9bbeb35c08
Fixed an issue that prevented the password reset tokens from working. Added email templates for password reset success and new account creation. Added more dynamic email template support.
1578 lines
54 KiB
Python
1578 lines
54 KiB
Python
# Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license
|
|
|
|
# Copyright (C) 2003-2017 Nominum, Inc.
|
|
#
|
|
# Permission to use, copy, modify, and distribute this software and its
|
|
# documentation for any purpose with or without fee is hereby granted,
|
|
# provided that the above copyright notice and this permission notice
|
|
# appear in all copies.
|
|
#
|
|
# THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES
|
|
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR
|
|
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
|
|
# OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
"""Talk to a DNS server."""
|
|
|
|
import base64
|
|
import contextlib
|
|
import enum
|
|
import errno
|
|
import os
|
|
import os.path
|
|
import selectors
|
|
import socket
|
|
import struct
|
|
import time
|
|
from typing import Any, Dict, Optional, Tuple, Union
|
|
|
|
import dns._features
|
|
import dns.exception
|
|
import dns.inet
|
|
import dns.message
|
|
import dns.name
|
|
import dns.quic
|
|
import dns.rcode
|
|
import dns.rdataclass
|
|
import dns.rdatatype
|
|
import dns.serial
|
|
import dns.transaction
|
|
import dns.tsig
|
|
import dns.xfr
|
|
|
|
|
|
def _remaining(expiration):
|
|
if expiration is None:
|
|
return None
|
|
timeout = expiration - time.time()
|
|
if timeout <= 0.0:
|
|
raise dns.exception.Timeout
|
|
return timeout
|
|
|
|
|
|
def _expiration_for_this_attempt(timeout, expiration):
|
|
if expiration is None:
|
|
return None
|
|
return min(time.time() + timeout, expiration)
|
|
|
|
|
|
_have_httpx = dns._features.have("doh")
|
|
if _have_httpx:
|
|
import httpcore._backends.sync
|
|
import httpx
|
|
|
|
_CoreNetworkBackend = httpcore.NetworkBackend
|
|
_CoreSyncStream = httpcore._backends.sync.SyncStream
|
|
|
|
class _NetworkBackend(_CoreNetworkBackend):
|
|
def __init__(self, resolver, local_port, bootstrap_address, family):
|
|
super().__init__()
|
|
self._local_port = local_port
|
|
self._resolver = resolver
|
|
self._bootstrap_address = bootstrap_address
|
|
self._family = family
|
|
|
|
def connect_tcp(
|
|
self, host, port, timeout, local_address, socket_options=None
|
|
): # pylint: disable=signature-differs
|
|
addresses = []
|
|
_, expiration = _compute_times(timeout)
|
|
if dns.inet.is_address(host):
|
|
addresses.append(host)
|
|
elif self._bootstrap_address is not None:
|
|
addresses.append(self._bootstrap_address)
|
|
else:
|
|
timeout = _remaining(expiration)
|
|
family = self._family
|
|
if local_address:
|
|
family = dns.inet.af_for_address(local_address)
|
|
answers = self._resolver.resolve_name(
|
|
host, family=family, lifetime=timeout
|
|
)
|
|
addresses = answers.addresses()
|
|
for address in addresses:
|
|
af = dns.inet.af_for_address(address)
|
|
if local_address is not None or self._local_port != 0:
|
|
source = dns.inet.low_level_address_tuple(
|
|
(local_address, self._local_port), af
|
|
)
|
|
else:
|
|
source = None
|
|
sock = _make_socket(af, socket.SOCK_STREAM, source)
|
|
attempt_expiration = _expiration_for_this_attempt(2.0, expiration)
|
|
try:
|
|
_connect(
|
|
sock,
|
|
dns.inet.low_level_address_tuple((address, port), af),
|
|
