/usr/lib/rads/venv/lib/python3.13/site-packages/dns/__pycache__
Edit: /usr/lib/rads/venv/lib/python3.13/site-packages/dns/__pycache__/dnssec.cpython-313.pyc (51461B)
j S r SSKrSSKrSSKrSSKrSSKrSSKrSSKJr SSKJ r J
r
J r J r J
r
JrJrJr SSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSKrSSK rSSK J r J r J r SSKJ!r!J"r"J#r#J$r$ SSK%J&r& SSK'J(r( SS K)J*r* SS
K+J,r, SS K-J.r.J/r/ SS K0J1r1 SS
K2J3r3J4r4 SSK5J6r6 \S r7\S r8\ \Rr Rt \Rv Rx /S4 r=S\>S\ 4S jr?S\\ \@4 S\>4S jrAS\\\>\B\@4 S\@4S jrCS\\*\&4 S\@4S jrD " S S5 rE " S S \E5 rF\F" \ R \ R \ R \ R 1\ R \ R \ R 1\ R \ R \ R 1\ R 15 rN\F" \O" 5 \O" 5 \O" 5 \O" 5 5 rP\NrQ SaS \\R R \>4 S\R R S \\ \>4 S \ \R R S!\ \E S"\VS\,4S# jjrW SbS \\R R \>4 S\R R S \\ \>4 S \ \R R S\(4
S$ jjrXS%\
\R R \\R R \R R 4 4 S&\3S\ \ \* 4S' jr]S(\\Rv Rx \\R R \R R 4 4 S\\R R \R R 4 4S) jr^S*\_S+\_S\*SS4S, jr` ScS(\\Rv Rx \\R R \R R 4 4 S&\3S%\
\R R \\R R \R R 4 4 S \ \R R S-\ \B S!\ \E SS4S. jjra ScS(\\Rv Rx \\R R \R R 4 4 S/\\Rv Rx \\R R \R R 4 4 S%\
\R R \\R R \R R 4 4 S \ \R R S-\ \B S!\ \E SS4S0 jjrb SdS(\\Rv Rx \\R R \R R 4 4 S2\8S3\R R S4\*S5\ \\\>\@\B4 S6\ \\\>\@\B4 S7\ \@ S8\VS!\ \E S \ \R R S9\VS\34S: jjrc SbS(\\Rv Rx \\R R \R R 4 4 S&\3S \ \R R S\_4S; jjrd\6R S<4S=\7S \\@\>4 S>\@S?\@S\*4
S@ jjrf\6R S<4S=\7S \\@\>4 S>\@S?\@S\&4
SA jjrgSB\\R R \>4 SC\ \\>\_4 SD\@S \\@\>4 S\>4
SE jrh SbS(\\Rv Rx \\R R \R R 4 4 SF\
\\ \>4 S \ \R R S\R R 4SG jjriSH\R R S\R R 4SI jrj SbS \\R R \>4 SH\R R S \\ \>4 S \ \R R S\R R 4
SJ jjrkSH\R R S\R R 4SK jrl SeSL\Rr Rt S(\Rv Rx S3\R R SM\ \\8\*4 SN\ \\8\*4 S5\ \\\>\@\B4 S6\ \\\>\@\B4 S7\ \@ S!\ \E S \ \R R S9\VSS4SO jjrm SfSP\R R SL\ \Rr Rt S%\ \ \\8\*4 SQ\VSR\ \@ S5\ \\\>\@\B4 S6\ \\\>\@\B4 S7\ \@ SS\ \1 ST\ \= S!\ \E S9\VSS4SU jjrp SbSP\R R SL\Rr Rt ST\ \= SS4SV jjrqSW rr\R R SX5 ( aA SSYKuJvrv SSZKwJxrx SS[KwJyry SS\KwJzrz SS]KwJ{r{ SS^KwJ|r| SS_K}J~r~Jr SS`KJrJr \br\ar\cr\fr\grS1rO \rr\rr\rr\rr\rrS r\ R rG\ GR r\ R rH\ GR r\ GR r\ R rI\ GR r\ GR r\ GR r\ R rJ\ GR r\ GR r\ GR" r\ GR$ r\ GR& r\ GR( r\ GR* rg)gz.Common DNSSEC-related functions and constants. N)datetime)CallableDictListOptionalSetTupleUnioncast) AlgorithmDSDigest NSEC3Hash)AlgorithmKeyMismatchDeniedByPolicyUnsupportedAlgorithmValidationFailure)CDNSKEY)CDS)DNSKEY)DS)NSECBitmap)
NSEC3PARAM)RRSIGsigtime_to_posixtime)Flag)GenericPublicKeyzrsa.RSAPublicKeyzec.EllipticCurvePublicKeyzed25519.Ed25519PublicKeyzed448.Ed448PublicKey)GenericPrivateKeyzrsa.RSAPrivateKeyzec.EllipticCurvePrivateKeyzed25519.Ed25519PrivateKeyzed448.Ed448PrivateKeytextreturnc . [ R " U 5 $ )zConvert text into a DNSSEC algorithm value.
