args()
print("PHASE 1--Loading keys to check for internal timing problems")
try:
kd = keydict(path=args.path, zones=args.zone, keyttl=args.keyttl)
except Exception as e:
fatal('ERROR: Unable to build key dictionary: ' + str(e))
for key in kd:
key.check_prepub(output)
if key.sep:
key.check_postpub(output)
else:
key.check_postpub(output, args.maxttl + args.resign)
output("PHASE 2--Scanning future key events for coverage failures")
vreset()
try:
elist = eventlist(kd)
except Exception as e:
fatal('ERROR: Unable to build event list: ' + str(e))
errors = False
if not args.zone:
if not elist.coverage(None, args.keytype, args.checklimit, output):
errors = True
else:
for zone in args.zone:
try:
if not elist.coverage(zone, args.keytype,
args.checklimit, output):
errors = True
except:
output('ERROR: Coverage check failed for zone ' + zone)
sys.exit(1 if errors else 0)
keymgr.py 0000644 00000014553 15173300451 0006423 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
from __future__ import print_function
import os, sys, argparse, glob, re, time, calendar, pprint
from collections import defaultdict
prog='dnssec-keymgr'
from isc import dnskey, keydict, keyseries, policy, parsetab, utils
############################################################################
# print a fatal error and exit
############################################################################
def fatal(*args, **kwargs):
print(*args, **kwargs)
sys.exit(1)
############################################################################
# find the location of an external command
############################################################################
def set_path(command, default=None):
""" find the location of a specified command. If a default is supplied,
exists and it's an executable, we use it; otherwise we search PATH
for an alternative.
:param command: command to look for
:param default: default value to use
:return: PATH with the location of a suitable binary
"""
fpath = default
if not fpath or not os.path.isfile(fpath) or not os.access(fpath, os.X_OK):
path = os.environ["PATH"]
if not path:
path = os.path.defpath
for directory in path.split(os.pathsep):
fpath = directory + os.sep + command
if os.path.isfile(fpath) and os.access(fpath, os.X_OK):
break
fpath = None
return fpath
############################################################################
# parse arguments
############################################################################
def parse_args():
""" Read command line arguments, returns 'args' object
:return: args object properly prepared
"""
keygen = set_path('dnssec-keygen',
os.path.join(utils.prefix('sbin'), 'dnssec-keygen'))
settime = set_path('dnssec-settime',
os.path.join(utils.prefix('sbin'), 'dnssec-settime'))
parser = argparse.ArgumentParser(description=prog + ': schedule '
'DNSSEC key rollovers according to a '
'pre-defined policy')
parser.add_argument('zone', type=str, nargs='*', default=None,
help='Zone(s) to which the policy should be applied ' +
'(default: all zones in the directory)')
parser.add_argument('-K', dest='path', type=str,
help='Directory containing keys', metavar='dir')
parser.add_argument('-c', dest='policyfile', type=str,
help='Policy definition file', metavar='file')
parser.add_argument('-g', dest='keygen', default=keygen, type=str,
help='Path to \'dnssec-keygen\'',
metavar='path')
parser.add_argument('-r', dest='randomdev', type=str, default=None,
help='Path to a file containing random data to pass to \'dnssec-keygen\'',
metavar='path')
parser.add_argument('-s', dest='settime', default=settime, type=str,
help='Path to \'dnssec-settime\'',
metavar='path')
parser.add_argument('-k', dest='no_zsk',
action='store_true', default=False,
help='Only apply policy to key-signing keys (KSKs)')
parser.add_argument('-z', dest='no_ksk',
action='store_true', default=False,
help='Only apply policy to zone-signing keys (ZSKs)')
parser.add_argument('-f', '--force', dest='force', action='store_true',
default=False, help='Force updates to key events '+
'even if they are in the past')
parser.add_argument('-q', '--quiet', dest='quiet', action='store_true',
default=False, help='Update keys silently')
parser.add_argument('-v', '--version', action='version',
version=utils.version)
args = parser.parse_args()
if args.no_zsk and args.no_ksk:
fatal("ERROR: -z and -k cannot be used together.")
if args.keygen is None:
fatal("ERROR: dnssec-keygen not found")
if args.settime is None:
fatal("ERROR: dnssec-settime not found")
# if a policy file was specified, check that it exists.
# if not, use the default file, unless it doesn't exist
if args.policyfile is not None:
if not os.path.exists(args.policyfile):
fatal('ERROR: Policy file "%s" not found' % args.policyfile)
else:
args.policyfile = os.path.join(utils.sysconfdir,
'dnssec-policy.conf')
if not os.path.exists(args.policyfile):
args.policyfile = None
return args
############################################################################
# main
############################################################################
def main():
args = parse_args()
# As we may have specific locations for the binaries, we put that info
# into a context object that can be passed around
context = {'keygen_path': args.keygen,
'settime_path': args.settime,
'keys_path': args.path,
'randomdev': args.randomdev}
try:
dp = policy.dnssec_policy(args.policyfile)
except Exception as e:
fatal('Unable to load DNSSEC policy: ' + str(e))
try:
kd = keydict(dp, path=args.path, zones=args.zone)
except Exception as e:
fatal('Unable to build key dictionary: ' + str(e))
try:
ks = keyseries(kd, context=context)
except Exception as e:
fatal('Unable to build key series: ' + str(e))
try:
ks.enforce_policy(dp, ksk=args.no_zsk, zsk=args.no_ksk,
force=args.force, quiet=args.quiet)
except Exception as e:
fatal('Unable to apply policy: ' + str(e))
checkds.py 0000644 00000015446 15173300451 0006533 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
import argparse
import os
import sys
from subprocess import Popen, PIPE
from isc.utils import prefix,version
prog = 'dnssec-checkds'
############################################################################
# SECRR class:
# Class for DS/DLV resource record
############################################################################
class SECRR:
hashalgs = {1: 'SHA-1', 2: 'SHA-256', 3: 'GOST', 4: 'SHA-384'}
rrname = ''
rrclass = 'IN'
keyid = None
keyalg = None
hashalg = None
digest = ''
ttl = 0
def __init__(self, rrtext, dlvname = None):
if not rrtext:
raise Exception
# 'str' does not have decode method in python3
if type(rrtext) is not str:
fields = rrtext.decode('ascii').split()
else:
fields = rrtext.split()
if len(fields) < 7:
raise Exception
if dlvname:
self.rrtype = "DLV"
self.dlvname = dlvname.lower()
parent = fields[0].lower().strip('.').split('.')