attempt_expiration,
|
|
)
|
|
return _CoreSyncStream(sock)
|
|
except Exception:
|
|
pass
|
|
raise httpcore.ConnectError
|
|
|
|
def connect_unix_socket(
|
|
self, path, timeout, socket_options=None
|
|
): # pylint: disable=signature-differs
|
|
raise NotImplementedError
|
|
|
|
class _HTTPTransport(httpx.HTTPTransport):
|
|
def __init__(
|
|
self,
|
|
*args,
|
|
local_port=0,
|
|
bootstrap_address=None,
|
|
resolver=None,
|
|
family=socket.AF_UNSPEC,
|
|
**kwargs,
|
|
):
|
|
if resolver is None:
|
|
# pylint: disable=import-outside-toplevel,redefined-outer-name
|
|
import dns.resolver
|
|
|
|
resolver = dns.resolver.Resolver()
|
|
super().__init__(*args, **kwargs)
|
|
self._pool._network_backend = _NetworkBackend(
|
|
resolver, local_port, bootstrap_address, family
|
|
)
|
|
|
|
else:
|
|
|
|
class _HTTPTransport: # type: ignore
|
|
def connect_tcp(self, host, port, timeout, local_address):
|
|
raise NotImplementedError
|
|
|
|
|
|
have_doh = _have_httpx
|
|
|
|
try:
|
|
import ssl
|
|
except ImportError: # pragma: no cover
|
|
|
|
class ssl: # type: ignore
|
|
CERT_NONE = 0
|
|
|
|
class WantReadException(Exception):
|
|
pass
|
|
|
|
class WantWriteException(Exception):
|
|
pass
|
|
|
|
class SSLContext:
|
|
pass
|
|
|
|
class SSLSocket:
|
|
pass
|
|
|
|
@classmethod
|
|
def create_default_context(cls, *args, **kwargs):
|
|
raise Exception("no ssl support") # pylint: disable=broad-exception-raised
|
|
|
|
|
|
# Function used to create a socket. Can be overridden if needed in special
|
|
# situations.
|
|
socket_factory = socket.socket
|
|
|
|
|
|
class UnexpectedSource(dns.exception.DNSException):
|
|
"""A DNS query response came from an unexpected address or port."""
|
|
|
|
|
|
class BadResponse(dns.exception.FormError):
|
|
"""A DNS query response does not respond to the question asked."""
|
|
|
|
|
|
class NoDOH(dns.exception.DNSException):
|
|
"""DNS over HTTPS (DOH) was requested but the httpx module is not
|
|
available."""
|
|
|
|
|
|
class NoDOQ(dns.exception.DNSException):
|
|
"""DNS over QUIC (DOQ) was requested but the aioquic module is not
|
|
available."""
|
|
|
|
|
|
# for backwards compatibility
|
|
TransferError = dns.xfr.TransferError
|
|
|
|
|
|
def _compute_times(timeout):
|
|
now = time.time()
|
|
if timeout is None:
|
|
return (now, None)
|
|
else:
|
|
return (now, now + timeout)
|
|
|
|
|
|
def _wait_for(fd, readable, writable, _, expiration):
|
|
# Use the selected selector class to wait for any of the specified
|
|
# events. An "expiration" absolute time is converted into a relative
|
|
# timeout.
|
|
#
|
|
# The unused parameter is 'error', which is always set when
|
|
# selecting for read or write, and we have no error-only selects.
|
|
|
|
if readable and isinstance(fd, ssl.SSLSocket) and fd.pending() > 0:
|
|
return True
|
|
sel = _selector_class()
|
|
events = 0
|
|
if readable:
|
|
events |= selectors.EVENT_READ
|
|
if writable:
|
|
events |= selectors.EVENT_WRITE
|
|
if events:
|
|
sel.register(fd, events)
|
|
if expiration is None:
|
|
timeout = None
|
|
else:
|
|
timeout = expiration - time.time()
|
|
if timeout <= 0.0:
|
|
raise dns.exception.Timeout
|
|
if not sel.select(timeout):
|
|
raise dns.exception.Timeout
|
|
|
|
|
|
def _set_selector_class(selector_class):
|
|
# Internal API. Do not use.
|
|
|
|
global _selector_class
|
|
|
|
_selector_class = selector_class
|
|
|
|
|
|
if hasattr(selectors, "PollSelector"):