*text*, a ``str``, the text to convert to into an algorithm value.
Returns an ``int``.
)r from_text)r s =/usr/lib/rads/venv/lib/python3.13/site-packages/dns/dnssec.pyalgorithm_from_textr$ L s t $$ valuec . [ R " U 5 $ )zConvert a DNSSEC algorithm value to text
*value*, a ``dns.dnssec.Algorithm``.
Returns a ``str``, the name of a DNSSEC algorithm.
)r to_textr& s r# algorithm_to_textr* W s U ##r% c " [ U [ 5 ( a [ U R 5 5 $ [ U [ 5 ( a [ U 5 $ [ U [ 5 ( a [ U 5 $ [ U [ 5 ( a U $ [ S5 e)z%Convert various format to a timestampzUnsupported timestamp type)
isinstancer int timestampstrr float TypeErrorr) s r# to_timestampr2 b sn %""5??$%% E3 #E** E5 ! !5z E3 455r% keyc d U R 5 nUc eU R [ R :X a US S- US - $ Sn[ [ U5 S- 5 H nX!SU- S- USU- S- - -
nM [ U5 S- S:w a X![ U5 S-
S- -
nX"S- S- -
nUS- $ ) zReturn the key id (a 16-bit number) for the specified key.
*key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY``
Returns an ``int`` between 0 and 65535
r i )to_wire algorithmr RSAMD5rangelen)r3 rdatatotalis r# key_idrC p s
KKME
}} (((b Q%)++s5zQ'A AEla'5Q+;; ;E ( u:>Q 3u:>*a/ /E
2+''v~ r% c b \ rS rSrS rS\S\4S jrS\S\4S jrS\ S\4S jr
S\ S\4S jr S r g
) Policy c g N )selfs r# __init__Policy.__init__ s r% _r c gNFrI rJ rM s r#
ok_to_signPolicy.ok_to_sign r% c grO rI rP s r# ok_to_validatePolicy.ok_to_validate rS r% c grO rI rP s r# ok_to_create_dsPolicy.ok_to_create_ds rS r% c grO rI rP s r# ok_to_validate_dsPolicy.ok_to_validate_ds rS r% rI N)
__name__
__module__ __qualname____firstlineno__rK r boolrQ rU r
rX r[ __static_attributes__rI r% r# rE rE sS
F t 4 d 8 r% rE c p ^ \ rS rSrU 4S jrS\S\4S jrS\S\4S jrS\ S\4S jr
S\ S\4S jr S
r U =r
$ )
SimpleDeny c R > [ TU ] 5 Xl X l X0l X@l g rH )superrK
_deny_sign_deny_validate_deny_create_ds_deny_validate_ds)rJ deny_sign
deny_validatedeny_create_dsdeny_validate_ds __class__s r# rK SimpleDeny.__init__ s%
# + - !1 r% r3 r c 4 UR U R ; $ rH )r< rh rJ r3 s r# rQ SimpleDeny.ok_to_sign s }}DOO33r% c 4 UR U R ; $ rH )r< ri rs s r# rU SimpleDeny.ok_to_validate s }}D$7$777r% r< c XR ; $ rH )rj rJ r< s r# rX SimpleDeny.ok_to_create_ds s 4 444r% c XR ; $ rH )rk rx s r# r[ SimpleDeny.ok_to_validate_ds s 6 666r% )rj rh ri rk )r] r^ r_ r` rK r ra rQ rU r
rX r[ rb
__classcell__)rp s @r# rd rd sY 24f 4 48& 8T 85 5d 578 7 7 7r% rd Fnamer< originpolicy
validatingc Uc [ n [ U[ 5 ( a [ UR 5 nU( a
UR nO UR nU" U5 ( d [ e[ U[ [ 45 ( d [ S5 eU[ R :X a [ R " 5 nOcU[ R :X a [ R" " 5 nO9U[ R$ :X a [ R& " 5 nO[
SU S35 e[ U [ 5 ( a [( R* R- X5 n U R/ 5 R1 5 nUR1 US9n Ub U c eUR3 U5 UR3 U 5 UR5 5 n
[6 R8 " S[; U5 UR< U5 U
- n [( R> RA [( RB RD [( RF RH U S[K U 5 5 n [M [H U 5 $ ! [
a [
SU S35 ef = f)aO Create a DS record for a DNSSEC key.
