HizdZddlZddlZddlZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z mZmZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddlmZmZmZddlm Z ddlm!Z!m"Z"m#Z#ddl$m%Z%dd l&m'Z'dd l(m)Z)dd l*m+Z+dd l,m-Z-m.Z.dd l/m0Z0ddl1m2Z2m3Z3ddl4m5Z5edZ6edZ7e ej8j9ej:j;gdfZdee?zde=fdZ@dee=zeAze?zde?fdZBde)e%zde?fdZCGddZDGddeDZEeEejFejGejHejIhejFejGejHhejJejKejLhejJhZMeEeNeNeNeNZOeMZP dadejQjRe=zdejSjTd ee=zd!ejQjRdzd"eDdzd#eUde+fd$ZV dbdejQjRe=zdejSjTd ee=zd!ejQjRdzde'f d%ZWd&e ejQjRejXjYejZj[zfd'e2de e)dzfd(Z\d)ej:j;e ejQjRejXjYfzde ejQjRejXjYffd*Z]d+e^d,e^de)ddfd-Z_ dcd)ej:j;e ejQjRejXjYfzd'e2d&e ejQjRejZj[ejXjYzfd!ejQjRdzd.eAdzd"eDdzddfd/Z` dcd)ej:j;e ejQjRejXjYfzd0ej:j;e ejQjRejXjYfzd&e ejQjRejZj[ejXjYzfd!ejQjRdzd.eAdzd"eDdzddfd1Za ddd)ej:j;e ejQjRejXjYfzd3e7d4ejQjRd5e)d6ee=ze?zeAzdzd7ee=ze?zeAzdzd8e?dzd9eUd"eDdzd!ejQjRdzd:eUde2fd;Zb dbd)ej:j;e ejQjRejXjYfzd'e2d!ejQjRdzde^fd<Zce5jdd=fd>e6d e?e=zd?e?d@e?de)f dAZee5jdd=fd>e6d e?e=zd?e?d@e?de%f dBZfdCejQjRe=zdDe=e^zdzdEe?d e?e=zde=f dFZg dbd)ej:j;e ejQjRejXjYfzdGe ee=zd!ejQjRdzdejXjYfdHZhdIejXjYdejXjYfdJZi dbdejQjRe=zdIejXjYd ee=zd!ejQjRdzdejXjYf dKZjdIejXjYdejXjYfdLZk dedMej8j9d)ej:j;d4ejQjRdNe e e7e)fdOe e e7e)fd6ee=ze?zeAzdzd7ee=ze?zeAzdzd8e?dzd"eDdzd!ejQjRdzd:eUddfdPZl dfdQejmjndMej8j9dzd&e e e7e)fdzdReUdSe?dzd6ee=ze?zeAzdzd7ee=ze?zeAzdzd8e?dzdTe0dzdUeQ   U3u::>*a/ /E %2+''v~r$cTeZdZdZdedefdZdedefdZdedefdZ dedefdZ d S) PolicycdSN)selfs r"__init__zPolicy.__init__s r$r2rcdSNFrGrHr2s r" ok_to_signzPolicy.ok_to_signur$cdSrKrGrLs r"ok_to_validatezPolicy.ok_to_validaterNr$r;cdSrKrGrHr;s r"ok_to_create_dszPolicy.ok_to_create_dsrNr$cdSrKrGrRs r"ok_to_validate_dszPolicy.ok_to_validate_dsrNr$N) __name__ __module__ __qualname__rIrboolrMrPr rSrUrGr$r"rDrDs   f&Td8r$rDc^eZdZfdZdedefdZdedefdZdedefdZ dedefdZ xZ S) SimpleDenyct||_||_||_||_dSrF)superrI _deny_sign_deny_validate_deny_create_ds_deny_validate_ds)rH deny_sign deny_validatedeny_create_dsdeny_validate_ds __class__s r"rIzSimpleDeny.__init__s> #+-!1r$r2rc|j|jvSrF)r;r^rLs r"rMzSimpleDeny.ok_to_signs}DO33r$c|j|jvSrF)r;r_rLs r"rPzSimpleDeny.ok_to_validates}D$777r$r;c||jvSrF)r`rRs r"rSzSimpleDeny.ok_to_create_dss 444r$c||jvSrF)rarRs r"rUzSimpleDeny.ok_to_validate_dss 666r$) rVrWrXrIrrYrMrPr rSrU __classcell__)rfs@r"r[r[s222224f444448&8T888855d555578777777777r$r[Fnamer;originpolicy validatingc |t} t|trt|}n!#t $rt d|dwxYw|r|j}n|j}||stt|ttzstd|tj krtj}n[|tjkrtj}n7|tjkrtj}nt d|dt|tr t(j||}|}||} || J|||| |} t7jdt;||j|| z} t(j t(j!j"t(j#j$| dtK| } tMtH| S)aCreate a DS record for a DNSSEC key. *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``, the key the DS is about. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name, then it will be made absolute using the specified origin. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. *validating*, a ``bool``. If ``True``, then policy is checked in validating mode, i.e. "Is it ok to validate using this digest algorithm?". Otherwise the policy is checked in creating mode, i.e. "Is it ok to create a DS with this digest algorithm?". Raises ``UnsupportedAlgorithm`` if the algorithm is unknown. Raises ``DeniedByPolicy`` if the algorithm is denied by policy. Returns a ``dns.rdtypes.ANY.DS.DS`` Nunsupported algorithm ""zkey is not a DNSKEY | CDNSKEYrmz!HBBr)'default_policyr+r.r upper ExceptionrrUrSrrr ValueErrorSHA1hashlibsha1SHA256sha256SHA384sha384dnsrlr! canonicalizer:updatedigeststructpackrBr;r? from_wire rdataclassIN rdatatyperr>r ) rlr2r;rmrnrocheckdshashwirekwirerdsrdatadss r"make_dsrs8J~K i % % 4 !2!23I KKK"#IY#I#I#IJJJK'(& 5   c6G+ , ,:8999HM!! ho % %!! ho % %!!"#IY#I#I#IJJJ$0x!!$//      & & ( (D KKvK & &E   1 1 1 MM$ MM% ]]__Fk&&++s}iHH6QG    3=+WaW  B B<<s 4AAct||||}t|jtjj|j|j|j|jS)aCreate a CDS record for a DNSSEC key. *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``, the key the DS is about. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if the algorithm is unknown. Returns a ``dns.rdtypes.ANY.DS.CDS`` rdclassrdtypekey_tagr; digest_typer) rrrrrrr;rr)rlr2r;rmrs r"make_cdsrsO2 sIv . .B  }  ,Ny    r$keysrrsigc|j}t|tjjr5|tjjtj j }n|}|dSfd|DS)Ncg|]l}|jjkrZt|jkrB|jtjztjkr |jdkWtt|mS)) r;rBrflagsrZONEprotocolr r).0rdrs r" z(_find_candidate_keys..0st     <5? * * 2JJ%- ' ' X !di / / K1   VR   r$) getsignerr+rnodeNode get_rdatasetrrrr)rrr%rdatasets ` r"_find_candidate_keysr&s HHU\ " "E%''%%cn&79MNNt       r$rrsetc^t|tr|d|dfS|j|fS)Nrr8)r+tuplerl)rs r"_get_rrname_rdatasetr:s6%!Qxq!!z5  r$sigdatact|j} ||}n#t$rt dwxYw|||dS)Nzinvalid public key)get_algorithm_cls_from_dnskey public_cls from_dnskeyrwrverify)rrr2r public_keys r"_validate_signaturerCsr.s33>J6++C00 666 45556c4     s ,Anowc|t}t||}|td|tj}|j|krtd|j|krtdt |||}|D]H}||s t|j ||dS#ttf$rYEwxYwtd)aValidate an RRset against a single signature rdata, throwing an exception if validation is not successful. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsig*, a ``dns.rdata.Rdata``, the signature to validate. *keys*, the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative names. *now*, a ``float`` or ``None``, the time, in seconds since the epoch, to use as the current time when validating. If ``None``, the actual current time is used. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. Raises ``ValidationFailure`` if the signature is expired, not yet valid, the public key is invalid, the algorithm is unknown, the verification fails, etc. Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by dnspython but not implemented. Nz unknown keyexpiredz not yet validzverify failure) rtrrtime expiration inception_make_rrsig_signature_datarPr signatureInvalidSignature) rrrrmrrncandidate_keysr candidate_keys r"_validate_rrsigrMs P~)$66N ... {ikk # *** 000 %eUF ; ;D( $$]33    } E E E FF "34    H  , - --s B99C  C rrsigsetc |t}t|tr/tj|tjj}t|tr |d}n|j}t|tr|d}|d}n |j}|}||}||}||krtd|D]T} t| tstd t|| ||||dS#ttf$rYQwxYwtd)aValidate an RRset against a signature RRset, throwing an exception if none of the signatures validate. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsigset*, the signature RRset. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *keys*, the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin*, a ``dns.name.Name``, the origin to use for relative names; defaults to None. *now*, an ``int`` or ``None``, the time, in seconds since the epoch, to use as the current time when validating. If ``None``, the actual current time is used. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. Raises ``ValidationFailure`` if the signature is expired, not yet valid, the public key is invalid, the algorithm is unknown, the verification fails, etc. Nrr8zowner names do not matchzexpected an RRSIGzno RRSIGs validated) rtr+r.rrlr!rootrchoose_relativityrrrr) rrrrmrrnrrname rrsigname rrsigrdatasetrs r" _validaters[N~&#;##FCHM::%q(E""!QK   M   % %f - -F++F33I  :;;;%'' 9#$788 8  E5$V D D D FF!#78    D  1 2 22s D!!D54D5T private_keyrdnskeyrrlifetimer deterministicc |t}||stt|tr0|dj} |dj} |d} |dj}n|j} |j} |j} |j}|t|}n ttj }|t|}n|||z}ntd| | | } t| dz }| r|dz}t!| t"jj| |j||||t)||d }t+||| }t|t,r|}n: t/|}||}n#t0$rt3dwxYw|||| }t7t || S) aESign RRset using private key. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *private_key*, the private key to use for signing, a ``cryptography.hazmat.primitives.asymmetric`` private key class applicable for DNSSEC. *signer*, a ``dns.name.Name``, the Signer's name. *dnskey*, a ``DNSKEY`` matching ``private_key``. *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature inception time. If ``None``, the current time is used. If a ``str``, the format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text form; this is the same the RRSIG rdata's text form. Values of type `int` or `float` are interpreted as seconds since the UNIX epoch. *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature expiration time. If ``None``, the expiration time will be the inception time plus the value of the *lifetime* parameter. See the description of *inception* above for how the various parameter types are interpreted. *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This parameter is only meaningful if *expiration* is ``None``. *verify*, a ``bool``. If set to ``True``, the signer will verify signatures after they are created; the default is ``False``. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. *origin*, a ``dns.name.Name`` or ``None``. If ``None``, the default, then all names in the rrset (including its owner name) must be absolute; otherwise the specified origin will be used to make names absolute when signing. *deterministic*, a ``bool``. If ``True``, the default, use deterministic (reproducible) signatures when supported by the algorithm used for signing. Currently, this only affects ECDSA. Raises ``DeniedByPolicy`` if the signature is denied by policy. Nr8rz(expiration or lifetime must be specifiedr$) rr type_coveredr;labels original_ttlrrrrrr2zUnsupported key algorithm)r)rtrMrr+rrrttlrlr1r,rrw derelativizer>is_wildrrrr;rBrrrrr0signr replace)rrrrrrrrrnrmrrrrrrrsig_inceptionrrsig_expirationrrrsig_templater signing_key private_clsrs r"_signrs+t~   V $ $% !