File: //lib/python3.6/site-packages/dnf/__pycache__/dnssec.cpython-36.pyc
3
ft`;, @ s d dl mZ d dl mZ d dl mZ d dlmZ d dlZd dlZd dlZd dl Z d dl
m Z d dl Z
d dlZ
ejdZdZG d d
d
e
jjZd d d
ZG dd deZG dd dZG dd dZG dd dZdd Zdd ZG dd dZ dS ) )print_function)absolute_import)unicode_literals)EnumN)_dnf= c @ s e Zd ZdZdd ZdS ) DnssecErrorz-
Exception used in the dnssec module
c C s dj | jd k r| jndS )Nz<DnssecError, value='{}'>z
Not specified)formatvalue)self r
/usr/lib/python3.6/dnssec.py__repr__- s zDnssecError.__repr__N)__name__
__module__ __qualname____doc__r r
r
r
r r ) s r _openpgpkeyc C s~ | j d}t|dkr"d}t||d }|d }tj }|j|jd tj|j dd j
dj }|d | d | S ) z
Implements RFC 7929, section 3
https://tools.ietf.org/html/rfc7929#section-3
:param email_address:
:param tag:
:return:
@ z0Email address must contain exactly one '@' sign.r zutf-8 .) splitlenr hashlibZsha256updateencodebase64Z b16encodedigestdecodelower)Z
email_addresstagr msgZlocalZdomainhashr r
r
r email2location2 s
r& c @ s( e Zd ZdZdZdZdZdZdZdZ dS ) Validityz
Output of the verification algorithm.
TODO: this type might be simplified in order to less reflect the underlying DNS layer.
TODO: more specifically the variants from 3 to 5 should have more understandable names
r r N)
r r r r VALIDREVOKEDPROVEN_NONEXISTENCERESULT_NOT_SECURE BOGUS_RESULTERRORr
r
r
r r' J s r' c @ s e Zd ZdZdS )NoKeyz
This class represents an absence of a key in the cache. It is an expression of non-existence
using the Python's type system.
N)r r r r r
r
r
r r2 X s r2 c @ s& e Zd ZdZdddZedd ZdS )KeyInfozv
Wrapper class for email and associated verification key, where both are represented in
form of a string.
Nc C s || _ || _d S )N)emailkey)r r4 r5 r
r
r __init__e s zKeyInfo.__init__c C s t jd| }|dkrt|jd}|jdjd}d}d}x6tdt|D ]$}|| dkr^|}|| dkrJ|}qJW d j||d
|d j d}t
||S ) z
Since dnf uses different format of the key than the one used in DNS RR, I need to convert
the former one into the new one.
z <(.*@.*)>Nr ascii
r z$-----BEGIN PGP PUBLIC KEY BLOCK-----z"-----END PGP PUBLIC KEY BLOCK----- r ) researchr groupr! r ranger joinr r3 ) ZuseridZraw_keyZ input_emailr4 r5 startstopiZcat_keyr
r
r from_rpm_key_objecti s
zKeyInfo.from_rpm_key_object)NN)r r r r r6 staticmethodrB r
r
r
r r3 ` s
r3 c @ s8 e Zd ZdZi Zedd Zedd Zedd ZdS ) DNSSECKeyVerificationz
The main class when it comes to verification itself. It wraps Unbound context and a cache with
already obtained results.
c C sZ | |krt jd tjS | tkr0t jd tjS t jdj| t jdj| tjS dS )zD
Compare the key in case it was found in the cache.