parent.reverse()
dlv = dlvname.split('.')
dlv.reverse()
while len(dlv) != 0 and len(parent) != 0 and parent[0] == dlv[0]:
parent = parent[1:]
dlv = dlv[1:]
if dlv:
raise Exception
parent.reverse()
self.parent = '.'.join(parent)
self.rrname = self.parent + '.' + self.dlvname + '.'
else:
self.rrtype = "DS"
self.rrname = fields[0].lower()
fields = fields[1:]
if fields[0].upper() in ['IN', 'CH', 'HS']:
self.rrclass = fields[0].upper()
fields = fields[1:]
else:
self.ttl = int(fields[0])
self.rrclass = fields[1].upper()
fields = fields[2:]
if fields[0].upper() != self.rrtype:
raise Exception('%s does not match %s' %
(fields[0].upper(), self.rrtype))
self.keyid, self.keyalg, self.hashalg = map(int, fields[1:4])
self.digest = ''.join(fields[4:]).upper()
def __repr__(self):
return '%s %s %s %d %d %d %s' % \
(self.rrname, self.rrclass, self.rrtype,
self.keyid, self.keyalg, self.hashalg, self.digest)
def __eq__(self, other):
return self.__repr__() == other.__repr__()
############################################################################
# check:
# Fetch DS/DLV RRset for the given zone from the DNS; fetch DNSKEY
# RRset from the masterfile if specified, or from DNS if not.
# Generate a set of expected DS/DLV records from the DNSKEY RRset,
# and report on congruency.
############################################################################
def check(zone, args, masterfile=None, lookaside=None):
rrlist = []
cmd = [args.dig, "+noall", "+answer", "-t", "dlv" if lookaside else "ds",
"-q", zone + "." + lookaside if lookaside else zone]
fp, _ = Popen(cmd, stdout=PIPE).communicate()
for line in fp.splitlines():
if type(line) is not str:
line = line.decode('ascii')
rrlist.append(SECRR(line, lookaside))
rrlist = sorted(rrlist, key=lambda rr: (rr.keyid, rr.keyalg, rr.hashalg))
klist = []
if masterfile:
cmd = [args.dsfromkey, "-f", masterfile]
if lookaside:
cmd += ["-l", lookaside]
cmd.append(zone)
fp, _ = Popen(cmd, stdout=PIPE).communicate()
else:
intods, _ = Popen([args.dig, "+noall", "+answer", "-t", "dnskey",
"-q", zone], stdout=PIPE).communicate()
cmd = [args.dsfromkey, "-f", "-"]
if lookaside:
cmd += ["-l", lookaside]
cmd.append(zone)
fp, _ = Popen(cmd, stdin=PIPE, stdout=PIPE).communicate(intods)
for line in fp.splitlines():
if type(line) is not str:
line = line.decode('ascii')
klist.append(SECRR(line, lookaside))
if len(klist) < 1:
print("No DNSKEY records found in zone apex")
return False
found = False
for rr in klist:
if rr in rrlist:
print("%s for KSK %s/%03d/%05d (%s) found in parent" %
(rr.rrtype, rr.rrname.strip('.'), rr.keyalg,
rr.keyid, SECRR.hashalgs[rr.hashalg]))
found = True
else:
print("%s for KSK %s/%03d/%05d (%s) missing from parent" %
(rr.rrtype, rr.rrname.strip('.'), rr.keyalg,
rr.keyid, SECRR.hashalgs[rr.hashalg]))
if not found:
print("No %s records were found for any DNSKEY" % ("DLV" if lookaside else "DS"))
return found
############################################################################
# parse_args:
# Read command line arguments, set global 'args' structure
############################################################################
def parse_args():
parser = argparse.ArgumentParser(description=prog + ': checks DS coverage')
bindir = 'bin'
sbindir = 'bin' if os.name == 'nt' else 'sbin'
parser.add_argument('zone', type=str, help='zone to check')
parser.add_argument('-f', '--file', dest='masterfile', type=str,
help='zone master file')
parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
help='DLV lookaside zone')
parser.add_argument('-d', '--dig', dest='dig',
default=os.path.join(prefix(bindir), 'dig'),
type=str, help='path to \'dig\'')
parser.add_argument('-D', '--dsfromkey', dest='dsfromkey',
default=os.path.join(prefix(sbindir),
'dnssec-dsfromkey'),
type=str, help='path to \'dnssec-dsfromkey\'')
parser.add_argument('-v', '--version', action='version',
version=version)
args = parser.parse_args()
args.zone = args.zone.strip('.')