("qqQx| -y &y11dikk**' 33  *X5CDDD$$V,, [[1_F~~! }""!#!v   N &e^V D DD+0119!  97??K%++666KK# 9 9 9788 8 9  v}==I ~-- -BB C CCs F%%F?cttr/tjtjj|j}|s&td| }t|\}}d}| |}|J||ddz }||j |z }|s&td| }t|}|r|j|dz krtd|dz |jkrtd |j|dz krC||jdzd} tjd | }| } t#jd |j|j|j} fd |D} t-| D]8} || z }|| z }t#jd t| }||z }|| z }9|S)aCreate signature rdata. *rrset*, the RRset to sign/validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsig*, a ``dns.rdata.Rdata``, the signature to validate, or the signature template used when signing. *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative names. Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by dnspython but not implemented. Nz,relative RR name without an origin specifiedr$rsr7z&wild owner name has wrong label lengthr8z#owner name longer than RRSIG labels*z!HHIc:g|]}|SrG) to_digestable)rr?rms r"rz._make_rrsig_signature_data..s' @ @ @ee!!&)) @ @ @r$z!H)r+r.rrlr!rr is_absoluterrrr:rr>rrsplitrrrrrsorted)rrrmrrrrrname_lensuffix rrnamebufrrfixedrdatasr?rrlens ` r"rr[sV*&#;##FCHM:: \F     - >#$RSS S$$V,,,E22FH D === ' 'D    D"IDEL & &v . ..D     - >#$RSS S$$V,,6{{H ~~JELHqL88 HIII!|el"" EFFF 1 $ $elQ.//2##C00$$&&Ik&(/83CUEWXXG @ @ @ @x @ @ @F   D#e**--     Kr$rrrrctj|}t|tr|||St |j}||||S)aConvert a public key to DNSKEY Rdata *public_key*, a ``PublicKey`` (``GenericPublicKey`` or ``cryptography.hazmat.primitives.asymmetric``) to convert. *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm. *flags*: DNSKEY flags field as an integer. *protocol*: DNSKEY protocol field as an integer. Raises ``ValueError`` if the specified key algorithm parameters are not unsupported, ``TypeError`` if the key type is unsupported, `UnsupportedAlgorithm` if the algorithm is unknown and `AlgorithmKeyMismatch` if the algorithm does not match the key type. Return DNSKEY ``Rdata``. )rrr)r maker+r to_dnskeyget_algorithm_clsr)rr;rrrs r" _make_dnskeyrsx2y))I*.//T##%(#CCC&y11< zj)))33%(3SSSr$ct||||}t|jtjj|j|j|j|jS)aConvert a public key to CDNSKEY Rdata *public_key*, the public key to convert, a ``cryptography.hazmat.primitives.asymmetric`` public key class applicable for DNSSEC. *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm. *flags*: DNSKEY flags field as an integer. *protocol*: DNSKEY protocol field as an integer. Raises ``ValueError`` if the specified key algorithm parameters are not unsupported, ``TypeError`` if the key type is unsupported, `UnsupportedAlgorithm` if the algorithm is unknown and `AlgorithmKeyMismatch` if the algorithm does not match the key type. Return CDNSKEY ``Rdata``. rrrrr;r2) rrrrrrrr;r2)rr;rrrs r" _make_cdnskeyrsP4*i A AF }$l" J    r$domainsalt iterationsctdd} t|trt|}n#t $rt dwxYw|tjkrt d|d}nWt|tr@t|dzdkrt |}nt d|}t|tj