*name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record.
*key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``,
the key the DS is about.
*algorithm*, a ``str`` or ``int`` specifying the hash algorithm.
The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
does not matter for these strings.
*origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name,
then it will be made absolute using the specified origin.
*policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy,
``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.
*validating*, a ``bool``. If ``True``, then policy is checked in
validating mode, i.e. "Is it ok to validate using this digest algorithm?".
Otherwise the policy is checked in creating mode, i.e. "Is it ok to create a DS with
this digest algorithm?".
Raises ``UnsupportedAlgorithm`` if the algorithm is unknown.
Raises ``DeniedByPolicy`` if the algorithm is denied by policy.
Returns a ``dns.rdtypes.ANY.DS.DS``
unsupported algorithm ""zkey is not a DNSKEY/CDNSKEYr~ z!HBBr )'default_policyr, r/ r
upper Exceptionr r[ rX r r r
ValueErrorSHA1hashlibsha1SHA256sha256SHA384sha384dnsr} r" canonicalizer; updatedigeststructpackrC r< r@ from_wire
rdataclassIN rdatatyper r? r )
r} r3 r< r~ r r checkdshashwirekwirer dsrdatadss
r# make_dsr s J ~ K i % % !23I ((&& cFG, - -677HMM! hoo % ! hoo % !"%
s3 % Qxq!!zz5 r% sigdatac [ U5 R n UR U5 nUR X5 g ! [ a [ S5 ef = f)Nzinvalid public key) get_algorithm_cls_from_dnskey
public_cls from_dnskeyr r verify)r r r3 r
public_keys r# _validate_signaturer G sT .s3>>J6 ++C0
c 6 4556s : Anowc Uc [ n[ X!5 nUc [ S5 eUc [ R " 5 nUR U: a [ S5 eUR
U: a [ S5 e[
XU5 nU H2 nUR U5 ( d M [ UR Xx5 g [ S5 e! [ [ 4 a MT f = f)a~ Validate an RRset against a single signature rdata, throwing an
exception if validation is not successful.
*rrset*, the RRset to validate. This can be a
``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
tuple.
*rrsig*, a ``dns.rdata.Rdata``, the signature to validate.
*keys*, the key dictionary, used to find the DNSKEY associated
with a given name. The dictionary is keyed by a
``dns.name.Name``, and has ``dns.node.Node`` or
``dns.rdataset.Rdataset`` values.
*origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative
names.
*now*, a ``float`` or ``None``, the time, in seconds since the epoch, to
use as the current time when validating. If ``None``, the actual current
time is used.
*policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy,
``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.
Raises ``ValidationFailure`` if the signature is expired, not yet valid,
the public key is invalid, the algorithm is unknown, the verification
fails, etc.
Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by
dnspython but not implemented.
Nz unknown keyexpiredz
not yet validzverify failure) r r r time
expiration inception_make_rrsig_signature_datarU r signatureInvalidSignature) r r r r~ r r candidate_keysr
candidate_keys r# _validate_rrsigr Q s P ~ )$6N
..
{iik # ** 00 %eF ;D (
$$]33 E ( ,
-- !"34 s C CCrrsigsetc n Uc [ n[ U[ 5 ( a8 [ R R U[ R R 5 n[ U [ 5 ( a U S nO U R n[ U[ 5 ( a US nUS nOUR nUnUR U5 nUR U5 nXg:w a [ S5 eU H1 n [ U [ 5 ( d [ S5 e [ X X#XE5 g [ S5 e! [ [ 4 a MS f = f)aa Validate an RRset against a signature RRset, throwing an exception
if none of the signatures validate.
*rrset*, the RRset to validate. This can be a
``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
tuple.
*rrsigset*, the signature RRset. This can be a
``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
tuple.
*keys*, the key dictionary, used to find the DNSKEY associated
with a given name. The dictionary is keyed by a
``dns.name.Name``, and has ``dns.node.Node`` or
``dns.rdataset.Rdataset`` values.
