?????????? ????????? - ??????????????? - /home/agenciai/public_html/cd38d8/dns.zip
???????
PK M�[�:i�E �E asyncresolver.pynu �[��� # Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license # Copyright (C) 2003-2017 Nominum, Inc. # # Permission to use, copy, modify, and distribute this software and its # documentation for any purpose with or without fee is hereby granted, # provided that the above copyright notice and this permission notice # appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. """Asynchronous DNS stub resolver.""" import socket import time from typing import Any, Dict, List, Optional, Union import dns._ddr import dns.asyncbackend import dns.asyncquery import dns.exception import dns.name import dns.query import dns.rdataclass import dns.rdatatype import dns.resolver # lgtm[py/import-and-import-from] # import some resolver symbols for brevity from dns.resolver import NXDOMAIN, NoAnswer, NoRootSOA, NotAbsolute # for indentation purposes below _udp = dns.asyncquery.udp _tcp = dns.asyncquery.tcp class Resolver(dns.resolver.BaseResolver): """Asynchronous DNS stub resolver.""" async def resolve( self, qname: Union[dns.name.Name, str], rdtype: Union[dns.rdatatype.RdataType, str] = dns.rdatatype.A, rdclass: Union[dns.rdataclass.RdataClass, str] = dns.rdataclass.IN, tcp: bool = False, source: Optional[str] = None, raise_on_no_answer: bool = True, source_port: int = 0, lifetime: Optional[float] = None, search: Optional[bool] = None, backend: Optional[dns.asyncbackend.Backend] = None, ) -> dns.resolver.Answer: """Query nameservers asynchronously to find the answer to the question. *backend*, a ``dns.asyncbackend.Backend``, or ``None``. If ``None``, the default, then dnspython will use the default backend. See :py:func:`dns.resolver.Resolver.resolve()` for the documentation of the other parameters, exceptions, and return type of this method. """ resolution = dns.resolver._Resolution( self, qname, rdtype, rdclass, tcp, raise_on_no_answer, search ) if not backend: backend = dns.asyncbackend.get_default_backend() start = time.time() while True: (request, answer) = resolution.next_request() # Note we need to say "if answer is not None" and not just # "if answer" because answer implements __len__, and python # will call that. We want to return if we have an answer # object, including in cases where its length is 0. if answer is not None: # cache hit! return answer assert request is not None # needed for type checking done = False while not done: (nameserver, tcp, backoff) = resolution.next_nameserver() if backoff: await backend.sleep(backoff) timeout = self._compute_timeout(start, lifetime, resolution.errors) try: response = await nameserver.async_query( request, timeout=timeout, source=source, source_port=source_port, max_size=tcp, backend=backend, ) except Exception as ex: (_, done) = resolution.query_result(None, ex) continue (answer, done) = resolution.query_result(response, None) # Note we need to say "if answer is not None" and not just # "if answer" because answer implements __len__, and python # will call that. We want to return if we have an answer # object, including in cases where its length is 0. if answer is not None: return answer async def resolve_address( self, ipaddr: str, *args: Any, **kwargs: Any ) -> dns.resolver.Answer: """Use an asynchronous resolver to run a reverse query for PTR records. This utilizes the resolve() method to perform a PTR lookup on the specified IP address. *ipaddr*, a ``str``, the IPv4 or IPv6 address you want to get the PTR record for. All other arguments that can be passed to the resolve() function except for rdtype and rdclass are also supported by this function. """ # We make a modified kwargs for type checking happiness, as otherwise # we get a legit warning about possibly having rdtype and rdclass # in the kwargs more than once. modified_kwargs: Dict[str, Any] = {} modified_kwargs.update(kwargs) modified_kwargs["rdtype"] = dns.rdatatype.PTR modified_kwargs["rdclass"] = dns.rdataclass.IN return await self.resolve( dns.reversename.from_address(ipaddr), *args, **modified_kwargs ) async def resolve_name( self, name: Union[dns.name.Name, str], family: int = socket.AF_UNSPEC, **kwargs: Any, ) -> dns.resolver.HostAnswers: """Use an asynchronous resolver to query for address records. This utilizes the resolve() method to perform A and/or AAAA lookups on the specified name. *qname*, a ``dns.name.Name`` or ``str``, the name to resolve. *family*, an ``int``, the address family. If socket.AF_UNSPEC (the default), both A and AAAA records will be retrieved. All other arguments that can be passed to the resolve() function except for rdtype and rdclass are also supported by this function. """ # We make a modified kwargs for type checking happiness, as otherwise # we get a legit warning about possibly having rdtype and rdclass # in the kwargs more than once. modified_kwargs: Dict[str, Any] = {} modified_kwargs.update(kwargs) modified_kwargs.pop("rdtype", None) modified_kwargs["rdclass"] = dns.rdataclass.IN if family == socket.AF_INET: v4 = await self.resolve(name, dns.rdatatype.A, **modified_kwargs) return dns.resolver.HostAnswers.make(v4=v4) elif family == socket.AF_INET6: v6 = await self.resolve(name, dns.rdatatype.AAAA, **modified_kwargs) return dns.resolver.HostAnswers.make(v6=v6) elif family != socket.AF_UNSPEC: raise NotImplementedError(f"unknown address family {family}") raise_on_no_answer = modified_kwargs.pop("raise_on_no_answer", True) lifetime = modified_kwargs.pop("lifetime", None) start = time.time() v6 = await self.resolve( name, dns.rdatatype.AAAA, raise_on_no_answer=False, lifetime=self._compute_timeout(start, lifetime), **modified_kwargs, ) # Note that setting name ensures we query the same name # for A as we did for AAAA. (This is just in case search lists # are active by default in the resolver configuration and # we might be talking to a server that says NXDOMAIN when it # wants to say NOERROR no data. name = v6.qname v4 = await self.resolve( name, dns.rdatatype.A, raise_on_no_answer=False, lifetime=self._compute_timeout(start, lifetime), **modified_kwargs, ) answers = dns.resolver.HostAnswers.make( v6=v6, v4=v4, add_empty=not raise_on_no_answer ) if not answers: raise NoAnswer(response=v6.response) return answers # pylint: disable=redefined-outer-name async def canonical_name(self, name: Union[dns.name.Name, str]) -> dns.name.Name: """Determine the canonical name of *name*. The canonical name is the name the resolver uses for queries after all CNAME and DNAME renamings have been applied. *name*, a ``dns.name.Name`` or ``str``, the query name. This method can raise any exception that ``resolve()`` can raise, other than ``dns.resolver.NoAnswer`` and ``dns.resolver.NXDOMAIN``. Returns a ``dns.name.Name``. """ try: answer = await self.resolve(name, raise_on_no_answer=False) canonical_name = answer.canonical_name except dns.resolver.NXDOMAIN as e: canonical_name = e.canonical_name return canonical_name async def try_ddr(self, lifetime: float = 5.0) -> None: """Try to update the resolver's nameservers using Discovery of Designated Resolvers (DDR). If successful, the resolver will subsequently use DNS-over-HTTPS or DNS-over-TLS for future queries. *lifetime*, a float, is the maximum time to spend attempting DDR. The default is 5 seconds. If the SVCB query is successful and results in a non-empty list of nameservers, then the resolver's nameservers are set to the returned servers in priority order. The current implementation does not use any address hints from the SVCB record, nor does it resolve addresses for the SCVB target name, rather it assumes that the bootstrap nameserver will always be one of the addresses and uses it. A future revision to the code may offer fuller support. The code verifies that the bootstrap nameserver is in the Subject Alternative Name field of the TLS certficate. """ try: expiration = time.time() + lifetime answer = await self.resolve( dns._ddr._local_resolver_name, "svcb", lifetime=lifetime ) timeout = dns.query._remaining(expiration) nameservers = await dns._ddr._get_nameservers_async(answer, timeout) if len(nameservers) > 0: self.nameservers = nameservers except Exception: pass default_resolver = None def get_default_resolver() -> Resolver: """Get the default asynchronous resolver, initializing it if necessary.""" if default_resolver is None: reset_default_resolver() assert default_resolver is not None return default_resolver def reset_default_resolver() -> None: """Re-initialize default asynchronous resolver. Note that the resolver configuration (i.e. /etc/resolv.conf on UNIX systems) will be re-read immediately. """ global default_resolver default_resolver = Resolver() async def resolve( qname: Union[dns.name.Name, str], rdtype: Union[dns.rdatatype.RdataType, str] = dns.rdatatype.A, rdclass: Union[dns.rdataclass.RdataClass, str] = dns.rdataclass.IN, tcp: bool = False, source: Optional[str] = None, raise_on_no_answer: bool = True, source_port: int = 0, lifetime: Optional[float] = None, search: Optional[bool] = None, backend: Optional[dns.asyncbackend.Backend] = None, ) -> dns.resolver.Answer: """Query nameservers asynchronously to find the answer to the question. This is a convenience function that uses the default resolver object to make the query. See :py:func:`dns.asyncresolver.Resolver.resolve` for more information on the parameters. """ return await get_default_resolver().resolve( qname, rdtype, rdclass, tcp, source, raise_on_no_answer, source_port, lifetime, search, backend, ) async def resolve_address( ipaddr: str, *args: Any, **kwargs: Any ) -> dns.resolver.Answer: """Use a resolver to run a reverse query for PTR records. See :py:func:`dns.asyncresolver.Resolver.resolve_address` for more information on the parameters. """ return await get_default_resolver().resolve_address(ipaddr, *args, **kwargs) async def resolve_name( name: Union[dns.name.Name, str], family: int = socket.AF_UNSPEC, **kwargs: Any ) -> dns.resolver.HostAnswers: """Use a resolver to asynchronously query for address records. See :py:func:`dns.asyncresolver.Resolver.resolve_name` for more information on the parameters. """ return await get_default_resolver().resolve_name(name, family, **kwargs) async def canonical_name(name: Union[dns.name.Name, str]) -> dns.name.Name: """Determine the canonical name of *name*. See :py:func:`dns.resolver.Resolver.canonical_name` for more information on the parameters and possible exceptions. """ return await get_default_resolver().canonical_name(name) async def try_ddr(timeout: float = 5.0) -> None: """Try to update the default resolver's nameservers using Discovery of Designated Resolvers (DDR). If successful, the resolver will subsequently use DNS-over-HTTPS or DNS-over-TLS for future queries. See :py:func:`dns.resolver.Resolver.try_ddr` for more information. """ return await get_default_resolver().try_ddr(timeout) async def zone_for_name( name: Union[dns.name.Name, str], rdclass: dns.rdataclass.RdataClass = dns.rdataclass.IN, tcp: bool = False, resolver: Optional[Resolver] = None, backend: Optional[dns.asyncbackend.Backend] = None, ) -> dns.name.Name: """Find the name of the zone which contains the specified name. See :py:func:`dns.resolver.Resolver.zone_for_name` for more information on the parameters and possible exceptions. """ if isinstance(name, str): name = dns.name.from_text(name, dns.name.root) if resolver is None: resolver = get_default_resolver() if not name.is_absolute(): raise NotAbsolute(name) while True: try: answer = await resolver.resolve( name, dns.rdatatype.SOA, rdclass, tcp, backend=backend ) assert answer.rrset is not None if answer.rrset.name == name: return name # otherwise we were CNAMEd or DNAMEd and need to look higher except (NXDOMAIN, NoAnswer): pass try: name = name.parent() except dns.name.NoParent: # pragma: no cover raise NoRootSOA async def make_resolver_at( where: Union[dns.name.Name, str], port: int = 53, family: int = socket.AF_UNSPEC, resolver: Optional[Resolver] = None, ) -> Resolver: """Make a stub resolver using the specified destination as the full resolver. *where*, a ``dns.name.Name`` or ``str`` the domain name or IP address of the full resolver. *port*, an ``int``, the port to use. If not specified, the default is 53. *family*, an ``int``, the address family to use. This parameter is used if *where* is not an address. The default is ``socket.AF_UNSPEC`` in which case the first address returned by ``resolve_name()`` will be used, otherwise the first address of the specified family will be used. *resolver*, a ``dns.asyncresolver.Resolver`` or ``None``, the resolver to use for resolution of hostnames. If not specified, the default resolver will be used. Returns a ``dns.resolver.Resolver`` or raises an exception. """ if resolver is None: resolver = get_default_resolver() nameservers: List[Union[str, dns.nameserver.Nameserver]] = [] if isinstance(where, str) and dns.inet.is_address(where): nameservers.append(dns.nameserver.Do53Nameserver(where, port)) else: answers = await resolver.resolve_name(where, family) for address in answers.addresses(): nameservers.append(dns.nameserver.Do53Nameserver(address, port)) res = dns.asyncresolver.Resolver(configure=False) res.nameservers = nameservers return res async def resolve_at( where: Union[dns.name.Name, str], qname: Union[dns.name.Name, str], rdtype: Union[dns.rdatatype.RdataType, str] = dns.rdatatype.A, rdclass: Union[dns.rdataclass.RdataClass, str] = dns.rdataclass.IN, tcp: bool = False, source: Optional[str] = None, raise_on_no_answer: bool = True, source_port: int = 0, lifetime: Optional[float] = None, search: Optional[bool] = None, backend: Optional[dns.asyncbackend.Backend] = None, port: int = 53, family: int = socket.AF_UNSPEC, resolver: Optional[Resolver] = None, ) -> dns.resolver.Answer: """Query nameservers to find the answer to the question. This is a convenience function that calls ``dns.asyncresolver.make_resolver_at()`` to make a resolver, and then uses it to resolve the query. See ``dns.asyncresolver.Resolver.resolve`` for more information on the resolution parameters, and ``dns.asyncresolver.make_resolver_at`` for information about the resolver parameters *where*, *port*, *family*, and *resolver*. If making more than one query, it is more efficient to call ``dns.asyncresolver.make_resolver_at()`` and then use that resolver for the queries instead of calling ``resolve_at()`` multiple times. """ res = await make_resolver_at(where, port, family, resolver) return await res.resolve( qname, rdtype, rdclass, tcp, source, raise_on_no_answer, source_port, lifetime, search, backend, ) PK M�[=@�_�3 �3 xfr.pynu �[��� # Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license # Copyright (C) 2003-2017 Nominum, Inc. # # Permission to use, copy, modify, and distribute this software and its # documentation for any purpose with or without fee is hereby granted, # provided that the above copyright notice and this permission notice # appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. from typing import Any, List, Optional, Tuple, Union import dns.exception import dns.message import dns.name import dns.rcode import dns.rdataset import dns.rdatatype import dns.serial import dns.transaction import dns.tsig import dns.zone class TransferError(dns.exception.DNSException): """A zone transfer response got a non-zero rcode.""" def __init__(self, rcode): message = "Zone transfer error: %s" % dns.rcode.to_text(rcode) super().__init__(message) self.rcode = rcode class SerialWentBackwards(dns.exception.FormError): """The current serial number is less than the serial we know.""" class UseTCP(dns.exception.DNSException): """This IXFR cannot be completed with UDP.""" class Inbound: """ State machine for zone transfers. """ def __init__( self, txn_manager: dns.transaction.TransactionManager, rdtype: dns.rdatatype.RdataType = dns.rdatatype.AXFR, serial: Optional[int] = None, is_udp: bool = False, ): """Initialize an inbound zone transfer. *txn_manager* is a :py:class:`dns.transaction.TransactionManager`. *rdtype* can be `dns.rdatatype.AXFR` or `dns.rdatatype.IXFR` *serial* is the base serial number for IXFRs, and is required in that case. *is_udp*, a ``bool`` indidicates if UDP is being used for this XFR. """ self.txn_manager = txn_manager self.txn: Optional[dns.transaction.Transaction] = None self.rdtype = rdtype if rdtype == dns.rdatatype.IXFR: if serial is None: raise ValueError("a starting serial must be supplied for IXFRs") elif is_udp: raise ValueError("is_udp specified for AXFR") self.serial = serial self.is_udp = is_udp (_, _, self.origin) = txn_manager.origin_information() self.soa_rdataset: Optional[dns.rdataset.Rdataset] = None self.done = False self.expecting_SOA = False self.delete_mode = False def process_message(self, message: dns.message.Message) -> bool: """Process one message in the transfer. The message should have the same relativization as was specified when the `dns.xfr.Inbound` was created. The message should also have been created with `one_rr_per_rrset=True` because order matters. Returns `True` if the transfer is complete, and `False` otherwise. """ if self.txn is None: replacement = self.rdtype == dns.rdatatype.AXFR self.txn = self.txn_manager.writer(replacement) rcode = message.rcode() if rcode != dns.rcode.NOERROR: raise TransferError(rcode) # # We don't require a question section, but if it is present is # should be correct. # if len(message.question) > 0: if message.question[0].name != self.origin: raise dns.exception.FormError("wrong question name") if message.question[0].rdtype != self.rdtype: raise dns.exception.FormError("wrong question rdatatype") answer_index = 0 if self.soa_rdataset is None: # # This is the first message. We're expecting an SOA at # the origin. # if not message.answer or message.answer[0].name != self.origin: raise dns.exception.FormError("No answer or RRset not for zone origin") rrset = message.answer[0] rdataset = rrset if