j stj |}|}|Jt#j||z}t)|D]+}t#j||z},t+j|d } | |} | S) a Calculate the NSEC3 hash, according to https://tools.ietf.org/html/rfc5155#section-5 *domain*, a ``dns.name.Name`` or ``str``, the name to hash. *salt*, a ``str``, ``bytes``, or ``None``, the hash salt. If a string, it is decoded as a hex string. *iterations*, an ``int``, the number of iterations. *algorithm*, a ``str`` or ``int``, the hash algorithm. The only defined algorithm is SHA1. Returns a ``str``, the encoded NSEC3 hash. ABCDEFGHIJKLMNOPQRSTUVWXYZ234567 0123456789ABCDEFGHIJKLMNOPQRSTUVz-Wrong hash algorithm (only SHA1 is supported)Nr$r7rzInvalid salt lengthzutf-8)r. maketransr+r rurvrwrxr>bytesfromhexrrlNamer!rr:ryrzrr=base64 b32encodedecode translate) rrrr;b32_conversion salt_encodeddomain_encodedr_outputs r" nsec3_hashrs.]]*,NNJ i % % 5!)//"3"34I JJJHIIIJIN""HIII | D#   t99q=A   ==..LL233 3 fchm , ,,##F++((**2244N  % % % \.<7 8 8 ? ? A AF :  >>f|344;;==  f % % , ,W 5 5F   n - -F Ms 4AA, algorithmsc |t|\}}|jtjjtjjtjjfvrtdt}|D]n} t|trt| }n!#t$rtd|dwxYw||o|jtjjkryg}t!|D] }|j|vr||!t'|dkrtdtj|j|Sg}|D]'}|t1||||(tj|j|S)aCreate a DS record from DNSKEY/CDNSKEY/CDS. *rrset*, the RRset to create DS Rdataset for. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *algorithms*, a set of ``str`` or ``int`` specifying the hash algorithms. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. If the RRset is a CDS, only digest algorithms matching algorithms are accepted. *origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if any of the algorithms are unknown and ``ValueError`` if the given RRset is not usable. Returns a ``dns.rdataset.Rdataset`` zrrset not a DNSKEY/CDNSKEY/CDSrqrrrzno acceptable CDS rdata found)rrrrrrrrwsetr+r.r rurvraddcds_rdataset_to_ds_rdatasetrappendr>rfrom_rdata_listrextenddnskey_rdataset_to_cds_rdataset) rrrmrr _algorithmsr;resr?s r"make_ds_rdatasetr$s2,E22FH    9:::%%K##  O)S)) 8$Y__%6%67  O O O&'M'M'M'MNN N O """"#-+++0:: " "E K// 5!!! s88q==<== =|++HL#>>> C YY  268YPVWWXXXX < ' ' c : ::s .4B##Crc L|jtjjkrt dg}|D]R}|t|jtjj|j|j |j |j Stj |j|S)zCreate a CDS record from DS. *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for. Raises ``ValueError`` if the rdataset is not CDS. Returns a ``dns.rdataset.Rdataset`` zrdataset not a CDSr)rrrrrwr rrrr;rrrrrrrr?s r"r r ^s#-+++-... C     }' /!-|      < ' ' c : ::r$c |jtjjtjjfvrt dg}|D]'}|t||||(tj |j |S)aCreate a CDS record from DNSKEY/CDNSKEY. *name*, a ``dns.name.Name`` or ``str``, the owner name of the CDS record. *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if the algorithm is unknown or ``ValueError`` if the rdataset is not DNSKEY/CDNSKEY. Returns a ``dns.rdataset.Rdataset`` zrdataset not a DNSKEY/CDNSKEY) rrrrrrwr rrrr)rlrr;rmrr?s r"rr{s2s}3S]5JKKK8999 C== 8D%F;;<<<< < ' ' c : ::r$c 8|jtjjkrt dg}|D]H}|t |j|j|j|j |j |j Itj |j|S)zCreate a CDNSKEY record from DNSKEY. *rdataset*, a ``dns.rdataset.Rdataset``, to create CDNSKEY Rdataset for. Returns a ``dns.rdataset.Rdataset`` zrdataset not a DNSKEYr)rrrrrwr rrrrr;r2rrrrs r"#dnskey_rdataset_to_cdnskey_rdatasetrs#-...0111 C     (k/I      < ' ' c : ::r$txnkskszsksc >|jttjjjtjjjtjjjgvr|} n|} | D]?