*origin*, a ``dns.name.Name``, the origin to use for relative names;
defaults to None.
*now*, an ``int`` or ``None``, the time, in seconds since the epoch, to
use as the current time when validating. If ``None``, the actual current
time is used.
*policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy,
``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.
Raises ``ValidationFailure`` if the signature is expired, not yet valid,
the public key is invalid, the algorithm is unknown, the verification
fails, etc.
Nr r9 zowner names do not matchzexpected an RRSIGzno RRSIGs validated)
r r, r/ r r} r" rootr choose_relativityr r r r )
r r r r~ r r rrname rrsigname
rrsigrdatasetr s
r# _validater s N ~ &# ##FCHHMM:% q(E"" QK
MM
%
%f
-F++F3I
:;; %''#$78 8 E$ D 1
22 "#78 s
D D43D4T private_keyr dnskeyr r lifetimer
deterministicc Uc [ nUR U5 ( d [ e[ U [ 5 ( a3 U S R
n U S R n U S n
U S R nO0U R
n U R n U R n
U R nUb [ U5 nO [ [ R " 5 5 nUb [ U5 nOUb X- nO [ S5 eU b U
R U 5 n
[ U
5 S-
nU
R 5 ( a US- n[! U [" R$ R U UR& UUUU[) U5 USS9 n[" R* R- U UU 5 n[ U[. 5 ( a UnO [1 U5 nU" US9nUR7 UXz5 n[9 [ UR; US95 $ ! [2 a [5 S5 ef = f) a Sign RRset using private key.
*rrset*, the RRset to validate. This can be a
``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
tuple.
*private_key*, the private key to use for signing, a
``cryptography.hazmat.primitives.asymmetric`` private key class applicable
for DNSSEC.
*signer*, a ``dns.name.Name``, the Signer's name.
*dnskey*, a ``DNSKEY`` matching ``private_key``.
*inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the
signature inception time. If ``None``, the current time is used. If a ``str``, the
format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX
epoch in text form; this is the same the RRSIG rdata's text form.
Values of type `int` or `float` are interpreted as seconds since the UNIX epoch.
*expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature
expiration time. If ``None``, the expiration time will be the inception time plus
the value of the *lifetime* parameter. See the description of *inception* above
for how the various parameter types are interpreted.
*lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This
parameter is only meaningful if *expiration* is ``None``.
*verify*, a ``bool``. If set to ``True``, the signer will verify signatures
after they are created; the default is ``False``.
*policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy,
``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624.
*origin*, a ``dns.name.Name`` or ``None``. If ``None``, the default, then all
names in the rrset (including its owner name) must be absolute; otherwise the
specified origin will be used to make names absolute when signing.
*deterministic*, a ``bool``. If ``True``, the default, use deterministic
(reproducible) signatures when supported by the algorithm used for signing.
Currently, this only affects ECDSA.
Raises ``DeniedByPolicy`` if the signature is denied by policy.
r9 r z(expiration or lifetime must be specifiedr% ) r r type_coveredr< labels original_ttlr r r r r r3 zUnsupported key algorithm)r ) r rQ r r, r r r ttlr} r2 r- r r derelativizer? is_wildr r r r< rC dnssecr r r r r1 signr replace)r r r r r r r r r r~ r r r r r rrsig_inceptionrrsig_expirationr rrsig_templater signing_key private_clsr s r# _signr s t ~ V $ $ % (""q q Qx|| -- yy &y1 diik* '
3 *5CDD $$V,
[1_F ~~! }}""""!#!v N :: 0 0 OD + 011! 97?K%+6K v=I ~-- -B CC $ 9 78 8 9s !G! !G7c [ U[ 5 ( a8 [ R R U[ R R
5 nUR nUR 5 ( d Uc [ S5 eUR U5 n[ U 5 u pESnUR US9nUc eXgSS -
nXaR R U5 -
nUR 5 ( d Uc [ S5 eUR U5 n[ U5 nUR 5 ( a UR US-
:w a [ S5 eUS-
UR : a [ S 5 eUR US-
: aA UR! UR S- 5 S n [ R R S
U 5 nUR 5 n
[" R$ " S UR& UR( UR* 5 n U V s/ s H oR U5 PM n
n [- U
5 H3 n Xj-
nXk-
n[" R$ " S [ U 5 5 nXn-
nXl-
nM5 U$ s sn f )
a Create signature rdata.
*rrset*, the RRset to sign/validate. This can be a
``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
tuple.