if args.lookaside:
args.lookaside = args.lookaside.strip('.')
return args
############################################################################
# Main
############################################################################
def main():
args = parse_args()
found = check(args.zone, args, args.masterfile, args.lookaside)
exit(0 if found else 1)
parsetab.py 0000644 00000017575 15173300451 0006735 0 ustar 00
# parsetab.py
# This file is automatically generated. Do not edit.
_tabversion = '3.8'
_lr_method = 'LALR'
_lr_signature = 'C2FE91AF256AF1CCEB499107DA2CFE7E'
_lr_action_items = {'ALGORITHM_POLICY':([0,1,2,3,4,5,6,10,29,46,62,],[-3,7,7,-2,-4,-5,-6,-1,-15,-16,-17,]),'ZONE':([0,1,2,3,4,5,6,10,29,46,62,],[-3,8,8,-2,-4,-5,-6,-1,-15,-16,-17,]),'POLICY':([0,1,2,3,4,5,6,10,27,29,46,47,62,77,88,],[-3,9,9,-2,-4,-5,-6,-1,59,-15,-16,59,-17,-22,-23,]),'$end':([1,3,4,5,6,10,29,46,62,],[0,-2,-4,-5,-6,-1,-15,-16,-17,]),'ALGNAME':([7,61,],[11,80,]),'STR':([8,9,59,],[13,18,18,]),'QSTRING':([8,60,],[14,79,]),'KEYTYPE':([8,9,40,41,42,44,45,59,],[15,19,69,70,71,73,74,19,]),'DATESUFFIX':([8,9,59,67,],[16,20,20,82,]),'LBRACE':([11,12,13,14,15,16,17,18,19,20,21,22,23,],[-14,-14,-10,-11,-12,-13,-14,-7,-8,-9,25,27,27,]),'SEMI':([18,19,20,24,26,28,31,32,33,34,35,36,37,38,48,49,50,51,52,53,54,55,56,57,58,63,64,66,67,68,72,75,76,78,79,80,82,83,84,85,86,87,],[-7,-8,-9,29,46,62,65,-37,-38,-39,-40,-41,-42,-43,77,-24,-25,-26,-27,-28,-29,-30,-31,-32,-33,-34,81,-46,-18,-19,-52,-21,88,-44,-45,-53,-20,-47,-48,-49,-50,-51,]),'COVERAGE':([25,27,30,47,65,77,81,88,],[39,39,39,39,-35,-22,-36,-23,]),'ROLL_PERIOD':([25,27,30,47,65,77,81,88,],[40,40,40,40,-35,-22,-36,-23,]),'PRE_PUBLISH':([25,27,30,47,65,77,81,88,],[41,41,41,41,-35,-22,-36,-23,]),'POST_PUBLISH':([25,27,30,47,65,77,81,88,],[42,42,42,42,-35,-22,-36,-23,]),'KEYTTL':([25,27,30,47,65,77,81,88,],[43,43,43,43,-35,-22,-36,-23,]),'KEY_SIZE':([25,27,30,47,65,77,81,88,],[44,44,44,44,-35,-22,-36,-23,]),'STANDBY':([25,27,30,47,65,77,81,88,],[45,45,45,45,-35,-22,-36,-23,]),'DIRECTORY':([27,47,77,88,],[60,60,-22,-23,]),'ALGORITHM':([27,47,77,88,],[61,61,-22,-23,]),'RBRACE':([30,47,65,77,81,88,],[63,75,-35,-22,-36,-23,]),'NUMBER':([39,43,69,70,71,73,74,],[67,67,67,67,67,86,87,]),'NONE':([39,43,69,70,71,],[68,68,68,68,68,]),}
_lr_action = {}
for _k, _v in _lr_action_items.items():
for _x,_y in zip(_v[0],_v[1]):
if not _x in _lr_action: _lr_action[_x] = {}
_lr_action[_x][_k] = _y
del _lr_action_items
_lr_goto_items = {'policylist':([0,],[1,]),'init':([0,],[2,]),'policy':([1,2,],[3,10,]),'alg_policy':([1,2,],[4,4,]),'zone_policy':([1,2,],[5,5,]),'named_policy':([1,2,],[6,6,]),'domain':([8,],[12,]),'name':([9,59,],[17,78,]),'new_policy':([11,12,17,],[21,22,23,]),'alg_option_group':([21,],[24,]),'policy_option_group':([22,23,],[26,28,]),'alg_option_list':([25,],[30,]),'alg_option':([25,30,],[31,64,]),'coverage_option':([25,27,30,47,],[32,51,32,51,]),'rollperiod_option':([25,27,30,47,],[33,52,33,52,]),'prepublish_option':([25,27,30,47,],[34,53,34,53,]),'postpublish_option':([25,27,30,47,],[35,54,35,54,]),'keyttl_option':([25,27,30,47,],[36,57,36,57,]),'keysize_option':([25,27,30,47,],[37,55,37,55,]),'standby_option':([25,27,30,47,],[38,58,38,58,]),'policy_option_list':([27,],[47,]),'policy_option':([27,47,],[48,76,]),'parent_option':([27,47,],[49,49,]),'directory_option':([27,47,],[50,50,]),'algorithm_option':([27,47,],[56,56,]),'duration':([39,43,69,70,71,],[66,72,83,84,85,]),}
_lr_goto = {}
for _k, _v in _lr_goto_items.items():
for _x, _y in zip(_v[0], _v[1]):
if not _x in _lr_goto: _lr_goto[_x] = {}
_lr_goto[_x][_k] = _y
del _lr_goto_items
_lr_productions = [
("S' -> policylist","S'",1,None,None,None),
('policylist -> init policy','policylist',2,'p_policylist','policy.py',523),
('policylist -> policylist policy','policylist',2,'p_policylist','policy.py',524),
('init -> <empty>','init',0,'p_init','policy.py',528),
('policy -> alg_policy','policy',1,'p_policy','policy.py',532),
('policy -> zone_policy','policy',1,'p_policy','policy.py',533),
('policy -> named_policy','policy',1,'p_policy','policy.py',534),
('name -> STR','name',1,'p_name','policy.py',538),
('name -> KEYTYPE','name',1,'p_name','policy.py',539),
('name -> DATESUFFIX','name',1,'p_name','policy.py',540),
('domain -> STR','domain',1,'p_domain','policy.py',545),
('domain -> QSTRING','domain',1,'p_domain','policy.py',546),
('domain -> KEYTYPE','domain',1,'p_domain','policy.py',547),
