✘✘ GRAYBYTE WORDPRESS FILE MANAGER ✘✘

a

�M�e�,�@s�
dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dl	ZGdd�dej
j�ZGdd�dej
j�Z
Gdd�dej
j�ZGd	d
�d
ej
j�ZGdd�dej
j�ZGd
d�de�ZGdd�de�ZGdd�de�ZGdd�de�Zej�d�
Zej�d�
Zej�d�
Zej�d�
Zej�d�
Zej�d�
Zej�d�
Zej�d�
Zej�d�
Zej�d�
Z eZ!eded ed!ed"ed#ed$ed%ed!ed"e d&i
Z"Gd'd(�d(�Z#Gd)d*�d*�Z$Gd+d,�d,�Z%d:d-d.�
Z&d/d0�Z'd;d2d3�
Z(d<d4d5�
Z)d6d7�Z*Gd8d9�d9�Z+dS)=zDNS TSIG support.�Nc
@seZ
dZd
ZdS)�BadTimez8The current time is not within the TSIG's validity time.N��__name__�
__module__�__qualname__�__doc__�rr�,/usr/lib/python3.9/site-packages/dns/tsig.pyrs
rc
@seZ
dZd
ZdS)�BadSignaturez#The TSIG signature fails to verify.Nrrrrr	r
#s
r
c
@seZ
dZd
ZdS)�BadKeyz2The TSIG record owner name does not match the key.Nrrrrr	r's
rc
@seZ
dZd
ZdS)�BadAlgorithmz*The TSIG algorithm does not match the key.Nrrrrr	r+s
rc
@seZ
dZd
ZdS)�	PeerErrorz;Base class for all TSIG errors generated by the remote peerNrrrrr	r
/s
r
c
@seZ
dZd
ZdS)�
PeerBadKeyz$The peer didn't know the key we usedNrrrrr	r3s
rc
@seZ
dZd
ZdS)�PeerBadSignaturez*The peer didn't like the signature we sentNrrrrr	r7s
rc
@seZ
dZd
ZdS)�PeerBadTimez%The peer didn't like the time we sentNrrrrr	r;s
rc
@seZ
dZd
ZdS)�PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNrrrrr	r?s
rzHMAC-MD5.SIG-ALG.REG.INTz	hmac-sha1zhmac-sha224zhmac-sha256zhmac-sha256-128zhmac-sha384zhmac-sha384-192zhmac-sha512zhmac-sha512-256�gss-tsig��� ��0��@�c@s0eZ
dZd
Zdd�Zdd�Zdd�Zdd	�Zd
S)�GSSTSigaG

    GSS-TSIG TSIG implementation.  This uses the GSS-API context established
    in the TKEY message handshake to sign messages using GSS-API message
    integrity codes, per the RFC.

    In order to avoid a direct GSSAPI dependency, the keyring holds a ref
    to the GSSAPI object required, rather than the key itself.
    cCs|
|_d
|_
d|_dS)N�r)�gssapi_context�data�name)�selfrrrr	�__init__js


zGSSTSig.__init__cCs|j|
7_dS�
N)
r�r rrrr	�updateos
zGSSTSig.updatec

Cs|j�
|j�
Sr")rZ
get_signaturer)
r rrr	�signrszGSSTSig.signcCs.z|j�
|j|
�WSty(


t�
Yn0dSr")rZverify_signaturer�	Exceptionr
)r �expectedrrr	�verifyvs

zGSSTSig.verifyN)rrrrr!r$r%r(rrrr	r`s

	rc@s(eZ
dZd
d�Zdd�Zedd��
ZdS)�GSSTSigAdaptercCs
|
|_dSr")
�keyring)r r*rrr	r!�s
zGSSTSigAdapter.__init__cCsF||jvr>|j|}t
|t�r:|jtkr:|
r:t�||
|�
|SdSdSr")r*�
isinstance�Key�	algorithm�GSS_TSIGr)�parse_tkey_and_step)r �message�keyname�keyrrr	�__call__�s







zGSSTSigAdapter.__call__cCsVz>|�|j
|tjjtjj�}|r<|d
j}|
j}|�	|�
WSWnt
yP


Yn0dS)Nr
)Z
find_rrsetZanswer�dns�
rdataclass�ANYZ	rdatatypeZTKEYr2�secret�step�KeyError)�clsr2r0r1Zrrset�tokenrrrr	r/�s

�





z"GSSTSigAdapter.parse_tkey_and_stepN)rrrr!r3�classmethodr/rrrr	r)s


r)c@sveZ
dZd
Zeejeeje	ej
eej
dfeej
eej
dfeejeejdfeeji	Zdd�Zdd�Zd	d
�Zdd�Zd
S)�HMACTSigzo
    HMAC TSIG implementation.  This uses the HMAC python module to handle the
    sign/verify operations.
    r��
cCs�z|j|}Wn"t
y0


td
|�d��
�
Yn0t|t�r\tj|
|dd�|_|d|_ntj|
|d�|_d|_|jj	|_	|jr�|j	d|j��7_	dS)NzTSIG algorithm z is not supportedr
)
Z	digestmod�
�
-)
�_hashesr9�NotImplementedErrorr+�tuple�hmac�new�hmac_context�sizer)r r2r-Zhashinforrr	r!�s