*rrsig*, a ``dns.rdata.Rdata``, the signature to validate, or the
signature template used when signing.
*origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative
names.
Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by
dnspython but not implemented.
Nz,relative RR name without an origin specifiedr% r r8 z&wild owner name has wrong label lengthr9 z#owner name longer than RRSIG labels*z!HHIz!H)r, r/ r r} r" r r is_absoluter r r r;
to_digestabler? r r splitr r r r r sorted)r r r~ r r r r r name_lensuffix rrnamebufrrfixedr@ rdatasrrlens r# r r _ s * &# ##FCHHMM:
\\F >#$RS S$$V, ,E2F D === 'D "IDLL & &v ..D >#$RS S$$V,6{H
~~ELLHqL 8 HII!|ell" EFF 1 $ ellQ ./2##C0$$&Ikk&(//83C3CUEWEWXG7?
@xe!!&)xF
@ D#e*-
K As I$r r r r c [ R " U5 n[ U [ 5 ( a U R X#S9$ [ U5 R nU" U S9R X#S9$ )aT Convert a public key to DNSKEY Rdata
*public_key*, a ``PublicKey`` (``GenericPublicKey`` or
``cryptography.hazmat.primitives.asymmetric``) to convert.
*algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm.
*flags*: DNSKEY flags field as an integer.
*protocol*: DNSKEY protocol field as an integer.
Raises ``ValueError`` if the specified key algorithm parameters are not
unsupported, ``TypeError`` if the key type is unsupported,
`UnsupportedAlgorithm` if the algorithm is unknown and
`AlgorithmKeyMismatch` if the algorithm does not match the key type.
Return DNSKEY ``Rdata``.
)r r r )r maker, r to_dnskeyget_algorithm_clsr )r r< r r r s r# _make_dnskeyr s_ 2 y)I * .//##%#CC&y1<<
j)33%3SSr% c [ XX#5 n[ UR [ R R UR
UR UR UR S9$ )ae Convert a public key to CDNSKEY Rdata
*public_key*, the public key to convert, a
``cryptography.hazmat.primitives.asymmetric`` public key class applicable
for DNSSEC.
*algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm.
*flags*: DNSKEY flags field as an integer.
*protocol*: DNSKEY protocol field as an integer.
Raises ``ValueError`` if the specified key algorithm parameters are not
unsupported, ``TypeError`` if the key type is unsupported,
`UnsupportedAlgorithm` if the algorithm is unknown and
`AlgorithmKeyMismatch` if the algorithm does not match the key type.
Return CDNSKEY ``Rdata``.
r r r r r< r3 ) r r r r r r r r< r3 )r r< r r r s r#
_make_cdnskeyr sO 4 *
AF }}$$ll "" JJ
r% domainsalt
iterationsc [ R SS5 n [ U[ 5 ( a [ UR 5 nU[ R :w a [
S5 eUc SnOJ[ U[ 5 ( a3 [ U5 S- S:X a [ R U5 nO
[
S5 eUn[ U [ R R 5 ( d [ R R U 5 n U R 5 R! 5 nUc e[" R$ " Xe- 5 R' 5 n[) U5 H) n[" R$ " Xu- 5 R' 5 nM+ [* R, " U5 R/ S5 n U R1 U5 n U $ ! [
a [
S5 ef = f) a
Calculate the NSEC3 hash, according to
https://tools.ietf.org/html/rfc5155#section-5
*domain*, a ``dns.name.Name`` or ``str``, the name to hash.
*salt*, a ``str``, ``bytes``, or ``None``, the hash salt. If a
string, it is decoded as a hex string.
*iterations*, an ``int``, the number of iterations.
*algorithm*, a ``str`` or ``int``, the hash algorithm.
The only defined algorithm is SHA1.
Returns a ``str``, the encoded NSEC3 hash.
ABCDEFGHIJKLMNOPQRSTUVWXYZ234567 0123456789ABCDEFGHIJKLMNOPQRSTUVz-Wrong hash algorithm (only SHA1 is supported)r% r8 r zInvalid salt lengthzutf-8)r/ maketransr, r r r r r r? bytesfromhexr r} Namer" r r; r r r r> base64 b32encodedecode translate)
r r r r< b32_conversion salt_encodeddomain_encodedr rM outputs
r#
nsec3_hashr s| . ]]*,NNJ i % %!)//"34I INN"HII | D# t9q=A ==.L 23 3 fchhmm , ,##F+((*224N %% %
\\.7
8
?
?