('domain -> DATESUFFIX','domain',1,'p_domain','policy.py',548),
('new_policy -> <empty>','new_policy',0,'p_new_policy','policy.py',555),
('alg_policy -> ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMI','alg_policy',5,'p_alg_policy','policy.py',559),
('zone_policy -> ZONE domain new_policy policy_option_group SEMI','zone_policy',5,'p_zone_policy','policy.py',566),
('named_policy -> POLICY name new_policy policy_option_group SEMI','named_policy',5,'p_named_policy','policy.py',573),
('duration -> NUMBER','duration',1,'p_duration_1','policy.py',579),
('duration -> NONE','duration',1,'p_duration_2','policy.py',584),
('duration -> NUMBER DATESUFFIX','duration',2,'p_duration_3','policy.py',589),
('policy_option_group -> LBRACE policy_option_list RBRACE','policy_option_group',3,'p_policy_option_group','policy.py',608),
('policy_option_list -> policy_option SEMI','policy_option_list',2,'p_policy_option_list','policy.py',612),
('policy_option_list -> policy_option_list policy_option SEMI','policy_option_list',3,'p_policy_option_list','policy.py',613),
('policy_option -> parent_option','policy_option',1,'p_policy_option','policy.py',617),
('policy_option -> directory_option','policy_option',1,'p_policy_option','policy.py',618),
('policy_option -> coverage_option','policy_option',1,'p_policy_option','policy.py',619),
('policy_option -> rollperiod_option','policy_option',1,'p_policy_option','policy.py',620),
('policy_option -> prepublish_option','policy_option',1,'p_policy_option','policy.py',621),
('policy_option -> postpublish_option','policy_option',1,'p_policy_option','policy.py',622),
('policy_option -> keysize_option','policy_option',1,'p_policy_option','policy.py',623),
('policy_option -> algorithm_option','policy_option',1,'p_policy_option','policy.py',624),
('policy_option -> keyttl_option','policy_option',1,'p_policy_option','policy.py',625),
('policy_option -> standby_option','policy_option',1,'p_policy_option','policy.py',626),
('alg_option_group -> LBRACE alg_option_list RBRACE','alg_option_group',3,'p_alg_option_group','policy.py',630),
('alg_option_list -> alg_option SEMI','alg_option_list',2,'p_alg_option_list','policy.py',634),
('alg_option_list -> alg_option_list alg_option SEMI','alg_option_list',3,'p_alg_option_list','policy.py',635),
('alg_option -> coverage_option','alg_option',1,'p_alg_option','policy.py',639),
('alg_option -> rollperiod_option','alg_option',1,'p_alg_option','policy.py',640),
('alg_option -> prepublish_option','alg_option',1,'p_alg_option','policy.py',641),
('alg_option -> postpublish_option','alg_option',1,'p_alg_option','policy.py',642),
('alg_option -> keyttl_option','alg_option',1,'p_alg_option','policy.py',643),
('alg_option -> keysize_option','alg_option',1,'p_alg_option','policy.py',644),
('alg_option -> standby_option','alg_option',1,'p_alg_option','policy.py',645),
('parent_option -> POLICY name','parent_option',2,'p_parent_option','policy.py',649),
('directory_option -> DIRECTORY QSTRING','directory_option',2,'p_directory_option','policy.py',653),
('coverage_option -> COVERAGE duration','coverage_option',2,'p_coverage_option','policy.py',657),
('rollperiod_option -> ROLL_PERIOD KEYTYPE duration','rollperiod_option',3,'p_rollperiod_option','policy.py',661),
('prepublish_option -> PRE_PUBLISH KEYTYPE duration','prepublish_option',3,'p_prepublish_option','policy.py',668),
('postpublish_option -> POST_PUBLISH KEYTYPE duration','postpublish_option',3,'p_postpublish_option','policy.py',675),
('keysize_option -> KEY_SIZE KEYTYPE NUMBER','keysize_option',3,'p_keysize_option','policy.py',682),
('standby_option -> STANDBY KEYTYPE NUMBER','standby_option',3,'p_standby_option','policy.py',689),
('keyttl_option -> KEYTTL duration','keyttl_option',2,'p_keyttl_option','policy.py',696),
('algorithm_option -> ALGORITHM ALGNAME','algorithm_option',2,'p_algorithm_option','policy.py',700),
]
dnskey.py 0000644 00000040040 15173300452 0006411 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
import os
import time
import calendar
from subprocess import Popen, PIPE
########################################################################
# Class dnskey
########################################################################
class TimePast(Exception):
def __init__(self, key, prop, value):
super(TimePast, self).__init__('%s time for key %s (%d) is already past'
% (prop, key, value))
class dnskey:
"""An individual DNSSEC key. Identified by path, name, algorithm, keyid.