|
|
# Prefer poll() on platforms that support it because it has no
|
|
# limits on the maximum value of a file descriptor (plus it will
|
|
# be more efficient for high values).
|
|
#
|
|
# We ignore typing here as we can't say _selector_class is Any
|
|
# on python < 3.8 due to a bug.
|
|
_selector_class = selectors.PollSelector # type: ignore
|
|
else:
|
|
_selector_class = selectors.SelectSelector # type: ignore
|
|
|
|
|
|
def _wait_for_readable(s, expiration):
|
|
_wait_for(s, True, False, True, expiration)
|
|
|
|
|
|
def _wait_for_writable(s, expiration):
|
|
_wait_for(s, False, True, True, expiration)
|
|
|
|
|
|
def _addresses_equal(af, a1, a2):
|
|
# Convert the first value of the tuple, which is a textual format
|
|
# address into binary form, so that we are not confused by different
|
|
# textual representations of the same address
|
|
try:
|
|
n1 = dns.inet.inet_pton(af, a1[0])
|
|
n2 = dns.inet.inet_pton(af, a2[0])
|
|
except dns.exception.SyntaxError:
|
|
return False
|
|
return n1 == n2 and a1[1:] == a2[1:]
|
|
|
|
|
|
def _matches_destination(af, from_address, destination, ignore_unexpected):
|
|
# Check that from_address is appropriate for a response to a query
|
|
# sent to destination.
|
|
if not destination:
|
|
return True
|
|
if _addresses_equal(af, from_address, destination) or (
|
|
dns.inet.is_multicast(destination[0]) and from_address[1:] == destination[1:]
|
|
):
|
|
return True
|
|
elif ignore_unexpected:
|
|
return False
|
|
raise UnexpectedSource(
|
|
f"got a response from {from_address} instead of " f"{destination}"
|
|
)
|
|
|
|
|
|
def _destination_and_source(
|
|
where, port, source, source_port, where_must_be_address=True
|
|
):
|
|
# Apply defaults and compute destination and source tuples
|
|
# suitable for use in connect(), sendto(), or bind().
|
|
af = None
|
|
destination = None
|
|
try:
|
|
af = dns.inet.af_for_address(where)
|
|
destination = where
|
|
except Exception:
|
|
if where_must_be_address:
|
|
raise
|
|
# URLs are ok so eat the exception
|
|
if source:
|
|
saf = dns.inet.af_for_address(source)
|
|
if af:
|
|
# We know the destination af, so source had better agree!
|
|
if saf != af:
|
|
raise ValueError(
|
|
"different address families for source and destination"
|
|
)
|
|
else:
|
|
# We didn't know the destination af, but we know the source,
|
|
# so that's our af.
|
|
af = saf
|
|
if source_port and not source:
|
|
# Caller has specified a source_port but not an address, so we
|
|
# need to return a source, and we need to use the appropriate
|
|
# wildcard address as the address.
|
|
try:
|
|
source = dns.inet.any_for_af(af)
|
|
except Exception:
|
|
# we catch this and raise ValueError for backwards compatibility
|
|
raise ValueError("source_port specified but address family is unknown")
|
|
# Convert high-level (address, port) tuples into low-level address
|
|
# tuples.
|
|
if destination:
|
|
destination = dns.inet.low_level_address_tuple((destination, port), af)
|
|
if source:
|
|
source = dns.inet.low_level_address_tuple((source, source_port), af)
|
|
return (af, destination, source)
|
|
|
|
|
|
def _make_socket(af, type, source, ssl_context=None, server_hostname=None):
|
|
s = socket_factory(af, type)
|
|
try:
|
|
s.setblocking(False)
|
|
if source is not None:
|
|
s.bind(source)
|
|
if ssl_context:
|
|
# LGTM gets a false positive here, as our default context is OK
|
|
return ssl_context.wrap_socket(
|
|
s,
|
|
do_handshake_on_connect=False, # lgtm[py/insecure-protocol]
|
|
server_hostname=server_hostname,
|
|
)
|
|
else:
|
|
return s
|
|
except Exception:
|
|
s.close()
|
|
raise
|
|
|
|
|
|
def https(
|
|
q: dns.message.Message,
|
|
where: str,
|
|
timeout: Optional[float] = None,
|
|
port: int = 443,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
one_rr_per_rrset: bool = False,
|
|
ignore_trailing: bool = False,
|
|
session: Optional[Any] = None,
|
|
path: str = "/dns-query",
|
|
post: bool = True,
|
|
bootstrap_address: Optional[str] = None,
|
|
verify: Union[bool, str] = True,
|
|
resolver: Optional["dns.resolver.Resolver"] = None,
|
|
family: Optional[int] = socket.AF_UNSPEC,
|
|
) -> dns.message.Message:
|
|
"""Return the response obtained after sending a query via DNS-over-HTTPS.
|
|
|
|
*q*, a ``dns.message.Message``, the query to send.
|
|
|
|
*where*, a ``str``, the nameserver IP address or the full URL. If an IP address is
|
|
given, the URL will be constructed using the following schema:
|
|
https://<IP-address>:<port>/<path>.
|
|
|
|
*timeout*, a ``float`` or ``None``, the number of seconds to wait before the query
|
|
times out. If ``None``, the default, wait forever.
|
|
|
|
*port*, a ``int``, the port to send the query to. The default is 443.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source
|
|
address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message. The default is
|
|
0.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset.
