0
  $   ˆl–Ým_Jå0–54 ^¸Ëw%1hßÄ„Z?Ã¿Á ,•    # Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license

# Copyright (C) 2001-2007, 2009-2011 Nominum, Inc.
#
# Permission to use, copy, modify, and distribute this software and its
# documentation for any purpose with or without fee is hereby granted,
# provided that the above copyright notice and this permission notice
# appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

"""DNS TSIG support."""

import base64
import hashlib
import hmac
import struct

import dns.exception
import dns.name
import dns.rcode
import dns.rdataclass


class BadTime(dns.exception.DNSException):
    """The current time is not within the TSIG's validity time."""


class BadSignature(dns.exception.DNSException):
    """The TSIG signature fails to verify."""


class BadKey(dns.exception.DNSException):
    """The TSIG record owner name does not match the key."""


class BadAlgorithm(dns.exception.DNSException):
    """The TSIG algorithm does not match the key."""


class PeerError(dns.exception.DNSException):
    """Base class for all TSIG errors generated by the remote peer"""


class PeerBadKey(PeerError):
    """The peer didn't know the key we used"""


class PeerBadSignature(PeerError):
    """The peer didn't like the signature we sent"""


class PeerBadTime(PeerError):
    """The peer didn't like the time we sent"""


class PeerBadTruncation(PeerError):
    """The peer didn't like amount of truncation in the TSIG we sent"""


# TSIG Algorithms

HMAC_MD5 = dns.name.from_text("HMAC-MD5.SIG-ALG.REG.INT")
HMAC_SHA1 = dns.name.from_text("hmac-sha1")
HMAC_SHA224 = dns.name.from_text("hmac-sha224")
HMAC_SHA256 = dns.name.from_text("hmac-sha256")
HMAC_SHA256_128 = dns.name.from_text("hmac-sha256-128")
HMAC_SHA384 = dns.name.from_text("hmac-sha384")
HMAC_SHA384_192 = dns.name.from_text("hmac-sha384-192")
HMAC_SHA512 = dns.name.from_text("hmac-sha512")
HMAC_SHA512_256 = dns.name.from_text("hmac-sha512-256")
GSS_TSIG = dns.name.from_text("gss-tsig")

default_algorithm = HMAC_SHA256

mac_sizes = {
    HMAC_SHA1: 20,
    HMAC_SHA224: 28,
    HMAC_SHA256: 32,
    HMAC_SHA256_128: 16,
    HMAC_SHA384: 48,
    HMAC_SHA384_192: 24,
    HMAC_SHA512: 64,
    HMAC_SHA512_256: 32,
    HMAC_MD5: 16,
    GSS_TSIG: 128,  # This is what we assume to be the worst case!
}


class GSSTSig:
    """
    GSS-TSIG TSIG implementation.  This uses the GSS-API context established
    in the TKEY message handshake to sign messages using GSS-API message
    integrity codes, per the RFC.

    In order to avoid a direct GSSAPI dependency, the keyring holds a ref
    to the GSSAPI object required, rather than the key itself.
    """

    def __init__(self, gssapi_context):
        self.gssapi_context = gssapi_context
        self.data = b""
        self.name = "gss-tsig"

    def update(self, data):
        self.data += data

    def sign(self):
        # defer to the GSSAPI function to sign
        return self.gssapi_context.get_signature(self.data)

    def verify(self, expected):
        try:
            # defer to the GSSAPI function to verify
            return self.gssapi_context.verify_signature(self.data, expected)
        except Exception:
            # note the usage of a bare exception
            raise BadSignature


class GSSTSigAdapter:
    def __init__(self, keyring):
        self.keyring = keyring

    def __call__(self, message, keyname):
        if keyname in self.keyring:
            key = self.keyring[keyname]
            if isinstance(key, Key) and key.algorithm == GSS_TSIG:
                if message:
                    GSSTSig