\} } t|| | |||||| |  }| |j |j |@dS)zDefault RRset signer) rrrrrrrrnrmrN) rr rr RdataTyperrrrr rlr)rrrrrrrrrnrmrrrrrs r"default_rrset_signerrs |s M # * M # ' M # + # . . V#!'      EIu---- . .r$zone add_dnskey dnskey_ttlnsec3 rrset_signerc .g} g} |rS|D]G}|djtjzr| |2| |H| s|} | s|} ng}|rt j|}n|}|jtd|5}|r|e| |jtj j }|r|j }n1| |jtj j}|j }|D]!\}}||j||"|rt!d| p,t#jt&|j| | |||| |j|  }t)|||cdddS#1swxYwYdS)aSign zone. *zone*, a ``dns.zone.Zone``, the zone to sign. *txn*, a ``dns.transaction.Transaction``, an optional transaction to use for signing. *keys*, a list of (``PrivateKey``, ``DNSKEY``) tuples, to use for signing. KSK/ZSK roles are assigned automatically if the SEP flag is used, otherwise all RRsets are signed by all keys. *add_dnskey*, a ``bool``. If ``True``, the default, all specified DNSKEYs are automatically added to the zone on signing. *dnskey_ttl*, a``int``, specifies the TTL for DNSKEY RRs. If not specified the TTL of the existing DNSKEY RRset used or the TTL of the SOA RRset. *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature inception time. If ``None``, the current time is used. If a ``str``, the format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text form; this is the same the RRSIG rdata's text form. Values of type `int` or `float` are interpreted as seconds since the UNIX epoch. *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature expiration time. If ``None``, the expiration time will be the inception time plus the value of the *lifetime* parameter. See the description of *inception* above for how the various parameter types are interpreted. *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This parameter is only meaningful if *expiration* is ``None``. *nsec3*, a ``NSEC3PARAM`` Rdata, configures signing using NSEC3. Not yet implemented. *rrset_signer*, a ``Callable``, an optional function for signing RRsets. The function requires two arguments: transaction and RRset. If the not specified, ``dns.dnssec.default_rrset_signer`` will be used. *deterministic*, a ``bool``. If ``True``, the default, use deterministic (reproducible) signatures when supported by the algorithm used for signing. Currently, this only affects ECDSA. Returns ``None``. r8Nzno zone originz&Signing with NSEC3 not yet implemented) rrrrrrrnrmr)rrSEPr  contextlib nullcontextwriterrmrwrrrrrSOAr NotImplementedError functoolspartialr_sign_zone_nsec)rrrr r!rrrr"r#rnrrrr2cm_txnrsoar _rrset_signers r" sign_zoner2sv D D  ! !C1v|dh& ! C     C     D D 0:0Fs0K0K [[]] {)*** >t  :!$+s}/CDD)!'JJ((4; 0ABBC!$J! : : 6j&9999  >%&NOO O( I,=${#%!