Contains a dictionary of metadata events."""
_PROPS = ('Created', 'Publish', 'Activate', 'Inactive', 'Delete',
'Revoke', 'DSPublish', 'SyncPublish', 'SyncDelete')
_OPTS = (None, '-P', '-A', '-I', '-D', '-R', None, '-Psync', '-Dsync')
_ALGNAMES = (None, 'RSAMD5', 'DH', 'DSA', 'ECC', 'RSASHA1',
'NSEC3DSA', 'NSEC3RSASHA1', 'RSASHA256', None,
'RSASHA512', None, 'ECCGOST', 'ECDSAP256SHA256',
'ECDSAP384SHA384', 'ED25519', 'ED448')
def __init__(self, key, directory=None, keyttl=None):
# this makes it possible to use algname as a class or instance method
if isinstance(key, tuple) and len(key) == 3:
self._dir = directory or '.'
(name, alg, keyid) = key
self.fromtuple(name, alg, keyid, keyttl)
self._dir = directory or os.path.dirname(key) or '.'
key = os.path.basename(key)
(name, alg, keyid) = key.split('+')
name = name[1:-1]
alg = int(alg)
keyid = int(keyid.split('.')[0])
self.fromtuple(name, alg, keyid, keyttl)
def fromtuple(self, name, alg, keyid, keyttl):
if name.endswith('.'):
fullname = name
name = name.rstrip('.')
else:
fullname = name + '.'
keystr = "K%s+%03d+%05d" % (fullname, alg, keyid)
key_file = self._dir + (self._dir and os.sep or '') + keystr + ".key"
private_file = (self._dir + (self._dir and os.sep or '') +
keystr + ".private")
self.keystr = keystr
self.name = name
self.alg = int(alg)
self.keyid = int(keyid)
self.fullname = fullname
kfp = open(key_file, "r")
for line in kfp:
if line[0] == ';':
continue
tokens = line.split()
if not tokens:
continue
if tokens[1].lower() in ('in', 'ch', 'hs'):
septoken = 3
self.ttl = keyttl
else:
septoken = 4
self.ttl = int(tokens[1]) if not keyttl else keyttl
if (int(tokens[septoken]) & 0x1) == 1:
self.sep = True
else:
self.sep = False
kfp.close()
pfp = open(private_file, "rU")
self.metadata = dict()
self._changed = dict()
self._delete = dict()
self._times = dict()
self._fmttime = dict()
self._timestamps = dict()
self._original = dict()
self._origttl = None
for line in pfp:
line = line.strip()
if not line or line[0] in ('!#'):
continue
punctuation = [line.find(c) for c in ':= '] + [len(line)]
found = min([pos for pos in punctuation if pos != -1])
name = line[:found].rstrip()
value = line[found:].lstrip(":= ").rstrip()
self.metadata[name] = value
for prop in dnskey._PROPS:
self._changed[prop] = False
if prop in self.metadata:
t = self.parsetime(self.metadata[prop])
self._times[prop] = t
self._fmttime[prop] = self.formattime(t)
self._timestamps[prop] = self.epochfromtime(t)
self._original[prop] = self._timestamps[prop]
else:
self._times[prop] = None
self._fmttime[prop] = None
self._timestamps[prop] = None
self._original[prop] = None
pfp.close()
def commit(self, settime_bin, **kwargs):
quiet = kwargs.get('quiet', False)
cmd = []
first = True
if self._origttl is not None:
cmd += ["-L", str(self.ttl)]
for prop, opt in zip(dnskey._PROPS, dnskey._OPTS):
if not opt or not self._changed[prop]:
continue
delete = False
if prop in self._delete and self._delete[prop]:
delete = True
when = 'none' if delete else self._fmttime[prop]
cmd += [opt, when]
first = False
if cmd:
fullcmd = [settime_bin, "-K", self._dir] + cmd + [self.keystr,]
if not quiet:
print('# ' + ' '.join(fullcmd))
try:
p = Popen(fullcmd, stdout=PIPE, stderr=PIPE)
stdout, stderr = p.communicate()
if stderr:
raise Exception(str(stderr))
except Exception as e:
raise Exception('unable to run %s: %s' %
(settime_bin, str(e)))
self._origttl = None
for prop in dnskey._PROPS:
self._original[prop] = self._timestamps[prop]
self._changed[prop] = False
@classmethod
def generate(cls, keygen_bin, randomdev, keys_dir, name, alg, keysize, sep,
ttl, publish=None, activate=None, **kwargs):
quiet = kwargs.get('quiet', False)
keygen_cmd = [keygen_bin, "-q", "-K", keys_dir, "-L", str(ttl)]
if randomdev:
keygen_cmd += ["-r", randomdev]
if sep:
keygen_cmd.append("-fk")
if alg:
keygen_cmd += ["-a", alg]
if keysize:
keygen_cmd += ["-b", str(keysize)]
if publish:
t = dnskey.timefromepoch(publish)
keygen_cmd += ["-P", dnskey.formattime(t)]
if activate:
t = dnskey.timefromepoch(activate)
keygen_cmd += ["-A", dnskey.formattime(activate)]
keygen_cmd.append(name)
if not quiet:
print('# ' + ' '.join(keygen_cmd))
p = Popen(keygen_cmd, stdout=PIPE, stderr=PIPE)
stdout, stderr = p.communicate()
if stderr:
raise Exception('unable to generate key: ' + str(stderr))
try:
keystr = stdout.splitlines()[0].decode('ascii')
newkey = dnskey(keystr, keys_dir, ttl)
return newkey
except Exception as e:
raise Exception('unable to parse generated key: %s' % str(e))
def generate_successor(self, keygen_bin, randomdev, prepublish, **kwargs):