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the
|
|
received message.
|
|
|
|
*session*, an ``httpx.Client``. If provided, the client session to use to send the
|
|
queries.
|
|
|
|
*path*, a ``str``. If *where* is an IP address, then *path* will be used to
|
|
construct the URL to send the DNS query to.
|
|
|
|
*post*, a ``bool``. If ``True``, the default, POST method will be used.
|
|
|
|
*bootstrap_address*, a ``str``, the IP address to use to bypass resolution.
|
|
|
|
*verify*, a ``bool`` or ``str``. If a ``True``, then TLS certificate verification
|
|
of the server is done using the default CA bundle; if ``False``, then no
|
|
verification is done; if a `str` then it specifies the path to a certificate file or
|
|
directory which will be used for verification.
|
|
|
|
*resolver*, a ``dns.resolver.Resolver`` or ``None``, the resolver to use for
|
|
resolution of hostnames in URLs. If not specified, a new resolver with a default
|
|
configuration will be used; note this is *not* the default resolver as that resolver
|
|
might have been configured to use DoH causing a chicken-and-egg problem. This
|
|
parameter only has an effect if the HTTP library is httpx.
|
|
|
|
*family*, an ``int``, the address family. If socket.AF_UNSPEC (the default), both A
|
|
and AAAA records will be retrieved.
|
|
|
|
Returns a ``dns.message.Message``.
|
|
"""
|
|
|
|
if not have_doh:
|
|
raise NoDOH # pragma: no cover
|
|
if session and not isinstance(session, httpx.Client):
|
|
raise ValueError("session parameter must be an httpx.Client")
|
|
|
|
wire = q.to_wire()
|
|
(af, _, the_source) = _destination_and_source(
|
|
where, port, source, source_port, False
|
|
)
|
|
transport = None
|
|
headers = {"accept": "application/dns-message"}
|
|
if af is not None and dns.inet.is_address(where):
|
|
if af == socket.AF_INET:
|
|
url = "https://{}:{}{}".format(where, port, path)
|
|
elif af == socket.AF_INET6:
|
|
url = "https://[{}]:{}{}".format(where, port, path)
|
|
else:
|
|
url = where
|
|
|
|
# set source port and source address
|
|
|
|
if the_source is None:
|
|
local_address = None
|
|
local_port = 0
|
|
else:
|
|
local_address = the_source[0]
|
|
local_port = the_source[1]
|
|
transport = _HTTPTransport(
|
|
local_address=local_address,
|
|
http1=True,
|
|
http2=True,
|
|
verify=verify,
|
|
local_port=local_port,
|
|
bootstrap_address=bootstrap_address,
|
|
resolver=resolver,
|
|
family=family,
|
|
)
|
|
|
|
if session:
|
|
cm: contextlib.AbstractContextManager = contextlib.nullcontext(session)
|
|
else:
|
|
cm = httpx.Client(http1=True, http2=True, verify=verify, transport=transport)
|
|
with cm as session:
|
|
# see https://tools.ietf.org/html/rfc8484#section-4.1.1 for DoH
|
|
# GET and POST examples
|
|
if post:
|
|
headers.update(
|
|
{
|
|
"content-type": "application/dns-message",
|
|
"content-length": str(len(wire)),
|
|
}
|
|
)
|
|
response = session.post(url, headers=headers, content=wire, timeout=timeout)
|
|
else:
|
|
wire = base64.urlsafe_b64encode(wire).rstrip(b"=")
|
|
twire = wire.decode() # httpx does a repr() if we give it bytes
|
|
response = session.get(
|
|
url, headers=headers, timeout=timeout, params={"dns": twire}
|
|
)
|
|
|
|
# see https://tools.ietf.org/html/rfc8484#section-4.2.1 for info about DoH
|
|
# status codes
|
|
if response.status_code < 200 or response.status_code > 299:
|
|
raise ValueError(
|
|
"{} responded with status code {}"
|
|
"\nResponse body: {}".format(where, response.status_code, response.content)
|
|
)
|
|
r = dns.message.from_wire(
|
|
response.content,
|
|
keyring=q.keyring,
|
|
request_mac=q.request_mac,
|
|
one_rr_per_rrset=one_rr_per_rrset,
|
|
ignore_trailing=ignore_trailing,
|
|
)
|
|
r.time = response.elapsed.total_seconds()
|
|
if not q.is_response(r):
|
|
raise BadResponse
|
|
return r
|
|
|
|
|
|
def _udp_recv(sock, max_size, expiration):
|
|
"""Reads a datagram from the socket.