{+ - - -M#4}==7>>>>>>>>>>>>>>>>>>sCF  FFcZ d dtjjdtjjdtjjdzdtjjdtdtdzddfd }| |j }d}d}t| D]}|r| |r||tjjr||jkr|}nd}|r||}|rk|jD]c} | jtjjkr|r| jtjjkr:tjj|| jg| R} ||| d||||||j|||}|r||||j|j||dSdS) zNSEC zone signerNrrl next_securerrr#rc  ttjjjtjjjg}||}|r|rtd|jD|z}tj t|} tj ||t |tjjj|| } | | |r||| dSdSdSdS)zNSEC zone signer helpercg|] }|j SrG)r)rrs r"rz:_sign_zone_nsec.._txn_add_nsec..jsDDDX_DDDr$)rrnextwindowsN)r rrrrrget_node rdatasetsr from_rdtypeslistr from_rdatar ) rrlr4rrr#mandatory_typesrtypesr8rs r" _txn_add_nsecz&_sign_zone_nsec.._txn_add_nsec[s ] $ *CM,C,H I  ||D!!  )K )DDT^DDDEEW )$u++66GI((#=27$#   E GGENNN ) S%(((((# ) ) ) )  ) )r$rF)r transaction Transactionrlrr RdataClassr, RRsetSignerget_soaminimumr iterate_names is_subdomainrrNSrmr9r:rrrrr=rr) rrr#r@ rrsig_ttl delegation last_securerlrrrs r"r-r-Ts,0 )) _ ()hm)X]T))* )  ) "D( ) ))))@ S!!)IJKs((**++  $++J77   WWT3=+ , , 1D1DJJJ  1<<%%D 1 $ 1 1H#-*=== #13=;K(K(K # 4T8< S( S S S$ S%0000  " M#{D$, < X X X   dk4<L       r$c td)Nz.DNSSEC validation requires python cryptography) ImportError)argskwargss r" _need_pycarQs 8  r$dnssec)r)ec)ed448)rsa)ed25519)rr)rr)NNFrF)NNN)NNNFNNT)NNNNNT) NNTNNNNNNNT)__doc__rr&r+ryrrrtypingrrrrrr r dns._featuresrdns.namedns.node dns.rdatadns.rdataclass dns.rdataset dns.rdatatype dns.rrsetdns.transactiondns.zonedns.dnssectypesr r r dns.exceptionrrrrdns.rdtypes.ANY.CDNSKEYrdns.rdtypes.ANY.CDSrdns.rdtypes.ANY.DNSKEYrdns.rdtypes.ANY.DSrdns.rdtypes.ANY.NSECrrdns.rdtypes.ANY.NSEC3PARAMrdns.rdtypes.ANY.RRSIGrrdns.rdtypes.dnskeybaser PublicKey PrivateKeyrArBrRRsetrDr.r#r,r)r/r1rBrDr[r<DSA DSANSEC3SHA1ECCGOSTNULLrxGOSTrfc_8624_policyr allow_all_policyrtrlrr?RdatarYrrrRdatasetrrrrrrrrrrrrrrrr rrrrZoner2r-rQ _featureshavecryptography.exceptionsr)cryptography.hazmat.primitives.asymmetricrSrTrUrVdns.dnssecalgsrrdns.dnssecalgs.baserrvalidatevalidate_rrsigr make_dnskey make_cdnskey _have_pycaDHECCRSASHA1RSASHA1NSEC3SHA1 RSASHA256 RSASHA512ECDSAP256SHA256ECDSAP384SHA384ED25519ED448INDIRECT PRIVATEDNS PRIVATEOIDrGr$r"rs $54  @@@@@@@@@@@@@@@@@@::::::::::FFFFFFQQQQQQQQQQ++++++######))))))!!!!!!--------111111========''''''    3SY_EtKL %c%i%%%%$Y_$$$$$ 63.4 6 6 6 6 6 S,"77777777**y}i&OPy}i&<= ]HM8=1 ]O :cceeSSUUCCEE335599!$(  JJ (-# J J#~J HMD J TM J  JJJJJb$( !! (-# ! !#~! HMD !  !!!!H sx}cl3chmCC DMR &\D(! 9?U38=#,2G#GH H! 38=#,/ /0!!!!!U!%!f!!!!!$( C.C. 9?U38=#,2G#GH HC. C. sx}chmcl.CCC DC. HMD C.  C. TM C. C.C.C.C.T$( F3F3 9?U38=#,2G#GH HF3iochmS\5J&J KKF3 sx}chmcl.CCC DF3 HMD F3  F3 TM F3 F3F3F3F3\6:6: #'|D|D 9?U38=#,2G#GH H|D|D HM|D  |D #~#e+d2 |D 3$u,t3 |DDj|D |D TM|D HMD |D|D |D|D|D|DD$(@@ 9?U38=#,2G#GH H@ @ HMD @ @@@@L T T TSy T  T T  T T T TL ###Sy# # #  ####L: HMC : + ::Sy :  ::::@$(7;7; 9?U38=#,2G#GH H7;HsN#7; HMD 7; \ 7;7;7;7;t;l#;\;;;;B$( ;; (-# ;l#;#~; HMD ;  \ ;;;;B;l#;\;;;;B6:6: #''.'.  $'. 9?'. HM'. uZ'( ) '. uZ'( ) '. #~#e+d2 '.3$u,t3'.Dj'. TM'. HMD '.'. '.'.'.'.X/337!596:#'+ p>p> (-p>  $t +p> uZ'( )D 0p> p> d p> #~#e+d2 p>3$u,t3p>Djp>  p>$p> TMp>p> p>p>p>p>l(,L L (-L  $L $L  L L L L ^ =h888888<<<<<<??????======HGGGGGGGH$N DK LJJHN DKLJ  \mm  % -      ++      !  ! r$