rdataset.rdtype != dns.rdatatype.SOA: raise dns.exception.FormError("first RRset is not an SOA") answer_index = 1 self.soa_rdataset = rdataset.copy() if self.rdtype == dns.rdatatype.IXFR: if self.soa_rdataset[0].serial == self.serial: # # We're already up-to-date. # self.done = True elif dns.serial.Serial(self.soa_rdataset[0].serial) < self.serial: # It went backwards! raise SerialWentBackwards else: if self.is_udp and len(message.answer[answer_index:]) == 0: # # There are no more records, so this is the # "truncated" response. Say to use TCP # raise UseTCP # # Note we're expecting another SOA so we can detect # if this IXFR response is an AXFR-style response. # self.expecting_SOA = True # # Process the answer section (other than the initial SOA in # the first message). # for rrset in message.answer[answer_index:]: name = rrset.name rdataset = rrset if self.done: raise dns.exception.FormError("answers after final SOA") assert self.txn is not None # for mypy if rdataset.rdtype == dns.rdatatype.SOA and name == self.origin: # # Every time we see an origin SOA delete_mode inverts # if self.rdtype == dns.rdatatype.IXFR: self.delete_mode = not self.delete_mode # # If this SOA Rdataset is equal to the first we saw # then we're finished. If this is an IXFR we also # check that we're seeing the record in the expected # part of the response. # if rdataset == self.soa_rdataset and ( self.rdtype == dns.rdatatype.AXFR or (self.rdtype == dns.rdatatype.IXFR and self.delete_mode) ): # # This is the final SOA # if self.expecting_SOA: # We got an empty IXFR sequence! raise dns.exception.FormError("empty IXFR sequence") if ( self.rdtype == dns.rdatatype.IXFR and self.serial != rdataset[0].serial ): raise dns.exception.FormError("unexpected end of IXFR sequence") self.txn.replace(name, rdataset) self.txn.commit() self.txn = None self.done = True else: # # This is not the final SOA # self.expecting_SOA = False if self.rdtype == dns.rdatatype.IXFR: if self.delete_mode: # This is the start of an IXFR deletion set if rdataset[0].serial != self.serial: raise dns.exception.FormError( "IXFR base serial mismatch" ) else: # This is the start of an IXFR addition set self.serial = rdataset[0].serial self.txn.replace(name, rdataset) else: # We saw a non-final SOA for the origin in an AXFR. raise dns.exception.FormError("unexpected origin SOA in AXFR") continue if self.expecting_SOA: # # We made an IXFR request and are expecting another # SOA RR, but saw something else, so this must be an # AXFR response. # self.rdtype = dns.rdatatype.AXFR self.expecting_SOA = False self.delete_mode = False self.txn.rollback() self.txn = self.txn_manager.writer(True) # # Note we are falling through into the code below # so whatever rdataset this was gets written. # # Add or remove the data if self.delete_mode: self.txn.delete_exact(name, rdataset) else: self.txn.add(name, rdataset) if self.is_udp and not self.done: # # This is a UDP IXFR and we didn't get to done, and we didn't # get the proper "truncated" response # raise dns.exception.FormError("unexpected end of UDP IXFR") return self.done # # Inbounds are context managers. # def __enter__(self): return self def __exit__(self, exc_type, exc_val, exc_tb): if self.txn: self.txn.rollback() return False def make_query( txn_manager: dns.transaction.TransactionManager, serial: Optional[int] = 0, use_edns: Optional[Union[int, bool]] = None, ednsflags: Optional[int] = None, payload: Optional[int] = None, request_payload: Optional[int] = None, options: Optional[List[dns.edns.Option]] = None, keyring: Any = None, keyname: Optional[dns.name.Name] = None, keyalgorithm: Union[dns.name.Name, str] = dns.tsig.default_algorithm, ) -> Tuple[dns.message.QueryMessage, Optional[int]]: """Make an AXFR or IXFR query. *txn_manager* is a ``dns.transaction.TransactionManager``, typically a ``dns.zone.Zone``. *serial* is an ``int`` or ``None``. If 0, then IXFR will be attempted using the most recent serial number from the *txn_manager*; it is the caller's responsibility to ensure there are no write transactions active that could invalidate the retrieved serial. If a serial cannot be determined, AXFR will be forced. Other integer values are the starting serial to use. ``None`` forces an AXFR. Please see the documentation for :py:func:`dns.message.make_query` and :py:func:`dns.message.Message.use_tsig` for details on the other parameters to this function. Returns a `(query, serial)` tuple. """ (zone_origin, _, origin) = txn_manager.origin_information() if zone_origin is None: raise ValueError("no zone origin") if serial is None: rdtype = dns.rdatatype.AXFR elif not isinstance(serial, int): raise ValueError("serial is not an integer") elif serial == 0: with txn_manager.reader() as txn: rdataset = txn.get(origin, "SOA") if rdataset: serial = rdataset[0].serial rdtype = dns.rdatatype.IXFR else: serial = None rdtype = dns.rdatatype.AXFR elif serial > 0 and serial < 4294967296: rdtype = dns.rdatatype.IXFR else: raise ValueError("serial out-of-range") rdclass = txn_manager.get_class() q = dns.message.make_query( zone_origin, rdtype, rdclass, use_edns, False, ednsflags, payload, request_payload, options, ) if serial is not None: rdata = dns.rdata.from_text(rdclass, "SOA", f". . {serial} 0 0 0 0") rrset = q.find_rrset( q.authority, zone_origin, rdclass, dns.rdatatype.SOA, create=True ) rrset.add(rdata, 0) if keyring is not None: q.use_tsig(keyring, keyname, algorithm=keyalgorithm) return (q, serial) def extract_serial_from_query(query: dns.message.Message) -> Optional[int]: """Extract the SOA serial number from query if it is an IXFR and return it, otherwise return None. *query* is a dns.message.QueryMessage that is an IXFR or AXFR request. Raises if the query is not an IXFR or AXFR, or if an IXFR doesn't have an appropriate SOA RRset in the authority section. """ if not isinstance(query, dns.message.QueryMessage): raise ValueError("query not a QueryMessage") question = query.question[0] if question.rdtype == dns.rdatatype.AXFR: return None elif question.rdtype != dns.rdatatype.IXFR: raise ValueError("query is not an AXFR or IXFR") soa = query.find_rrset( query.authority, question.name, question.rdclass, dns.rdatatype.SOA ) return soa[0].serial PK M�[���E E exception.pynu �[��� # Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license # Copyright (C) 2003-2017 Nominum, Inc. # # Permission to use, copy, modify, and distribute this software and its # documentation for any purpose with or without fee is hereby granted, # provided that the above copyright notice and this permission notice # appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. """Common DNS Exceptions. Dnspython modules may also define their own exceptions, which will always be subclasses of ``DNSException``. """ from typing import Optional, Set class DNSException(Exception): """Abstract base class shared by all dnspython exceptions. It supports two basic modes of operation: a) Old/compatible mode is used if ``__init__`` was called with empty *kwargs*. In compatible mode all *args* are passed to the standard Python Exception class as before and all *args* are printed by the standard ``__str__`` implementation. Class variable ``msg`` (or doc string if ``msg`` is ``None``) is returned from ``str()`` if *args* is empty. b) New/parametrized mode is used if ``__init__`` was called with non-empty *kwargs*. In the new mode *args* must be empty and all kwargs must match those set in class variable ``supp_kwargs``. All kwargs are stored inside ``self.kwargs`` and used in a new ``__str__`` implementation to construct a formatted message based on the ``fmt`` class variable, a ``string``. In the simplest case it is enough to override the ``supp_kwargs`` and ``fmt`` class variables to get nice parametrized messages. """ msg: Optional[str] = None # non-parametrized message supp_kwargs: Set[str] = set() # accepted parameters for _fmt_kwargs (sanity check) fmt: Optional[str] = None # message parametrized with results from _fmt_kwargs def __init__(self, *args, **kwargs): self._check_params(*args, **kwargs) if kwargs: # This call to a virtual method from __init__ is ok in our usage self.kwargs = self._check_kwargs(**kwargs) # lgtm[py/init-calls-subclass] self.msg = str(self) else: self.kwargs = dict() # defined but empty for old mode exceptions if self.msg is None: # doc string is better implicit message than empty string self.msg = self.__doc__ if args: super().__init__(*args) else: super().