quiet = kwargs.get('quiet', False)
if not self.inactive():
raise Exception("predecessor key %s has no inactive date" % self)
keygen_cmd = [keygen_bin, "-q", "-K", self._dir, "-S", self.keystr]
if self.ttl:
keygen_cmd += ["-L", str(self.ttl)]
if randomdev:
keygen_cmd += ["-r", randomdev]
if prepublish:
keygen_cmd += ["-i", str(prepublish)]
if not quiet:
print('# ' + ' '.join(keygen_cmd))
p = Popen(keygen_cmd, stdout=PIPE, stderr=PIPE)
stdout, stderr = p.communicate()
if stderr:
raise Exception('unable to generate key: ' + stderr)
try:
keystr = stdout.splitlines()[0].decode('ascii')
newkey = dnskey(keystr, self._dir, self.ttl)
return newkey
except:
raise Exception('unable to generate successor for key %s' % self)
@staticmethod
def algstr(alg):
name = None
if alg in range(len(dnskey._ALGNAMES)):
name = dnskey._ALGNAMES[alg]
return name if name else ("%03d" % alg)
@staticmethod
def algnum(alg):
if not alg:
return None
alg = alg.upper()
try:
return dnskey._ALGNAMES.index(alg)
except ValueError:
return None
def algname(self, alg=None):
return self.algstr(alg or self.alg)
@staticmethod
def timefromepoch(secs):
return time.gmtime(secs)
@staticmethod
def parsetime(string):
return time.strptime(string, "%Y%m%d%H%M%S")
@staticmethod
def epochfromtime(t):
return calendar.timegm(t)
@staticmethod
def formattime(t):
return time.strftime("%Y%m%d%H%M%S", t)
def setmeta(self, prop, secs, now, **kwargs):
force = kwargs.get('force', False)
if self._timestamps[prop] == secs:
return
if self._original[prop] is not None and \
self._original[prop] < now and not force:
raise TimePast(self, prop, self._original[prop])
if secs is None:
self._changed[prop] = False \
if self._original[prop] is None else True
self._delete[prop] = True
self._timestamps[prop] = None
self._times[prop] = None
self._fmttime[prop] = None
return
t = self.timefromepoch(secs)
self._timestamps[prop] = secs
self._times[prop] = t
self._fmttime[prop] = self.formattime(t)
self._changed[prop] = False if \
self._original[prop] == self._timestamps[prop] else True
def gettime(self, prop):
return self._times[prop]
def getfmttime(self, prop):
return self._fmttime[prop]
def gettimestamp(self, prop):
return self._timestamps[prop]
def created(self):
return self._timestamps["Created"]
def syncpublish(self):
return self._timestamps["SyncPublish"]
def setsyncpublish(self, secs, now=time.time(), **kwargs):
self.setmeta("SyncPublish", secs, now, **kwargs)
def publish(self):
return self._timestamps["Publish"]
def setpublish(self, secs, now=time.time(), **kwargs):
self.setmeta("Publish", secs, now, **kwargs)
def activate(self):
return self._timestamps["Activate"]
def setactivate(self, secs, now=time.time(), **kwargs):
self.setmeta("Activate", secs, now, **kwargs)
def revoke(self):
return self._timestamps["Revoke"]
def setrevoke(self, secs, now=time.time(), **kwargs):
self.setmeta("Revoke", secs, now, **kwargs)
def inactive(self):
return self._timestamps["Inactive"]
def setinactive(self, secs, now=time.time(), **kwargs):
self.setmeta("Inactive", secs, now, **kwargs)
def delete(self):
return self._timestamps["Delete"]
def setdelete(self, secs, now=time.time(), **kwargs):
self.setmeta("Delete", secs, now, **kwargs)
def syncdelete(self):
return self._timestamps["SyncDelete"]
def setsyncdelete(self, secs, now=time.time(), **kwargs):
self.setmeta("SyncDelete", secs, now, **kwargs)
def setttl(self, ttl):
if ttl is None or self.ttl == ttl:
return
elif self._origttl is None:
self._origttl = self.ttl
self.ttl = ttl
elif self._origttl == ttl:
self._origttl = None
self.ttl = ttl
else:
self.ttl = ttl
def keytype(self):
return ("KSK" if self.sep else "ZSK")
def __str__(self):
return ("%s/%s/%05d"
% (self.name, self.algname(), self.keyid))
def __repr__(self):
return ("%s/%s/%05d (%s)"
% (self.name, self.algname(), self.keyid,
("KSK" if self.sep else "ZSK")))
def date(self):
return (self.activate() or self.publish() or self.created())
# keys are sorted first by zone name, then by algorithm. within
# the same name/algorithm, they are sorted according to their
# 'date' value: the activation date if set, OR the publication
# if set, OR the creation date.
def __lt__(self, other):
if self.name != other.name:
return self.name < other.name
if self.alg != other.alg:
return self.alg < other.alg
return self.date() < other.date()
def check_prepub(self, output=None):
def noop(*args, **kwargs): pass
if not output:
output = noop
now = int(time.time())
a = self.activate()
p = self.publish()
if not a:
return False
if not p:
if a > now:
output("WARNING: Key %s is scheduled for\n"
"\t activation but not for publication."