AF
:
f 34;;=
f
%
,
,W
5F
n
-F M9 JHIIJs ,F4 4G
algorithmsc [ U 5 u p4UR [ R R [ R R
[ R R 4; a [ S5 e[ 5 nU HA n [ U[ 5 ( a [ UR 5 nUR U5 MC UR [ R R :X a{ / n[! U5 H& nUR" U; d M UR% U5 M( [' U5 S:X a [ S5 e[ R( R+ UR, U5 $ / nU H nUR/ [1 X4Xb5 5 M [ R( R+ UR, U5 $ ! [ a [ SU S35 ef = f)a Create a DS record from DNSKEY/CDNSKEY/CDS.
*rrset*, the RRset to create DS Rdataset for. This can be a
``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``)
tuple.
*algorithms*, a set of ``str`` or ``int`` specifying the hash algorithms.
The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
does not matter for these strings. If the RRset is a CDS, only digest
algorithms matching algorithms are accepted.
*origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name,
then it will be made absolute using the specified origin.
Raises ``UnsupportedAlgorithm`` if any of the algorithms are unknown and
``ValueError`` if the given RRset is not usable.
Returns a ``dns.rdataset.Rdataset``
z rrset not a DNSKEY/CDNSKEY/CDSr r r z no acceptable CDS rdata found)r r r r r r r r setr, r/ r
r r r addcds_rdataset_to_ds_rdatasetr appendr? r from_rdata_listr extend dnskey_rdataset_to_cds_rdataset) r r r~ r r _algorithmsr< resr@ s r# make_ds_rdatasetr ( sz 2 ,E2F
9::%K O)S)) $Y__%6 7 "
#--+++0:E K/
5! ; s8q= <= =||++HLL#>>
C
26YWX ! << ' ' c ::! O&)@ 1'MN N Os ,F88Gr c U R [ R R :w a [ S5 e/ nU Hj nUR [ UR [ R R UR UR UR UR S95 Ml [ R R U R U5 $ )zCreate a CDS record from DS.
*rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for.
Raises ``ValueError`` if the rdataset is not CDS.
Returns a ``dns.rdataset.Rdataset``
zrdataset not a CDSr )r r r r r r r r r r< r r r r r r r r@ s r# r r b s #--+++-..
C
}}''
// ! - - ||
<< ' ' c ::r% c < UR [ R R [ R R 4; a [ S5 e/ nU H nUR
[ XX#5 5 M [ R R UR U5 $ )a Create a CDS record from DNSKEY/CDNSKEY.
*name*, a ``dns.name.Name`` or ``str``, the owner name of the CDS record.
*rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for.
*algorithm*, a ``str`` or ``int`` specifying the hash algorithm.
The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case
does not matter for these strings.
*origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name,
then it will be made absolute using the specified origin.
Raises ``UnsupportedAlgorithm`` if the algorithm is unknown or
``ValueError`` if the rdataset is not DNSKEY/CDNSKEY.
Returns a ``dns.rdataset.Rdataset``
z rdataset not a DNSKEY/CDNSKEY) r r r r r r r r r r r )r} r r< r~ r r@ s r# r r sr 2 s}} 3 3S]]5J5J KK899
C
8D;< << ' ' c ::r% c U R [ R R :w a [ S5 e/ nU H\ nUR [
U R U R UR UR UR UR S95 M^ [ R R U R U5 $ )zCreate a CDNSKEY record from DNSKEY.
*rdataset*, a ``dns.rdataset.Rdataset``, to create CDNSKEY Rdataset for.
Returns a ``dns.rdataset.Rdataset``
zrdataset not a DNSKEYr )r r r r r r r r r r r< r3 r r r r" s r# #dnskey_rdataset_to_cdnskey_rdatasetr% s #--...011
C
(( kk //II
<< ' ' c ::r% txnkskszsksc UR [ [ R R R
[ R R R [ R R R /5 ; a Un OUn U HR u p[ R R UU U
UUUUUU U
S9
nU R UR UR U5 MT g)zDefault RRset signer)
r r r r r r r r r~ r N)
r r r r RdataTyper r r r r r r} r )r& r r r' r( r r r r r~ r r r r r s r# default_rrset_signerr+ s
||s MM # # * * MM # # ' ' MM # # + +
#
# ! '
EIIu- $r% zone
add_dnskey
dnskey_ttlnsec3 rrset_signerc / n / n
U( ae U HL nUS R [ R - ( a U R U5 M; U
R U5 MN U ( d Un U
( d Un
O/ nU( a [ R
" U5 nOU R
5 nU R c [ S5 eU nU( a Uc UR U R [ R R 5 nU( a
UR nO@UR U R [ R R 5 nUR nU H# u nnUR U R UU5 M% U( a [! S5 eU =( d5 [" R$ " [& U R U U
UUUU
U R U S9
n[) U UU5 sSSS5 $ ! , ( d f g= f)a Sign zone.