__init__(self.msg) def _check_params(self, *args, **kwargs): """Old exceptions supported only args and not kwargs. For sanity we do not allow to mix old and new behavior.""" if args or kwargs: assert bool(args) != bool( kwargs ), "keyword arguments are mutually exclusive with positional args" def _check_kwargs(self, **kwargs): if kwargs: assert ( set(kwargs.keys()) == self.supp_kwargs ), "following set of keyword args is required: %s" % (self.supp_kwargs) return kwargs def _fmt_kwargs(self, **kwargs): """Format kwargs before printing them. Resulting dictionary has to have keys necessary for str.format call on fmt class variable. """ fmtargs = {} for kw, data in kwargs.items(): if isinstance(data, (list, set)): # convert list of <someobj> to list of str(<someobj>) fmtargs[kw] = list(map(str, data)) if len(fmtargs[kw]) == 1: # remove list brackets [] from single-item lists fmtargs[kw] = fmtargs[kw].pop() else: fmtargs[kw] = data return fmtargs def __str__(self): if self.kwargs and self.fmt: # provide custom message constructed from keyword arguments fmtargs = self._fmt_kwargs(**self.kwargs) return self.fmt.format(**fmtargs) else: # print *args directly in the same way as old DNSException return super().__str__() class FormError(DNSException): """DNS message is malformed.""" class SyntaxError(DNSException): """Text input is malformed.""" class UnexpectedEnd(SyntaxError): """Text input ended unexpectedly.""" class TooBig(DNSException): """The DNS message is too big.""" class Timeout(DNSException): """The DNS operation timed out.""" supp_kwargs = {"timeout"} fmt = "The DNS operation timed out after {timeout:.3f} seconds" # We do this as otherwise mypy complains about unexpected keyword argument # idna_exception def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) class UnsupportedAlgorithm(DNSException): """The DNSSEC algorithm is not supported.""" class AlgorithmKeyMismatch(UnsupportedAlgorithm): """The DNSSEC algorithm is not supported for the given key type.""" class ValidationFailure(DNSException): """The DNSSEC signature is invalid.""" class DeniedByPolicy(DNSException): """Denied by DNSSEC policy.""" class ExceptionWrapper: def __init__(self, exception_class): self.exception_class = exception_class def __enter__(self): return self def __exit__(self, exc_type, exc_val, exc_tb): if exc_type is not None and not isinstance(exc_val, self.exception_class): raise self.exception_class(str(exc_val)) from exc_val return False PK M�[�X�`0� 0� query.pynu �[��� # Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license # Copyright (C) 2003-2017 Nominum, Inc. # # Permission to use, copy, modify, and distribute this software and its # documentation for any purpose with or without fee is hereby granted, # provided that the above copyright notice and this permission notice # appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. """Talk to a DNS server.""" import base64 import contextlib import enum import errno import os import os.path import selectors import socket import struct import time from typing import Any, Dict, Optional, Tuple, Union import dns._features import dns.exception import dns.inet import dns.message import dns.name import dns.quic import dns.rcode import dns.rdataclass import dns.rdatatype import dns.serial import dns.transaction import dns.tsig import dns.xfr def _remaining(expiration): if expiration is None: return None timeout = expiration - time.time() if timeout <= 0.0: raise dns.exception.Timeout return timeout def _expiration_for_this_attempt(timeout, expiration): if expiration is None: return None return min(time.time() + timeout, expiration) _have_httpx = dns._features.have("doh") if _have_httpx: import httpcore._backends.sync import httpx _CoreNetworkBackend = httpcore.NetworkBackend _CoreSyncStream = httpcore._backends.sync.SyncStream class _NetworkBackend(_CoreNetworkBackend): def __init__(self, resolver, local_port, bootstrap_address, family): super().__init__() self._local_port = local_port self._resolver = resolver self._bootstrap_address = bootstrap_address self._family = family def connect_tcp( self, host, port, timeout, local_address, socket_options=None ): # pylint: disable=signature-differs addresses = [] _, expiration = _compute_times(timeout) if dns.inet.is_address(host): addresses.append(host) elif self._bootstrap_address is not None: addresses.append(self._bootstrap_address) else: timeout = _remaining(expiration) family = self._family if local_address: family = dns.inet.af_for_address(local_address) answers = self._resolver.resolve_name( host, family=family, lifetime=timeout ) addresses = answers.addresses() for address in addresses: af = dns.inet.af_for_address(address) if local_address is not None or self._local_port != 0: source = dns.inet.low_level_address_tuple( (local_address, self._local_port), af ) else: source = None sock = _make_socket(af, socket.SOCK_STREAM, source) attempt_expiration = _expiration_for_this_attempt(2.0, expiration) try: _connect( sock, dns.inet.low_level_address_tuple((address, port), af), attempt_expiration, ) return _CoreSyncStream(sock) except Exception: pass raise httpcore.ConnectError def connect_unix_socket( self, path, timeout, socket_options=None ): # pylint: disable=signature-differs raise NotImplementedError class _HTTPTransport(httpx.HTTPTransport): def __init__( self, *args, local_port=0, bootstrap_address=None, resolver=None, family=socket.AF_UNSPEC, **kwargs, ): if resolver is None: # pylint: disable=import-outside-toplevel,redefined-outer-name import dns.resolver resolver = dns.resolver.Resolver() super().__init__(*args, **kwargs) self._pool._network_backend = _NetworkBackend( resolver, local_port, bootstrap_address, family ) else: class _HTTPTransport: # type: ignore def connect_tcp(self, host, port, timeout, local_address): raise NotImplementedError have_doh = _have_httpx try: import ssl except ImportError: # pragma: no cover class ssl: # type: ignore CERT_NONE = 0 class WantReadException(Exception): pass class WantWriteException(Exception): pass class SSLContext: pass class SSLSocket: pass @classmethod def create_default_context(cls, *args, **kwargs): raise Exception("no ssl support") # pylint: disable=broad-exception-raised # Function used to create a socket. Can be overridden if needed in special # situations. socket_factory = socket.socket class UnexpectedSource(dns.exception.DNSException): """A DNS query response came from an unexpected address or port.""" class BadResponse(dns.exception.FormError): """A DNS query response does not respond to the question asked.""" class NoDOH(dns.exception.DNSException): """DNS over HTTPS (DOH) was requested but the httpx module is not available.""" class NoDOQ(dns.exception.DNSException): """DNS over QUIC (DOQ) was requested but the aioquic module is not available.""" # for backwards compatibility TransferError = dns.xfr.TransferError def _compute_times(timeout): now = time.time() if timeout is None: return (now, None) else: return (now, now + timeout) def _wait_for(fd, readable, writable, _, expiration): # Use the selected selector class to wait for any of the specified # events. An "expiration" absolute time is converted into a relative # timeout. # # The unused parameter is 'error', which is always set when # selecting for read or write, and we have no error-only selects. if readable and isinstance(fd, ssl.SSLSocket) and fd.pending() > 0: return True sel = _selector_class() events = 0 if readable: events |= selectors.EVENT_READ if writable: events |= selectors.EVENT_WRITE if events: sel.register(fd, events) if expiration is None: timeout = None else: timeout = expiration - time.time() if timeout <= 0.0: raise dns.exception.Timeout if not sel.select(timeout): raise dns.exception.Timeout def _set_selector_class(selector_class): # Internal API. Do not use. global _selector_class _selector_class = selector_class if hasattr(selectors, "PollSelector"): # Prefer poll() on platforms that support it because it has no # limits on the maximum value of a file descriptor (plus it will # be more efficient for high values). # # We ignore typing here as we can't say _selector_class is Any # on python < 3.8 due to a bug. _selector_class = selectors.PollSelector # type: ignore else: _selector_class = selectors.SelectSelector # type: ignore def _wait_for_readable(s, expiration): _wait_for(s, True, False, True, expiration) def _wait_for_writable(s, expiration): _wait_for(s, False, True, True, expiration) def _addresses_equal(af, a1, a2): # Convert the first value of the tuple, which is a textual format # address into binary form, so that we are not confused by different # textual representations of the same address try: n1 = dns.inet.inet_pton(af, a1[0]) n2 = dns.inet.inet_pton(af, a2[0]) except dns.exception.SyntaxError: return False return n1 == n2 and a1[1:] == a2[1:] def _matches_destination(af, from_address, destination, ignore_unexpected): # Check that from_address is appropriate for a response to a query # sent to destination. if not destination: return True if _addresses_equal(af, from_address, destination) or ( dns.inet.is_multicast(destination[0]) and from_address[1:] == destination[1:] ): return True elif ignore_unexpected: return False raise UnexpectedSource( f"got a response from {from_address} instead of " f"{destination}" ) def _destination_and_source( where, port, source, source_port, where_must_be_address=True ): # Apply defaults and compute destination and source tuples # suitable for use in connect(), sendto(), or