zCache hit, valid keyz Cache hit, proven non-existencezKey in cache: {}zInput key : {}N)loggerdebugr' r, r2 r. r
r- ) key_unionZinput_key_stringr
r
r
_cache_hit s
z DNSSECKeyVerification._cache_hitc C s y ddl }W n< tk
rH } z tdj|}tjj|W Y dd}~X nX |j }|jdddkrlt j
d |jdddkrt j
d |j dkrt j
d
|j d dkrt j
d |j
t| jt|j\}}|dkrt j
d
tjS |jrt j
d tjS |jst j
d tjS |jr,t j
d tjS |jsDt j
d tjS |jj d }t j |}|| j krntj S t j
dj| t j
dj| j tj!S dS )zz
In case the key was not found in the cache, create an Unbound context and contact the DNS
system
r NzLConfiguration option 'gpgkey_dns_verification' requires python3-unbound ({})z
verbosity:0z(Unbound context: Failed to set verbosityzqname-minimisation:yesz1Unbound context: Failed to set qname minimisationz+Unbound context: Failed to read resolv.confz/var/lib/unbound/root.keyz0Unbound context: Failed to add trust anchor filez%Communication with DNS servers failedzDNSSEC signatures are wrongz!Result is not secured with DNSSECz1Non-existence of this record was proven by DNSSECz"Unknown error in DNS communicationzKey from DNS: {}zInput key : {})"unbound ImportErrorr r
r
exceptionsErrorZub_ctxZ
set_optionrE rF Z
resolvconfZ add_ta_fileZresolver& r4 RR_TYPE_OPENPGPKEYZ RR_CLASS_INr' r1 Zbogusr0 Zsecurer/ Znxdomainr. ZhavedatadataZ as_raw_datar Z b64encoder5 r, r- ) input_keyrK er$ ZctxZstatusresultrP Z dns_data_b64r
r
r _cache_miss sN
z!DNSSECKeyVerification._cache_missc C sz t jdj| j tjj| j}|dk r6tj|| jS tj | }|t
j krZ| jtj| j< n|t
j krrt
tj| j< |S dS )zI
Public API. Use this method to verify a KeyInfo object.
z(Running verification for key with id: {}N)rE rF r
r4 rD _cachegetrH r5 rT r' r, r. r2 )rQ rG rS r
r
r verify s
z DNSSECKeyVerification.verifyN) r r r r rU rC rH rT rW r
r
r
r rD s
9rD c C s8 t d| j d }|tjkr(|t d S |t d S dS )zE
Inform the user about key validity in a human readable way.
z DNSSEC extension: Key for user z is valid.zhas unknown status.N)r r4 r' r, )Zkivprefixr
r
r
nice_user_msg s
r[ c C s t d| S )z;
Label any given message with DNSSEC extension tag
zDNSSEC extension: )r )mr
r
r any_msg s r] c @ s( e Zd ZdZedd Zedd ZdS )RpmImportedKeysaQ
Wrapper around keys, that are imported in the RPM database.
The keys are stored in packages with name gpg-pubkey, where the version and
release is different for each of them. The key content itself is stored as
an ASCII armored string in the package description, so it needs to be parsed
before it can be used.
c C s t jjj } | jdd}g }xl|D ]d}t jj|d}tjd|jd}t jj|d}|j ddd }d j
|}|t ||j d
g7 }q"W |S ) Nnamez
gpg-pubkeypackagerz <(.*@.*)>r descriptionr8 r( r9 r7 )
r ZrpmZ transactionZTransactionWrapperZdbMatchZ getheaderr: r; r< r r> r3 r ) Ztransaction_setZpackagesZ return_listZpkgr` r4 ra Z key_linesZkey_strr
r
r _query_db_for_gpg_keys s
z&RpmImportedKeys._query_db_for_gpg_keysc C s t j } tjttd x| D ]}ytj|}W n: tk
rl } z tj dj
|j |j w W Y d d }~X nX |t
jkrtjtdj
|j q |t
jkrtjtdj
|j q |t
jkrtjtdj
|j q |t
jkrtjtdj
|j q tjtdj
|j q W d S )Nz1Testing already imported keys for their validity.z%DNSSEC extension error (email={}): {}zGPG Key {} is validz,GPG Key {} does not support DNS verificationzGPG Key {} could not be verified, because DNSSEC signatures are bogus. Possible causes: wrong configuration of the DNS server, MITM attackz=GPG Key {} has been revoked and should be removed immediatelyz GPG Key {} could not be tested)r^ rc rE infor] r rD rW r Zwarningr
r4 r r' r, rF r. r0 r- )keysr5 rS rR r
r
r check_imported_keys_validity s,
z,RpmImportedKeys.check_imported_keys_validityN)r r r r rC rc rf r
r
r
r r^ s r^ )r ) Z
__future__r r r enumr r r Zloggingr: Zdnf.i18nr Zdnf.rpmr Zdnf.exceptionsZ getLoggerrE rO rM rN r r& r' r2 r3 rD r[ r] r^ r
r
r
r <module> s*
#g