*zone*, a ``dns.zone.Zone``, the zone to sign.
*txn*, a ``dns.transaction.Transaction``, an optional transaction to use for
signing.
*keys*, a list of (``PrivateKey``, ``DNSKEY``) tuples, to use for signing. KSK/ZSK
roles are assigned automatically if the SEP flag is used, otherwise all RRsets are
signed by all keys.
*add_dnskey*, a ``bool``. If ``True``, the default, all specified DNSKEYs are
automatically added to the zone on signing.
*dnskey_ttl*, a``int``, specifies the TTL for DNSKEY RRs. If not specified the TTL
of the existing DNSKEY RRset used or the TTL of the SOA RRset.
*inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature
inception time. If ``None``, the current time is used. If a ``str``, the format is
"YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text
form; this is the same the RRSIG rdata's text form. Values of type `int` or `float`
are interpreted as seconds since the UNIX epoch.
*expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature
expiration time. If ``None``, the expiration time will be the inception time plus
the value of the *lifetime* parameter. See the description of *inception* above for
how the various parameter types are interpreted.
*lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This
parameter is only meaningful if *expiration* is ``None``.
*nsec3*, a ``NSEC3PARAM`` Rdata, configures signing using NSEC3. Not yet
implemented.
*rrset_signer*, a ``Callable``, an optional function for signing RRsets. The
function requires two arguments: transaction and RRset. If the not specified,
``dns.dnssec.default_rrset_signer`` will be used.
*deterministic*, a ``bool``. If ``True``, the default, use deterministic
(reproducible) signatures when supported by the algorithm used for signing.
Currently, this only affects ECDSA.
Returns ``None``.
r9 Nzno zone originz&Signing with NSEC3 not yet implemented) r r' r( r r r r r~ r )r r SEPr
contextlib nullcontextwriterr~ r r r r r r SOAr NotImplementedError functoolspartialr+ _sign_zone_nsec)r, r& r r- r. r r r r/ r0 r r r' r( r3 cm_txnr soarM
_rrset_signers r# sign_zoner? s} v D
D C1v||dhh& C C
DD
0:0F0Fs0K
[[] {{)** t ! $++s}}/C/CD!'J ((4;;
0A0ABC!$J ! 6j&9 " %&NO O ( I,=,=${{#%! {{ + -M #4}=7
s
;DG
G+c ` S
S[ R R S[ R R S[
[ R R S[ R R S[ S[
[ SS4S jjnU R 5 R nSnSn[ UR 5 5 GH? nU( a UR U5 ( a M# UR U[ R R" 5 ( a XpR$ :w a UnOSnU( a UR' U5 nU( a UR( H n U R* [ R R, :X a M- U( a* U R* [ R R. :w a M^ [ R0 R2 " XyR4 /U Q76 n
U" X5 M Ub U" XXpR6 XB5 UnGMB U( a U" XU R$ U R6 XB5 gg) zNSEC zone signerNr& r} next_securer r r0 r c p [ [ R R R [ R R R
/5 nU R
U5 nU( a U( a [ UR Vs/ s H oR PM sn5 U- n [ R " [ U 5 5 n
[ R R UU[ U[ R R R
UU
S95 n U R U 5 U( a U" X 5 ggggs snf )zNSEC zone signer helper)r r nextwindowsN)r r r r* r r get_node rdatasetsr r from_rdtypeslistr