bind(). af = None destination = None try: af = dns.inet.af_for_address(where) destination = where except Exception: if where_must_be_address: raise # URLs are ok so eat the exception if source: saf = dns.inet.af_for_address(source) if af: # We know the destination af, so source had better agree! if saf != af: raise ValueError( "different address families for source and destination" ) else: # We didn't know the destination af, but we know the source, # so that's our af. af = saf if source_port and not source: # Caller has specified a source_port but not an address, so we # need to return a source, and we need to use the appropriate # wildcard address as the address. try: source = dns.inet.any_for_af(af) except Exception: # we catch this and raise ValueError for backwards compatibility raise ValueError("source_port specified but address family is unknown") # Convert high-level (address, port) tuples into low-level address # tuples. if destination: destination = dns.inet.low_level_address_tuple((destination, port), af) if source: source = dns.inet.low_level_address_tuple((source, source_port), af) return (af, destination, source) def _make_socket(af, type, source, ssl_context=None, server_hostname=None): s = socket_factory(af, type) try: s.setblocking(False) if source is not None: s.bind(source) if ssl_context: # LGTM gets a false positive here, as our default context is OK return ssl_context.wrap_socket( s, do_handshake_on_connect=False, # lgtm[py/insecure-protocol] server_hostname=server_hostname, ) else: return s except Exception: s.close() raise def https( q: dns.message.Message, where: str, timeout: Optional[float] = None, port: int = 443, source: Optional[str] = None, source_port: int = 0, one_rr_per_rrset: bool = False, ignore_trailing: bool = False, session: Optional[Any] = None, path: str = "/dns-query", post: bool = True, bootstrap_address: Optional[str] = None, verify: Union[bool, str] = True, resolver: Optional["dns.resolver.Resolver"] = None, family: Optional[int] = socket.AF_UNSPEC, ) -> dns.message.Message: """Return the response obtained after sending a query via DNS-over-HTTPS. *q*, a ``dns.message.Message``, the query to send. *where*, a ``str``, the nameserver IP address or the full URL. If an IP address is given, the URL will be constructed using the following schema: https://<IP-address>:<port>/<path>. *timeout*, a ``float`` or ``None``, the number of seconds to wait before the query times out. If ``None``, the default, wait forever. *port*, a ``int``, the port to send the query to. The default is 443. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *session*, an ``httpx.Client``. If provided, the client session to use to send the queries. *path*, a ``str``. If *where* is an IP address, then *path* will be used to construct the URL to send the DNS query to. *post*, a ``bool``. If ``True``, the default, POST method will be used. *bootstrap_address*, a ``str``, the IP address to use to bypass resolution. *verify*, a ``bool`` or ``str``. If a ``True``, then TLS certificate verification of the server is done using the default CA bundle; if ``False``, then no verification is done; if a `str` then it specifies the path to a certificate file or directory which will be used for verification. *resolver*, a ``dns.resolver.Resolver`` or ``None``, the resolver to use for resolution of hostnames in URLs. If not specified, a new resolver with a default configuration will be used; note this is *not* the default resolver as that resolver might have been configured to use DoH causing a chicken-and-egg problem. This parameter only has an effect if the HTTP library is httpx. *family*, an ``int``, the address family. If socket.AF_UNSPEC (the default), both A and AAAA records will be retrieved. Returns a ``dns.message.Message``. """ if not have_doh: raise NoDOH # pragma: no cover if session and not isinstance(session, httpx.Client): raise ValueError("session parameter must be an httpx.Client") wire = q.to_wire() (af, _, the_source) = _destination_and_source( where, port, source, source_port, False ) transport = None headers = {"accept": "application/dns-message"} if af is not None and dns.inet.is_address(where): if af == socket.AF_INET: url = "https://{}:{}{}".format(where, port, path) elif af == socket.AF_INET6: url = "https://[{}]:{}{}".format(where, port, path) else: url = where # set source port and source address if the_source is None: local_address = None local_port = 0 else: local_address = the_source[0] local_port = the_source[1] transport = _HTTPTransport( local_address=local_address, http1=True, http2=True, verify=verify, local_port=local_port, bootstrap_address=bootstrap_address, resolver=resolver, family=family, ) if session: cm: contextlib.AbstractContextManager = contextlib.nullcontext(session) else: cm = httpx.Client(http1=True, http2=True, verify=verify, transport=transport) with cm as session: # see https://tools.ietf.org/html/rfc8484#section-4.1.1 for DoH # GET and POST examples if post: headers.update( { "content-type": "application/dns-message", "content-length": str(len(wire)), } ) response = session.post(url, headers=headers, content=wire, timeout=timeout) else: wire = base64.urlsafe_b64encode(wire).rstrip(b"=") twire = wire.decode() # httpx does a repr() if we give it bytes response = session.get( url, headers=headers, timeout=timeout, params={"dns": twire} ) # see https://tools.ietf.org/html/rfc8484#section-4.2.1 for info about DoH # status codes if response.status_code < 200 or response.status_code > 299: raise ValueError( "{} responded with status code {}" "\nResponse body: {}".format(where, response.status_code, response.content) ) r = dns.message.from_wire( response.content, keyring=q.keyring, request_mac=q.request_mac, one_rr_per_rrset=one_rr_per_rrset, ignore_trailing=ignore_trailing, ) r.time = response.elapsed.total_seconds() if not q.is_response(r): raise BadResponse return r def _udp_recv(sock, max_size, expiration): """Reads a datagram from the socket. A Timeout exception will be raised if the operation is not completed by the expiration time. """ while True: try: return sock.recvfrom(max_size) except BlockingIOError: _wait_for_readable(sock, expiration) def _udp_send(sock, data, destination, expiration): """Sends the specified datagram to destination over the socket. A Timeout exception will be raised if the operation is not completed by the expiration time. """ while True: try: if destination: return sock.sendto(data, destination) else: return sock.send(data) except BlockingIOError: # pragma: no cover _wait_for_writable(sock, expiration) def send_udp( sock: Any, what: Union[dns.message.Message, bytes], destination: Any, expiration: Optional[float] = None, ) -> Tuple[int, float]: """Send a DNS message to the specified UDP socket. *sock*, a ``socket``. *what*, a ``bytes`` or ``dns.message.Message``, the message to send. *destination*, a destination tuple appropriate for the address family of the socket, specifying where to send the query. *expiration*, a ``float`` or ``None``, the absolute time at which a timeout exception should be raised. If ``None``, no timeout will occur. Returns an ``(int, float)`` tuple of bytes sent and the sent time. """ if isinstance(what, dns.message.Message): what = what.to_wire() sent_time = time.time() n = _udp_send(sock, what, destination, expiration) return (n, sent_time) def receive_udp( sock: Any, destination: Optional[Any] = None, expiration: Optional[float] = None, ignore_unexpected: bool = False, one_rr_per_rrset: bool = False, keyring: Optional[Dict[dns.name.Name, dns.tsig.Key]] = None, request_mac: Optional[bytes] = b"", ignore_trailing: bool = False, raise_on_truncation: bool = False, ignore_errors: bool = False, query: Optional[dns.message.Message] = None, ) -> Any: """Read a DNS message from a UDP socket. *sock*, a ``socket``. *destination*, a destination tuple appropriate for the address family of the socket, specifying where the message is expected to arrive from. When receiving a response, this would be where the associated query was sent. *expiration*, a ``float`` or ``None``, the absolute time at which a timeout exception should be raised. If ``None``, no timeout will occur. *ignore_unexpected*, a ``bool``. If ``True``, ignore responses from unexpected sources. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *keyring*, a ``dict``, the keyring to use for TSIG. *request_mac*, a ``bytes`` or ``None``, the MAC of the request (for TSIG). *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *raise_on_truncation*, a ``bool``. If ``True``, raise an exception if the TC bit is set. Raises if the message is malformed, if network errors occur, of if there is a timeout. If *destination* is not ``None``, returns a ``(dns.message.Message, float)`` tuple of the received message and the received time. If *destination* is ``None``, returns a ``(dns.message.Message, float, tuple)`` tuple of the received message, the received time, and the address where the message arrived from. *ignore_errors*, a ``bool``. If various format errors or response mismatches occur, ignore them and keep listening for a valid response. The default is ``False``. *query*, a ``dns.message.Message`` or ``None``. If not ``None`` and *ignore_errors* is ``True``, check that the received message is a response to this query, and if not keep listening for a valid response. """ wire = b"" while True: (wire, from_address) = _udp_recv(sock, 65535, expiration) if not _matches_destination( sock.family, from_address, destination, ignore_unexpected ): continue received_time = time.time() try: r = dns.message.from_wire( wire, keyring=keyring, request_mac=request_mac, one_rr_per_rrset=one_rr_per_rrset, ignore_trailing=ignore_trailing, raise_on_truncation=raise_on_truncation, ) except dns.message.Truncated as e: # If we got Truncated and not FORMERR, we at least got the header with TC # set, and very likely the question section, so we'll re-raise if the # message seems to be a response as we need to know when truncation happens. # We need to check that it seems to be a response as we don't want a random # injected message with TC set to cause us to bail out. if ( ignore_errors and query is not None and not query.is_response(e.message()) ): continue else: raise except Exception: if ignore_errors: continue else: raise if ignore_errors and query is not None and not query.is_response(r): continue if destination: return (r, received_time) else: return (r, received_time, from_address) def udp( q: dns.message.Message, where: str, timeout: Optional[float] = None, port: int = 53, source: Optional[str] = None, source_port: int = 0, ignore_unexpected: bool = False, one_rr_per_rrset: bool = False, ignore_trailing: bool = False, raise_on_truncation: bool = False, sock: Optional[Any] = None, ignore_errors: bool = False, ) -> dns.message.Message: """Return the response obtained after sending a query via UDP. *q*, a ``dns.message.Message``, the query to send *where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message. *timeout*, a ``float`` or ``None``, the number of seconds to wait before the query times out. If ``None``, the default, wait forever. *port*, an ``int``, the port send the message to. The default is 53. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *ignore_unexpected*, a ``bool``. If ``True``, ignore responses from unexpected sources. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *raise_on_truncation*, a ``bool``. If ``True``, raise an exception if the TC bit is set. *sock*, a ``socket.socket``, or ``None``, the socket to use for the query. If ``None``, the default, a socket is created. Note that if a socket is provided, it must be a nonblocking datagram socket, and the *source* and *source_port* are ignored. *ignore_errors*, a ``bool``. If various format errors or response mismatches occur, ignore them and keep listening for a valid response. The default is ``False``. Returns a ``dns.message.Message``. """ wire = q.to_wire() (af, destination, source) = _destination_and_source( where, port, source, source_port ) (begin_time, expiration) = _compute_times(timeout) if sock: cm: contextlib.AbstractContextManager = contextlib.nullcontext(sock) else: cm = _make_socket(af, socket.SOCK_DGRAM, source) with cm as s: send_udp(s, wire, destination, expiration) (r, received_time) = receive_udp( s, destination, expiration, ignore_unexpected, one_rr_per_rrset, q.keyring, q.mac, ignore_trailing, raise_on_truncation, ignore_errors, q, ) r.time = received_time - begin_time # We don't need to check q.is_response() if we are in ignore_errors mode # as receive_udp() will have checked it. if not (ignore_errors or q.is_response(r)): raise BadResponse return r assert ( False # help mypy figure out we can't get here lgtm[py/unreachable-statement] ) def udp_with_fallback( q: dns.message.Message, where: str, timeout: Optional[float] = None, port: int = 53, source: Optional[str] = None, source_port: int = 0, ignore_unexpected: bool = False, one_rr_per_rrset: bool = False, ignore_trailing: bool = False, udp_sock: Optional[Any] = None, tcp_sock: Optional[Any] = None, ignore_errors: bool = False, ) -> Tuple[dns.message.Message, bool]: """Return the response to the query, trying UDP first and falling back to TCP if UDP results in a truncated response. *q*, a ``dns.message.Message``, the query to send *where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message. *timeout*, a ``float`` or ``None``, the number of seconds to wait before the query times out. If ``None``, the default, wait forever. *port*, an ``int``, the port send the message to. The default is 53. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *ignore_unexpected*, a ``bool``. If ``True``, ignore responses from unexpected sources. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *udp_sock*, a ``socket.socket``, or ``None``, the socket to use for the UDP query. If ``None``, the default, a socket is created. Note that if a socket is provided, it must be a nonblocking datagram socket, and the *source* and *source_port* are ignored for the UDP query. *tcp_sock*, a ``socket.socket``, or ``None``, the connected socket to use for the TCP query. If ``None``, the default, a socket is created. Note that if a socket is provided, it must be a nonblocking connected stream socket, and *where*, *source* and *source_port* are ignored for the TCP query. *ignore_errors*, a ``bool``. If various format errors or response mismatches occur while listening for UDP, ignore them and keep listening for a valid response. The default is ``False``. Returns a (``dns.message.Message``, tcp) tuple where tcp is ``True`` if and only if TCP was used. """ try: response = udp( q, where, timeout, port, source, source_port, ignore_unexpected, one_rr_per_rrset, ignore_trailing, True, udp_sock, ignore_errors, ) return (response, False) except dns.message.Truncated: response = tcp( q, where, timeout, port, source, source_port, one_rr_per_rrset, ignore_trailing, tcp_sock, ) return (response, True) def _net_read(sock, count, expiration): """Read the specified number of bytes from sock. Keep trying until we either get the desired amount, or we hit EOF. A Timeout exception will be raised if the operation is not completed by the expiration time. """ s = b"" while count > 0: try: n = sock.recv(count) if n == b"": raise EOFError count -= len(n) s += n except (BlockingIOError, ssl.SSLWantReadError): _wait_for_readable(sock, expiration) except ssl.SSLWantWriteError: # pragma: no cover _wait_for_writable(sock, expiration) return s def _net_write(sock, data, expiration): """Write the specified data to the socket. A Timeout exception will be raised if the operation is not completed by the expiration time. """ current = 0 l = len(data) while current < l: try: current += sock.send(data[current:]) except (BlockingIOError, ssl.SSLWantWriteError): _wait_for_writable(sock, expiration) except ssl.SSLWantReadError: # pragma: no cover _wait_for_readable(sock, expiration) def send_tcp( sock: Any, what: Union[dns.message.Message, bytes], expiration: Optional[float] = None, ) -> Tuple[int, float]: """Send a DNS message to the specified TCP socket. *sock*, a ``socket``. *what*, a ``bytes`` or ``dns.message.Message``, the message to send. *expiration*, a ``float`` or ``None``, the absolute time at which a timeout exception should be raised. If ``None``, no timeout will occur. Returns an ``(int, float)`` tuple of bytes sent and the sent time. """ if isinstance(what, dns.message.Message): tcpmsg = what.to_wire(prepend_length=True) else: # copying the wire into tcpmsg is inefficient, but lets us # avoid writev() or doing a short write that would get pushed # onto the net tcpmsg = len(what).to_bytes(2, "big") + what sent_time = time.time() _net_write(sock, tcpmsg, expiration) return (len(tcpmsg), sent_time) def receive_tcp( sock: Any, expiration: Optional[float] = None, one_rr_per_rrset: bool = False, keyring: Optional[Dict[dns.name.Name, dns.tsig.Key]] = None, request_mac: Optional[bytes] = b"", ignore_trailing: bool = False, ) -> Tuple[dns.message.Message, float]: """Read a DNS message from a TCP socket. *sock*, a ``socket``. *expiration*, a ``float`` or ``None``, the absolute time at which a timeout exception should be raised. If ``None``, no timeout will occur. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *keyring*, a ``dict``, the keyring to use for TSIG. *request_mac*, a ``bytes`` or ``None``, the MAC of the request (for TSIG). *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. Raises if the message is malformed, if network errors occur, of if there is a timeout. Returns a ``(dns.message.Message, float)`` tuple of the received message and the received time. """ ldata = _net_read(sock, 2, expiration) (l,) = struct.unpack("!H", ldata) wire = _net_read(sock, l, expiration) received_time = time.time() r = dns.message.from_wire( wire, keyring=keyring, request_mac=request_mac, one_rr_per_rrset=one_rr_per_rrset, ignore_trailing=ignore_trailing, ) return (r, received_time) def _connect(s, address, expiration): err = s.connect_ex(address) if err == 0: return if err in (errno.EINPROGRESS, errno.EWOULDBLOCK, errno.EALREADY): _wait_for_writable(s, expiration) err = s.