% repr(self))
return False
if p <= now and a <= now:
return True
if p == a:
output("WARNING: %s is scheduled to be\n"
"\t published and activated at the same time. This\n"
"\t could result in a coverage gap if the zone was\n"
"\t previously signed. Activation should be at least\n"
"\t %s after publication."
% (repr(self),
dnskey.duration(self.ttl) or 'one DNSKEY TTL'))
return True
if a < p:
output("WARNING: Key %s is active before it is published"
% repr(self))
return False
if self.ttl is not None and a - p < self.ttl:
output("WARNING: Key %s is activated too soon\n"
"\t after publication; this could result in coverage \n"
"\t gaps due to resolver caches containing old data.\n"
"\t Activation should be at least %s after\n"
"\t publication."
% (repr(self),
dnskey.duration(self.ttl) or 'one DNSKEY TTL'))
return False
return True
def check_postpub(self, output = None, timespan = None):
def noop(*args, **kwargs): pass
if output is None:
output = noop
if timespan is None:
timespan = self.ttl
if timespan is None:
output("WARNING: Key %s using default TTL." % repr(self))
timespan = (60*60*24)
now = time.time()
d = self.delete()
i = self.inactive()
if not d:
return False
if not i:
if d > now:
output("WARNING: Key %s is scheduled for\n"
"\t deletion but not for inactivation." % repr(self))
return False
if d < now and i < now:
return True
if d < i:
output("WARNING: Key %s is scheduled for\n"
"\t deletion before inactivation."
% repr(self))
return False
if d - i < timespan:
output("WARNING: Key %s scheduled for\n"
"\t deletion too soon after deactivation; this may \n"
"\t result in coverage gaps due to resolver caches\n"
"\t containing old data. Deletion should be at least\n"
"\t %s after inactivation."
% (repr(self), dnskey.duration(timespan)))
return False
return True
@staticmethod
def duration(secs):
if not secs:
return None
units = [("year", 60*60*24*365),
("month", 60*60*24*30),
("day", 60*60*24),
("hour", 60*60),
("minute", 60),
("second", 1)]
output = []
for unit in units:
v, secs = secs // unit[1], secs % unit[1]
if v > 0:
output.append("%d %s%s" % (v, unit[0], "s" if v > 1 else ""))
return ", ".join(output)
rndc.py 0000644 00000015053 15173300452 0006050 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
############################################################################
# rndc.py
# This module implements the RNDC control protocol.
############################################################################
from collections import OrderedDict
import time
import struct
import hashlib
import hmac
import base64
import random
import socket
class rndc(object):
"""RNDC protocol client library"""
__algos = {'md5': 157,
'sha1': 161,
'sha224': 162,
'sha256': 163,
'sha384': 164,
'sha512': 165}
def __init__(self, host, algo, secret):
"""Creates a persistent connection to RNDC and logs in
host - (ip, port) tuple
algo - HMAC algorithm: one of md5, sha1, sha224, sha256, sha384, sha512
(with optional prefix 'hmac-')
secret - HMAC secret, base64 encoded"""
self.host = host
algo = algo.lower()
if algo.startswith('hmac-'):
algo = algo[5:]
self.algo = algo
self.hlalgo = getattr(hashlib, algo)
self.secret = base64.b64decode(secret)
self.ser = random.randint(0, 1 << 24)
self.nonce = None
self.__connect_login()
def call(self, cmd):
"""Call a RNDC command, all parsing is done on the server side
cmd - a complete string with a command (eg 'reload zone example.com')
"""
return dict(self.__command(type=cmd)['_data'])
def __serialize_dict(self, data, ignore_auth=False):
rv = bytearray()
for k, v in data.items():
if ignore_auth and k == '_auth':
continue
rv += struct.pack('B', len(k)) + k.encode('ascii')
if type(v) == str:
rv += struct.pack('>BI', 1, len(v)) + v.encode('ascii')
elif type(v) == bytes:
rv += struct.pack('>BI', 1, len(v)) + v
elif type(v) == bytearray:
rv += struct.pack('>BI', 1, len(v)) + v
elif type(v) == OrderedDict:
sd = self.__serialize_dict(v)
rv += struct.pack('>BI', 2, len(sd)) + sd
else:
raise NotImplementedError('Cannot serialize element of type %s'
% type(v))
return rv
def __prep_message(self, *args, **kwargs):
self.ser += 1
now = int(time.time())
data = OrderedDict(*args, **kwargs)
d = OrderedDict()
d['_auth'] = OrderedDict()
d['_ctrl'] = OrderedDict()
d['_ctrl']['_ser'] = str(self.ser)
d['_ctrl']['_tim'] = str(now)
d['_ctrl']['_exp'] = str(now+60)
if self.nonce is not None:
d['_ctrl']['_nonce'] = self.nonce
d['_data'] = data
msg = self.__serialize_dict(d, ignore_auth=True)
hash = hmac.new(self.secret, msg, self.hlalgo).digest()
bhash = base64.b64encode(hash)
if self.algo == 'md5':
d['_auth']['hmd5'] = struct.pack('22s', bhash)
else:
d['_auth']['hsha'] = bytearray(struct.pack('B88s',
self.__algos[self.algo], bhash))
msg = self.__serialize_dict(d)
msg = struct.pack('>II', len(msg) + 4, 1) + msg
return msg
def __verify_msg(self, msg):
if self.nonce is not None and msg['_ctrl']['_nonce'] != self.nonce:
return False
if self.algo == 'md5':
bhash = msg['_auth']['hmd5']
else:
bhash = msg['_auth']['hsha'][1:]
if type(bhash) == bytes:
bhash = bhash.decode('ascii')
bhash += '=' * (4 - (len(bhash) % 4))
remote_hash = base64.b64decode(bhash)
my_msg = self.__serialize_dict(msg, ignore_auth=True)
my_hash = hmac.new(self.secret, my_msg, self.hlalgo).digest()
return (my_hash == remote_hash)
def __command(self, *args, **kwargs):
msg = self.__prep_message(*args, **kwargs)
sent = self.socket.send(msg)
if sent != len(msg):
raise IOError("Cannot send the message")
header = self.socket.recv(8)
if len(header) != 8:
# What should we throw here? Bad auth can cause this...
raise IOError("Can't read response header")
length, version = struct.unpack('>II', header)
if version != 1:
raise NotImplementedError('Wrong message version %d' % version)
# it includes the header
length -= 4
data = self.socket.recv(length, socket.MSG_WAITALL)
if len(data) != length:
raise IOError("Can't read response data")
if type(data) == str:
data = bytearray(data)
msg = self.__parse_message(data)
if not self.__verify_msg(msg):
raise IOError("Authentication failure")
return msg
def __connect_login(self):
self.socket = socket.create_connection(self.host)
self.nonce = None
msg = self.__command(type='null')
self.nonce = msg['_ctrl']['_nonce']
def __parse_element(self, input):
pos = 0
labellen = input[pos]
pos += 1
label = input[pos:pos+labellen].decode('ascii')
pos += labellen
type = input[pos]
pos += 1
datalen = struct.unpack('>I', input[pos:pos+4])[0]
pos += 4
data = input[pos:pos+datalen]
pos += datalen
rest = input[pos:]
if type == 1: # raw binary value
return label, data, rest
elif type == 2: # dictionary
d = OrderedDict()
while len(data) > 0:
ilabel, value, data = self.__parse_element(data)
d[ilabel] = value
return label, d, rest
# TODO type 3 - list
else:
raise NotImplementedError('Unknown element type %d' % type)
def __parse_message(self, input):
rv = OrderedDict()
hdata = None
while len(input) > 0:
label, value, input = self.__parse_element(input)
rv[label] = value
return rv
keyzone.py 0000644 00000003677 15173300452 0006617 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
import os
import sys
import re
from subprocess import Popen, PIPE
########################################################################
# Exceptions
########################################################################
class KeyZoneException(Exception):
pass
########################################################################
# class keyzone
########################################################################
class keyzone:
"""reads a zone file to find data relevant to keys"""
def __init__(self, name, filename, czpath):
self.maxttl = None
self.keyttl = None
if not name:
return
if not czpath or not os.path.isfile(czpath) \
or not os.access(czpath, os.X_OK):
raise KeyZoneException('"named-compilezone" not found')
return
maxttl = keyttl = None
fp, _ = Popen([czpath, "-o", "-", name, filename],
stdout=PIPE, stderr=PIPE).communicate()
for line in fp.splitlines():
if type(line) is not str:
line = line.decode('ascii')
if re.search('^[:space:]*;', line):
continue
fields = line.split()
if not maxttl or int(fields[1]) > maxttl:
maxttl = int(fields[1])
if fields[3] == "DNSKEY":
keyttl = int(fields[1])
self.keyttl = keyttl
self.maxttl = maxttl
keydict.py 0000644 00000005441 15173300453 0006557 0 ustar 00 ############################################################################
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
############################################################################
from collections import defaultdict
from . import dnskey
import os
import glob
########################################################################
# Class keydict
########################################################################
class keydict:
""" A dictionary of keys, indexed by name, algorithm, and key id """
_keydict = defaultdict(lambda: defaultdict(dict))
_defttl = None
_missing = []
def __init__(self, dp=None, **kwargs):
self._defttl = kwargs.get('keyttl', None)
zones = kwargs.get('zones', None)
if not zones:
path = kwargs.get('path',None) or '.'
self.readall(path)
else:
for zone in zones:
if 'path' in kwargs and kwargs['path'] is not None:
path = kwargs['path']
else:
path = dp and dp.policy(zone).directory or '.'
if not self.readone(path, zone):
self._missing.append(zone)
def readall(self, path):
files = glob.glob(os.path.join(path, '*.private'))
for infile in files:
key = dnskey(infile, path, self._defttl)
self._keydict[key.name][key.alg][key.keyid] = key
def readone(self, path, zone):
if not zone.endswith('.'):
zone += '.'
match='K' + zone + '+*.private'
files = glob.glob(os.path.join(path, match))
found = False
for infile in files:
key = dnskey(infile, path, self._defttl)
if key.fullname != zone: # shouldn't ever happen
continue
keyname=key.name if zone != '.' else '.'
self._keydict[keyname][key.alg][key.keyid] = key
found = True
return found
def __iter__(self):
for zone, algorithms in self._keydict.items():
for alg, keys in algorithms.items():
for key in keys.values():
yield key
def __getitem__(self, name):
return self._keydict[name]
def zones(self):
return (self._keydict.keys())
def algorithms(self, zone):
return (self._keydict[zone].keys())
def keys(self, zone, alg):
return (self._keydict[zone][alg].keys())
def missing(self):
return (self._missing)