|
|
A Timeout exception will be raised if the operation is not completed
|
|
by the expiration time.
|
|
"""
|
|
while True:
|
|
try:
|
|
return sock.recvfrom(max_size)
|
|
except BlockingIOError:
|
|
_wait_for_readable(sock, expiration)
|
|
|
|
|
|
def _udp_send(sock, data, destination, expiration):
|
|
"""Sends the specified datagram to destination over the socket.
|
|
A Timeout exception will be raised if the operation is not completed
|
|
by the expiration time.
|
|
"""
|
|
while True:
|
|
try:
|
|
if destination:
|
|
return sock.sendto(data, destination)
|
|
else:
|
|
return sock.send(data)
|
|
except BlockingIOError: # pragma: no cover
|
|
_wait_for_writable(sock, expiration)
|
|
|
|
|
|
def send_udp(
|
|
sock: Any,
|
|
what: Union[dns.message.Message, bytes],
|
|
destination: Any,
|
|
expiration: Optional[float] = None,
|
|
) -> Tuple[int, float]:
|
|
"""Send a DNS message to the specified UDP socket.
|
|
|
|
*sock*, a ``socket``.
|
|
|
|
*what*, a ``bytes`` or ``dns.message.Message``, the message to send.
|
|
|
|
*destination*, a destination tuple appropriate for the address family
|
|
of the socket, specifying where to send the query.
|
|
|
|
*expiration*, a ``float`` or ``None``, the absolute time at which
|
|
a timeout exception should be raised. If ``None``, no timeout will
|
|
occur.
|
|
|
|
Returns an ``(int, float)`` tuple of bytes sent and the sent time.
|
|
"""
|
|
|
|
if isinstance(what, dns.message.Message):
|
|
what = what.to_wire()
|
|
sent_time = time.time()
|
|
n = _udp_send(sock, what, destination, expiration)
|
|
return (n, sent_time)
|
|
|
|
|
|
def receive_udp(
|
|
sock: Any,
|
|
destination: Optional[Any] = None,
|
|
expiration: Optional[float] = None,
|
|
ignore_unexpected: bool = False,
|
|
one_rr_per_rrset: bool = False,
|
|
keyring: Optional[Dict[dns.name.Name, dns.tsig.Key]] = None,
|
|
request_mac: Optional[bytes] = b"",
|
|
ignore_trailing: bool = False,
|
|
raise_on_truncation: bool = False,
|
|
ignore_errors: bool = False,
|
|
query: Optional[dns.message.Message] = None,
|
|
) -> Any:
|
|
"""Read a DNS message from a UDP socket.
|
|
|
|
*sock*, a ``socket``.
|
|
|
|
*destination*, a destination tuple appropriate for the address family
|
|
of the socket, specifying where the message is expected to arrive from.
|
|
When receiving a response, this would be where the associated query was
|
|
sent.
|
|
|
|
*expiration*, a ``float`` or ``None``, the absolute time at which
|
|
a timeout exception should be raised. If ``None``, no timeout will
|
|
occur.
|
|
|
|
*ignore_unexpected*, a ``bool``. If ``True``, ignore responses from
|
|
unexpected sources.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own
|
|
RRset.
|
|
|
|
*keyring*, a ``dict``, the keyring to use for TSIG.
|
|
|
|
*request_mac*, a ``bytes`` or ``None``, the MAC of the request (for TSIG).