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR) if err != 0: raise OSError(err, os.strerror(err)) def tcp( q: dns.message.Message, where: str, timeout: Optional[float] = None, port: int = 53, source: Optional[str] = None, source_port: int = 0, one_rr_per_rrset: bool = False, ignore_trailing: bool = False, sock: Optional[Any] = None, ) -> dns.message.Message: """Return the response obtained after sending a query via TCP. *q*, a ``dns.message.Message``, the query to send *where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message. *timeout*, a ``float`` or ``None``, the number of seconds to wait before the query times out. If ``None``, the default, wait forever. *port*, an ``int``, the port send the message to. The default is 53. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *sock*, a ``socket.socket``, or ``None``, the connected socket to use for the query. If ``None``, the default, a socket is created. Note that if a socket is provided, it must be a nonblocking connected stream socket, and *where*, *port*, *source* and *source_port* are ignored. Returns a ``dns.message.Message``. """ wire = q.to_wire() (begin_time, expiration) = _compute_times(timeout) if sock: cm: contextlib.AbstractContextManager = contextlib.nullcontext(sock) else: (af, destination, source) = _destination_and_source( where, port, source, source_port ) cm = _make_socket(af, socket.SOCK_STREAM, source) with cm as s: if not sock: _connect(s, destination, expiration) send_tcp(s, wire, expiration) (r, received_time) = receive_tcp( s, expiration, one_rr_per_rrset, q.keyring, q.mac, ignore_trailing ) r.time = received_time - begin_time if not q.is_response(r): raise BadResponse return r assert ( False # help mypy figure out we can't get here lgtm[py/unreachable-statement] ) def _tls_handshake(s, expiration): while True: try: s.do_handshake() return except ssl.SSLWantReadError: _wait_for_readable(s, expiration) except ssl.SSLWantWriteError: # pragma: no cover _wait_for_writable(s, expiration) def _make_dot_ssl_context( server_hostname: Optional[str], verify: Union[bool, str] ) -> ssl.SSLContext: cafile: Optional[str] = None capath: Optional[str] = None if isinstance(verify, str): if os.path.isfile(verify): cafile = verify elif os.path.isdir(verify): capath = verify else: raise ValueError("invalid verify string") ssl_context = ssl.create_default_context(cafile=cafile, capath=capath) ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2 if server_hostname is None: ssl_context.check_hostname = False ssl_context.set_alpn_protocols(["dot"]) if verify is False: ssl_context.verify_mode = ssl.CERT_NONE return ssl_context def tls( q: dns.message.Message, where: str, timeout: Optional[float] = None, port: int = 853, source: Optional[str] = None, source_port: int = 0, one_rr_per_rrset: bool = False, ignore_trailing: bool = False, sock: Optional[ssl.SSLSocket] = None, ssl_context: Optional[ssl.SSLContext] = None, server_hostname: Optional[str] = None, verify: Union[bool, str] = True, ) -> dns.message.Message: """Return the response obtained after sending a query via TLS. *q*, a ``dns.message.Message``, the query to send *where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message. *timeout*, a ``float`` or ``None``, the number of seconds to wait before the query times out. If ``None``, the default, wait forever. *port*, an ``int``, the port send the message to. The default is 853. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *sock*, an ``ssl.SSLSocket``, or ``None``, the socket to use for the query. If ``None``, the default, a socket is created. Note that if a socket is provided, it must be a nonblocking connected SSL stream socket, and *where*, *port*, *source*, *source_port*, and *ssl_context* are ignored. *ssl_context*, an ``ssl.SSLContext``, the context to use when establishing a TLS connection. If ``None``, the default, creates one with the default configuration. *server_hostname*, a ``str`` containing the server's hostname. The default is ``None``, which means that no hostname is known, and if an SSL context is created, hostname checking will be disabled. *verify*, a ``bool`` or ``str``. If a ``True``, then TLS certificate verification of the server is done using the default CA bundle; if ``False``, then no verification is done; if a `str` then it specifies the path to a certificate file or directory which will be used for verification. Returns a ``dns.message.Message``. """ if sock: # # If a socket was provided, there's no special TLS handling needed. # return tcp( q, where, timeout, port, source, source_port, one_rr_per_rrset, ignore_trailing, sock, ) wire = q.to_wire() (begin_time, expiration) = _compute_times(timeout) (af, destination, source) = _destination_and_source( where, port, source, source_port ) if ssl_context is None and not sock: ssl_context = _make_dot_ssl_context(server_hostname, verify) with _make_socket( af, socket.SOCK_STREAM, source, ssl_context=ssl_context, server_hostname=server_hostname, ) as s: _connect(s, destination, expiration) _tls_handshake(s, expiration) send_tcp(s, wire, expiration) (r, received_time) = receive_tcp( s, expiration, one_rr_per_rrset, q.keyring, q.mac, ignore_trailing ) r.time = received_time - begin_time if not q.is_response(r): raise BadResponse return r assert ( False # help mypy figure out we can't get here lgtm[py/unreachable-statement] ) def quic( q: dns.message.Message, where: str, timeout: Optional[float] = None, port: int = 853, source: Optional[str] = None, source_port: int = 0, one_rr_per_rrset: bool = False, ignore_trailing: bool = False, connection: Optional[dns.quic.SyncQuicConnection] = None, verify: Union[bool, str] = True, server_hostname: Optional[str] = None, ) -> dns.message.Message: """Return the response obtained after sending a query via DNS-over-QUIC. *q*, a ``dns.message.Message``, the query to send. *where*, a ``str``, the nameserver IP address. *timeout*, a ``float`` or ``None``, the number of seconds to wait before the query times out. If ``None``, the default, wait forever. *port*, a ``int``, the port to send the query to. The default is 853. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset. *ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the received message. *connection*, a ``dns.quic.SyncQuicConnection``. If provided, the connection to use to send the query. *verify*, a ``bool`` or ``str``. If a ``True``, then TLS certificate verification of the server is done using the default CA bundle; if ``False``, then no verification is done; if a `str` then it specifies the path to a certificate file or directory which will be used for verification. *server_hostname*, a ``str`` containing the server's hostname. The default is ``None``, which means that no hostname is known, and if an SSL context is created, hostname checking will be disabled. Returns a ``dns.message.Message``. """ if not dns.quic.have_quic: raise NoDOQ("DNS-over-QUIC is not available.") # pragma: no cover q.id = 0 wire = q.to_wire() the_connection: dns.quic.SyncQuicConnection the_manager: dns.quic.SyncQuicManager if connection: manager: contextlib.AbstractContextManager = contextlib.nullcontext(None) the_connection = connection else: manager = dns.quic.SyncQuicManager( verify_mode=verify, server_name=server_hostname ) the_manager = manager # for type checking happiness with manager: if not connection: the_connection = the_manager.connect(where, port, source, source_port) (start, expiration) = _compute_times(timeout) with the_connection.make_stream(timeout) as stream: stream.send(wire, True) wire = stream.receive(_remaining(expiration)) finish = time.time() r = dns.message.from_wire( wire, keyring=q.keyring, request_mac=q.request_mac, one_rr_per_rrset=one_rr_per_rrset, ignore_trailing=ignore_trailing, ) r.time = max(finish - start, 0.0) if not q.is_response(r): raise BadResponse return r def xfr( where: str, zone: Union[dns.name.Name, str], rdtype: Union[dns.rdatatype.RdataType, str] = dns.rdatatype.AXFR, rdclass: Union[dns.rdataclass.RdataClass, str] = dns.rdataclass.IN, timeout: Optional[float] = None, port: int = 53, keyring: Optional[Dict[dns.name.Name, dns.tsig.Key]] = None, keyname: Optional[Union[dns.name.Name, str]] = None, relativize: bool = True, lifetime: Optional[float] = None, source: Optional[str] = None, source_port: int = 0, serial: int = 0, use_udp: bool = False, keyalgorithm: Union[dns.name.Name, str] = dns.tsig.default_algorithm, ) -> Any: """Return a generator for the responses to a zone transfer. *where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message. *zone*, a ``dns.name.Name`` or ``str``, the name of the zone to transfer. *rdtype*, an ``int`` or ``str``, the type of zone transfer. The default is ``dns.rdatatype.AXFR``. ``dns.rdatatype.IXFR`` can be used to do an incremental transfer instead. *rdclass*, an ``int`` or ``str``, the class of the zone transfer. The default is ``dns.rdataclass.IN``. *timeout*, a ``float``, the number of seconds to wait for each response message. If None, the default, wait forever. *port*, an ``int``, the port send the message to. The default is 53. *keyring*, a ``dict``, the keyring to use for TSIG. *keyname*, a ``dns.name.Name`` or ``str``, the name of the TSIG key to use. *relativize*, a ``bool``. If ``True``, all names in the zone will be relativized to the zone origin. It is essential that the relativize setting matches the one specified to ``dns.zone.from_xfr()`` if using this generator to make a zone. *lifetime*, a ``float``, the total number of seconds to spend doing the transfer. If ``None``, the default, then there is no limit on the time the transfer may take. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *serial*, an ``int``, the SOA serial number to use as the base for an IXFR diff sequence (only meaningful if *rdtype* is ``dns.rdatatype.IXFR``). *use_udp*, a ``bool``. If ``True``, use UDP (only meaningful for IXFR). *keyalgorithm*, a ``dns.name.Name`` or ``str``, the TSIG algorithm to use. Raises on errors, and so does the generator. Returns a generator of ``dns.message.Message`` objects. """ if isinstance(zone, str): zone = dns.name.from_text(zone) rdtype = dns.rdatatype.RdataType.make(rdtype) q = dns.message.make_query(zone, rdtype, rdclass) if rdtype == dns.rdatatype.IXFR: rrset = dns.rrset.from_text(zone, 0, "IN", "SOA", ". . %u 0 0 0 0" % serial) q.authority.append(rrset) if keyring is not None: q.use_tsig(keyring, keyname, algorithm=keyalgorithm) wire = q.to_wire() (af, destination, source) = _destination_and_source( where, port, source, source_port ) if use_udp and rdtype != dns.rdatatype.IXFR: raise ValueError("cannot do a UDP AXFR") sock_type = socket.SOCK_DGRAM if use_udp else socket.SOCK_STREAM with _make_socket(af, sock_type, source) as s: (_, expiration) = _compute_times(lifetime) _connect(s, destination, expiration) l = len(wire) if use_udp: _udp_send(s, wire, None, expiration) else: tcpmsg = struct.pack("!H", l) + wire _net_write(s, tcpmsg, expiration) done = False delete_mode = True expecting_SOA = False soa_rrset = None if relativize: origin = zone oname = dns.name.empty else: origin = None oname = zone tsig_ctx = None while not done: (_, mexpiration) = _compute_times(timeout) if mexpiration is None or ( expiration is not None and mexpiration > expiration ): mexpiration = expiration if use_udp: (wire, _) = _udp_recv(s, 65535, mexpiration) else: ldata = _net_read(s, 2, mexpiration) (l,) = struct.unpack("!H", ldata) wire = _net_read(s, l, mexpiration) is_ixfr = rdtype == dns.rdatatype.IXFR r = dns.message.from_wire( wire, keyring=q.keyring, request_mac=q.mac, xfr=True, origin=origin, tsig_ctx=tsig_ctx, multi=True, one_rr_per_rrset=is_ixfr, ) rcode = r.rcode() if rcode != dns.rcode.NOERROR: raise TransferError(rcode) tsig_ctx = r.tsig_ctx answer_index = 0 if soa_rrset is None: if not r.answer or r.answer[0].name != oname: raise dns.exception.FormError("No answer or RRset not for qname") rrset = r.answer[0] if rrset.rdtype != dns.rdatatype.SOA: raise dns.exception.FormError("first RRset is not an SOA") answer_index = 1 soa_rrset = rrset.copy() if rdtype == dns.rdatatype.IXFR: if dns.serial.Serial(soa_rrset[0].serial) <= serial: # # We're already up-to-date. # done = True else: expecting_SOA = True # # Process SOAs in the answer section (other than the initial # SOA in the first message). # for rrset in r.answer[answer_index:]: if done: raise dns.exception.FormError("answers after final SOA") if rrset.rdtype == dns.rdatatype.SOA and rrset.name == oname: if expecting_SOA: if rrset[0].serial != serial: raise dns.exception.FormError("IXFR base serial mismatch") expecting_SOA = False elif rdtype == dns.rdatatype.IXFR: delete_mode = not delete_mode # # If this SOA RRset is equal to the first we saw then we're # finished. If this is an IXFR we also check that we're # seeing the record in the expected part of the response. # if rrset == soa_rrset and ( rdtype == dns.rdatatype.AXFR or (rdtype == dns.rdatatype.IXFR and delete_mode) ): done = True elif expecting_SOA: # # We made an IXFR request and are expecting another # SOA RR, but saw something else, so this must be an # AXFR response. # rdtype = dns.rdatatype.AXFR expecting_SOA = False if done and q.keyring and not r.had_tsig: raise dns.exception.FormError("missing TSIG") yield r class UDPMode(enum.IntEnum): """How should UDP be used in an IXFR from :py:func:`inbound_xfr()`? NEVER means "never use UDP; always use TCP" TRY_FIRST means "try to use UDP but fall back to TCP if needed" ONLY means "raise ``dns.xfr.UseTCP`` if trying UDP does not succeed" """ NEVER = 0 TRY_FIRST = 1 ONLY = 2 def inbound_xfr( where: str, txn_manager: dns.transaction.TransactionManager, query: Optional[dns.message.Message] = None, port: int = 53, timeout: Optional[float] = None, lifetime: Optional[float] = None, source: Optional[str] = None, source_port: int = 0, udp_mode: UDPMode = UDPMode.NEVER, ) -> None: """Conduct an inbound transfer and apply it via a transaction from the txn_manager. *where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message. *txn_manager*, a ``dns.transaction.TransactionManager``, the txn_manager for this transfer (typically a ``dns.zone.Zone``). *query*, the query to send. If not supplied, a default query is constructed using information from the *txn_manager*. *port*, an ``int``, the port send the message to. The default is 53. *timeout*, a ``float``, the number of seconds to wait for each response message. If None, the default, wait forever. *lifetime*, a ``float``, the total number of seconds to spend doing the transfer. If ``None``, the default, then there is no limit on the time the transfer may take. *source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source address. The default is the wildcard address. *source_port*, an ``int``, the port from which to send the message. The default is 0. *udp_mode*, a ``dns.query.UDPMode``, determines how UDP is used for IXFRs. The default is ``dns.UDPMode.NEVER``, i.e. only use TCP. Other possibilities are ``dns.UDPMode.TRY_FIRST``, which means "try UDP but fallback to TCP if needed", and ``dns.UDPMode.ONLY``, which means "try UDP and raise ``dns.xfr.UseTCP`` if it does not succeed. Raises on errors. """ if query is None: (query, serial) = dns.xfr.make_query(txn_manager) else: serial = dns.xfr.extract_serial_from_query(query) rdtype = query.question[0].rdtype is_ixfr = rdtype == dns.rdatatype.IXFR origin = txn_manager.from_wire_origin() wire = query.to_wire() (af, destination, source) = _destination_and_source( where, port, source, source_port ) (_, expiration) = _compute_times(lifetime) retry = True while retry: retry = False if is_ixfr and udp_mode != UDPMode.NEVER: sock_type = socket.SOCK_DGRAM is_udp = True else: sock_type = socket.SOCK_STREAM is_udp = False with _make_socket(af, sock_type, source) as s: _connect(s, destination, expiration) if is_udp: _udp_send(s, wire, None, expiration) else: tcpmsg = struct.pack("!H", len(wire)) + wire _net_write(s, tcpmsg, expiration) with dns.xfr.Inbound(txn_manager, rdtype, serial, is_udp) as inbound: done = False tsig_ctx = None while not done: (_, mexpiration) = _compute_times(timeout) if mexpiration is None or ( expiration is not None and mexpiration > expiration ): mexpiration = expiration if is_udp: (rwire, _) = _udp_recv(s, 65535, mexpiration) else: ldata = _net_read(s, 2, mexpiration) (l,) = struct.unpack("!H", ldata) rwire = _net_read(s, l, mexpiration) r = dns.message.from_wire( rwire, keyring=query.keyring, request_mac=query.mac, xfr=True, origin=origin, tsig_ctx=tsig_ctx, multi=(not is_udp), one_rr_per_rrset=is_ixfr, ) try: done = inbound.process_message(r) except dns.xfr.UseTCP: assert is_udp # should not happen if we used TCP! if udp_mode == UDPMode.ONLY: raise done = True retry = True udp_mode = UDPMode.NEVER continue tsig_ctx = r.tsig_ctx if not retry and query.keyring and not r.had_tsig: raise dns.exception.FormError("missing TSIG") PK M�[G�-�m m ! __pycache__/grange.cpython-39.pycnu �[��� a �M�ed � @ s6 d Z ddlmZ ddlZeeeeef d�dd�ZdS )zDNS GENERATE range conversion.� )�TupleN)�text�returnc C s d}d}d}d}d}| r0| d dkr0t j�d��| D ]b}|dkrZ|dkrZt|�}d}d}q4|dkrtt|�}d}d}q4|�� r�||7 }q4t j�d | ��q4|dkr�t j�d ��n&|dkr�t|�}n|dks�J �t|�}|dks�J �|dks�J �||k�rt j�d��|||fS )z�Convert the text form of a range in a ``$GENERATE`` statement to an integer. *text*, a ``str``, the textual range in ``$GENERATE`` form. Returns a tuple of three ``int`` values ``(start, stop, step)``. ���� � r �-z!Start cannot be a negative number�/� zCould not parse %szno stop value specifiedzstart must be <= stop)�dns� exception�SyntaxError�int�isdigit)r �start�stop�stepZcur�state�c� r �./usr/lib/python3.9/site-packages/dns/grange.py� from_text s<