zHMACTSig.__init__cCs|j�
|
�
Sr")rGr$r#rrr	r$�s
zHMACTSig.updatec
Cs&|j�
�}
|jr"|
d|jd
�}
|
S)N�)rG�digestrH)r rJrrr	r%�s



z
HMACTSig.signcCs|��}t
�||
�st�
dSr")r%rEZcompare_digestr
)r r'�macrrr	r(�s

zHMACTSig.verifyN)rrrr�	HMAC_SHA1�hashlibZsha1�HMAC_SHA224Zsha224�HMAC_SHA256Zsha256�HMAC_SHA256_128�HMAC_SHA384Zsha384�HMAC_SHA384_192�HMAC_SHA512Zsha512�HMAC_SHA512_256�HMAC_MD5Zmd5rBr!r$r%r(rrrr	r=�s











�r=cCs0
|o|}|r:t|
�
}|r:|�
t�d
t|�
��

|�
|�

|�
t�d
|j��

|�
|dd��

|r�|�
|
j���

|�
t�d
tj	j
��

|�
t�dd��

|dur�|j}|d?d@}|d@}	t�d	||	|j�}
t|j
�
}|dkr�td
�
�
|�
r"|�
|
j��|
�

|�
t�d|j|�|j
�

n
|�
|
�

|S)z�Return a context containing the TSIG rdata for the input parameters
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    �!H�Nz!Ir
ri��l��z!HIHz TSIG Other Data is > 65535 bytesz!HH)�get_contextr$�struct�pack�lenZoriginal_idrZ
to_digestabler4r5r6�time_signed�fudge�other�
ValueErrorr-�error)�wirer2�rdata�time�request_mac�ctx�multi�firstZ
upper_timeZ
lower_timeZtime_encodedZ	other_lenrrr	�_digest�s2


























rhcCs8|r0t|�
}|�
t�d
t|
�
��

|�
|
�

|SdSdS)z�If this is the first message in a multi-message sequence,
    start a new context.
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    rVN)rXr$rYrZr[)r2rKrfrerrr	�_maybe_start_digest�s




riFc	Cs:t||
|||||�}|�
�}|j||d
�}|t|
||�fS)a~
Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
    for the input parameters, the HMAC MAC calculated by applying the
    TSIG signature algorithm, and the TSIG digest context.
    @rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    )r\rK)rhr%�replaceri)	rar2rbrcrdrerfrKZtsigrrr	r%
s	

r%c	Cs
t�
d
|dd��\
}	|	dkr&tjj�
|	d8}	|dd�t�d
|	�|d|�}
|jdkr�|jtjjkrpt	�
nJ|jtjj
kr�t�
n6|jtjjkr�t
�
n"|jtjjkr�t�
ntd|j�
�
t|j|�
|jkr�t�
|
j|kr�t�
|
j|jkr�t�
t|
|
|d|||�}|�|j�

t|
|j|�S)aF
Validate the specified TSIG rdata against the other input parameters.

    @raises FormError: The TSIG is badly formed.
    @raises BadTime: There is too much time skew between the client and the
    server.
    @raises BadSignature: The TSIG signature did not validate
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrV�
�r
r@zunknown TSIG error code %dN)rY�unpackr4�	exceptionZ	FormErrorrZr`ZrcodeZBADSIGrZBADKEYrZBADTIMErZBADTRUNCrr
�absr\r]rrrr-rrhr(rKri)rar2�ownerrbZnowrdZ
tsig_startrerfZadcountZnew_wirerrr	�validate
s0



$



















rqc

Cs&|jt
krt|j�
St|j|j�Sd
S)z�Returns an HMAC context for the specified key.

    @rtype: HMAC context
    @raises NotImplementedError: I{algorithm} is not supported
    N)r-r.rr7r=)
r2rrr	rX:
s


rXc@s(eZ
dZef
d
d�
Zdd�Zdd�ZdS)r,cCsZt|
t
�rtj�|
�
}
|
|_t|t
�r4t�|���
}||_t|t
�rPtj�|�
}||_	dSr")
r+�strr4r�	from_text�base64Zdecodebytes�encoder7r-)r rr7r-rrr	r!H
s











zKey.__init__cCs.t|
t
�o,|j|
jko,|j|
jko,|j|
jkSr")r+r,rr7r-)r r^rrr	�__eq__S
s


�
�
�z
Key.__eq__c
CsNd
|j�d�d|j
�d�}
|j
tkrB|
dt�|j�
���d�7}
|
d7}
|
S)Nz<DNS key name='z', zalgorithm='�
'z
, secret='�
>)rr-r.rtZ	b64encoder7�decode)r �
rrrr	�__repr__[
s






zKey.__repr__N)rrr�default_algorithmr!rvr{rrrr	r,G
s
r,)NNNN)NNNF)NF),rrtrMrErYZ
dns.exceptionr4Zdns.nameZ	dns.rcodeZdns.rdataclassrnZDNSExceptionrr
rrr
rrrrrrsrUrLrNrOrPrQrRrSrTr.r|Z	mac_sizesrr)r=rhrir%rqrXr,rrrr	�<module>sb























� 4
#
�
&