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing
|
|
junk at end of the received message.
|
|
|
|
*raise_on_truncation*, a ``bool``. If ``True``, raise an exception if
|
|
the TC bit is set.
|
|
|
|
Raises if the message is malformed, if network errors occur, of if
|
|
there is a timeout.
|
|
|
|
If *destination* is not ``None``, returns a ``(dns.message.Message, float)``
|
|
tuple of the received message and the received time.
|
|
|
|
If *destination* is ``None``, returns a
|
|
``(dns.message.Message, float, tuple)``
|
|
tuple of the received message, the received time, and the address where
|
|
the message arrived from.
|
|
|
|
*ignore_errors*, a ``bool``. If various format errors or response
|
|
mismatches occur, ignore them and keep listening for a valid response.
|
|
The default is ``False``.
|
|
|
|
*query*, a ``dns.message.Message`` or ``None``. If not ``None`` and
|
|
*ignore_errors* is ``True``, check that the received message is a response
|
|
to this query, and if not keep listening for a valid response.
|
|
"""
|
|
|
|
wire = b""
|
|
while True:
|
|
(wire, from_address) = _udp_recv(sock, 65535, expiration)
|
|
if not _matches_destination(
|
|
sock.family, from_address, destination, ignore_unexpected
|
|
):
|
|
continue
|
|
received_time = time.time()
|
|
try:
|
|
r = dns.message.from_wire(
|
|
wire,
|
|
keyring=keyring,
|
|
request_mac=request_mac,
|
|
one_rr_per_rrset=one_rr_per_rrset,
|
|
ignore_trailing=ignore_trailing,
|
|
raise_on_truncation=raise_on_truncation,
|
|
)
|
|
except dns.message.Truncated as e:
|
|
# If we got Truncated and not FORMERR, we at least got the header with TC
|
|
# set, and very likely the question section, so we'll re-raise if the
|
|
# message seems to be a response as we need to know when truncation happens.
|
|
# We need to check that it seems to be a response as we don't want a random
|
|
# injected message with TC set to cause us to bail out.
|
|
if (
|
|
ignore_errors
|
|
and query is not None
|
|
and not query.is_response(e.message())
|
|
):
|
|
continue
|
|
else:
|
|
raise
|
|
except Exception:
|
|
if ignore_errors:
|
|
continue
|
|
else:
|
|
raise
|
|
if ignore_errors and query is not None and not query.is_response(r):
|
|
continue
|
|
if destination:
|
|
return (r, received_time)
|
|
else:
|
|
return (r, received_time, from_address)
|
|
|
|
|
|
def udp(
|
|
q: dns.message.Message,
|
|
where: str,
|
|
timeout: Optional[float] = None,
|
|
port: int = 53,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
ignore_unexpected: bool = False,
|
|
one_rr_per_rrset: bool = False,
|
|
ignore_trailing: bool = False,
|
|
raise_on_truncation: bool = False,
|
|
sock: Optional[Any] = None,
|
|
ignore_errors: bool = False,
|
|
) -> dns.message.Message:
|
|
"""Return the response obtained after sending a query via UDP.
|
|
|
|
*q*, a ``dns.message.Message``, the query to send
|
|
|
|
*where*, a ``str`` containing an IPv4 or IPv6 address, where
|
|
to send the message.
|
|
|
|
*timeout*, a ``float`` or ``None``, the number of seconds to wait before the
|
|
query times out. If ``None``, the default, wait forever.
|
|
|
|
*port*, an ``int``, the port send the message to. The default is 53.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying
|
|
the source address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message.
|
|
The default is 0.
|
|
|
|
*ignore_unexpected*, a ``bool``. If ``True``, ignore responses from
|
|
unexpected sources.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own
|
|
RRset.