from_rdatar ) r& r} rA r r r0 mandatory_typesr r typesrD r s r#
_txn_add_nsec&_sign_zone_nsec.._txn_add_nsec_ s
]]
$
$
*
*CMM,C,C,H,H I
||D! KT^^D^__^DEW
))$u+6GII(( # ==2277$ # E
GGEN S( ! 4Ds D3rH ) r transaction Transactionr} r r r
RdataClassr- RRsetSignerget_soaminimumr
iterate_names is_subdomainr r NSr~ rE rF r r r r rI r r ) r, r& r0 rL rrsig_ttl
delegation last_securer} r r r s r# r: r: X s /3
)
__
(
( )hhmm ) chhmm, ) ** )
) {+
)
)@ &&IJKs((*+ $++J77
WWT3==++
,
,1D J J <<%D $H #--*=*== #3==;K;K(K # 4 4T<< S( S$S0 !/ " #D,, X 9 ,< dkk4<<
r% c [ S5 e)Nz.DNSSEC validation requires python cryptography) ImportError)argskwargss r#
_need_pycar^ s
8 r% r )r )dsa)ec)ed448)rsa)ed25519)r r )r r )NNFrH )NNN)NNNFNNT)NNNNNT) NNTNNNNNNNT)__doc__r r3 r8 r r r r typingr r r r r r r
r
dns._featuresr
dns.exceptiondns.namedns.node dns.rdatadns.rdataclass dns.rdataset
dns.rdatatype dns.rrsetdns.transactiondns.zonedns.dnssectypesr r
r r r r r dns.rdtypes.ANY.CDNSKEYr dns.rdtypes.ANY.CDSr dns.rdtypes.ANY.DNSKEYr dns.rdtypes.ANY.DSr dns.rdtypes.ANY.NSECr r dns.rdtypes.ANY.NSEC3PARAMr dns.rdtypes.ANY.RRSIGr r dns.rdtypes.dnskeybaser PublicKey
PrivateKeyrN rO r RRsetrQ r/ r$ r- r* r0 r2 rC rE rd r= DSA DSANSEC3SHA1ECCGOSTNULLr GOSTrfc_8624_policyr allow_all_policyr r} r r@ Rdatara r r r Rdatasetr r r r r r r r r r r r r r r r r r% r+ r, Zoner? r: r^ _featureshavecryptography.exceptionsr )cryptography.hazmat.primitives.asymmetricr_ r` ra rb rc dns.dnssecalgsr r dns.dnssecalgs.baser r validatevalidate_rrsigr make_dnskey make_cdnskey
_have_pycaDHECCRSASHA1RSASHA1NSEC3SHA1 RSASHA256 RSASHA512ECDSAP256SHA256ECDSAP384SHA384ED25519ED448INDIRECT
PRIVATEDNS
PRIVATEOIDrI r% r# r s $ 5
J J J : : , # ) ! - 1 = '
33SYY__EtKL %c %i %$U9c> 2 $s $ 6hUC 78 6S 6 fgo& 3 , "7 7* y}}i&<&O>OPy}}i&<&<=
]]HMM8==1
]]O ceSUCE359 ! '+ #
J
s"
#J J Xs]#J
SXX]] # J
V J
J Jb '+ !
s"
#! ! Xs]#!
SXX]] # !
!H
sxx}}eCLL$9$9388==$H II
JSX
d6l(! %
s||7L7L(L"MM N!
388==#,,// /0!!U !% !f ! ! '+ #
C. %
s||7L7L(L"MM NC. C. sxx}}eCHHMM3<<3H3H$H II
JC.
SXX]] # C.
% C.
V
C.
C.T '+ #
F3 %
s||7L7L(L"MM NF3CIIOOU388==#,,:O:O+O%PPQF3 sxx}}eCHHMM3<<3H3H$H II
JF3
SXX]] # F3
% F3
V
F3
F3\ =A=A " #&* |D %
s||7L7L(L"MM N|D|D
HHMM|D
|D
hS% 789 |D xc5 89:
|D sm|D
|D
V |D
SXX]] #|D |D |DD '+@ %
s||7L7L(L"MM N@ @
SXX]] #@ @L T TS#X T T T
TL ##S#X# # #
#L: #((--$ %:
5e$
%: : S#X :
:@ '+7; %
s||7L7L(L"MM N7;E(C-()7;
SXX]] #7; \\ 7;t;ll##;\\;B '+ ;
s"
# ;ll## ; Xs]# ;
SXX]] # ;
\\ ;B;ll##;\\;B =A=A " #&* '. $ $'. 99??'.
HHMM'. uZ'(
) '.
uZ'(
) '. hS% 789
'. xc5 89:'. sm'.
V '.
SXX]] #'. '.
'.X 266: $<@=A ""&*. # p>
((--p> #//-- .p> 4j& 012
3p> p>
p> hS% 789
p> xc5 89:p> smp> J p> ;'p>
V p> p>
p>l +/L
((--L
$ $L
;'L
L
^ ==h 8=<?= HH$N D K LJH N D K LJ
\\mmmm
%% --
++++
!
!
!
!
r%