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing
|
|
junk at end of the received message.
|
|
|
|
*raise_on_truncation*, a ``bool``. If ``True``, raise an exception if
|
|
the TC bit is set.
|
|
|
|
*sock*, a ``socket.socket``, or ``None``, the socket to use for the
|
|
query. If ``None``, the default, a socket is created. Note that
|
|
if a socket is provided, it must be a nonblocking datagram socket,
|
|
and the *source* and *source_port* are ignored.
|
|
|
|
*ignore_errors*, a ``bool``. If various format errors or response
|
|
mismatches occur, ignore them and keep listening for a valid response.
|
|
The default is ``False``.
|
|
|
|
Returns a ``dns.message.Message``.
|
|
"""
|
|
|
|
wire = q.to_wire()
|
|
(af, destination, source) = _destination_and_source(
|
|
where, port, source, source_port
|
|
)
|
|
(begin_time, expiration) = _compute_times(timeout)
|
|
if sock:
|
|
cm: contextlib.AbstractContextManager = contextlib.nullcontext(sock)
|
|
else:
|
|
cm = _make_socket(af, socket.SOCK_DGRAM, source)
|
|
with cm as s:
|
|
send_udp(s, wire, destination, expiration)
|
|
(r, received_time) = receive_udp(
|
|
s,
|
|
destination,
|
|
expiration,
|
|
ignore_unexpected,
|
|
one_rr_per_rrset,
|
|
q.keyring,
|
|
q.mac,
|
|
ignore_trailing,
|
|
raise_on_truncation,
|
|
ignore_errors,
|
|
q,
|
|
)
|
|
r.time = received_time - begin_time
|
|
# We don't need to check q.is_response() if we are in ignore_errors mode
|
|
# as receive_udp() will have checked it.
|
|
if not (ignore_errors or q.is_response(r)):
|
|
raise BadResponse
|
|
return r
|
|
assert (
|
|
False # help mypy figure out we can't get here lgtm[py/unreachable-statement]
|
|
)
|
|
|
|
|
|
def udp_with_fallback(
|
|
q: dns.message.Message,
|
|
where: str,
|
|
timeout: Optional[float] = None,
|
|
port: int = 53,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
ignore_unexpected: bool = False,
|
|
one_rr_per_rrset: bool = False,
|
|
ignore_trailing: bool = False,
|
|
udp_sock: Optional[Any] = None,
|
|
tcp_sock: Optional[Any] = None,
|
|
ignore_errors: bool = False,
|
|
) -> Tuple[dns.message.Message, bool]:
|
|
"""Return the response to the query, trying UDP first and falling back
|
|
to TCP if UDP results in a truncated response.
|
|
|
|
*q*, a ``dns.message.Message``, the query to send
|
|
|
|
*where*, a ``str`` containing an IPv4 or IPv6 address, where to send the message.
|
|
|
|
*timeout*, a ``float`` or ``None``, the number of seconds to wait before the query
|
|
times out. If ``None``, the default, wait forever.
|
|
|
|
*port*, an ``int``, the port send the message to. The default is 53.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source
|
|
address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message. The default is
|
|
0.
|
|
|
|
*ignore_unexpected*, a ``bool``. If ``True``, ignore responses from unexpected
|
|
sources.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset.
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the
|
|
received message.
|
|
|
|
*udp_sock*, a ``socket.socket``, or ``None``, the socket to use for the UDP query.
|
|
If ``None``, the default, a socket is created. Note that if a socket is provided,
|
|
it must be a nonblocking datagram socket, and the *source* and *source_port* are
|
|
ignored for the UDP query.
|
|
|
|
*tcp_sock*, a ``socket.socket``, or ``None``, the connected socket to use for the
|
|
TCP query. If ``None``, the default, a socket is created. Note that if a socket is
|
|
provided, it must be a nonblocking connected stream socket, and *where*, *source*
|
|
and *source_port* are ignored for the TCP query.
|
|
|
|
*ignore_errors*, a ``bool``. If various format errors or response mismatches occur
|
|
while listening for UDP, ignore them and keep listening for a valid response. The
|
|
default is ``False``.
|
|
|
|
Returns a (``dns.message.Message``, tcp) tuple where tcp is ``True`` if and only if
|
|
TCP was used.
|
|
"""
|
|
try:
|
|
response = udp(
|
|
q,
|
|
where,
|
|
timeout,
|
|
port,
|
|
source,
|
|
source_port,
|
|
ignore_unexpected,
|
|
one_rr_per_rrset,
|
|
ignore_trailing,
|
|
True,
|
|
udp_sock,
|
|
ignore_errors,
|
|
)
|
|
return (response, False)
|
|
except dns.message.Truncated:
|
|
response = tcp(
|
|
q,
|
|
where,
|
|
timeout,
|
|
port,
|
|
source,
|
|
source_port,
|
|
one_rr_per_rrset,
|
|
ignore_trailing,
|
|
tcp_sock,
|
|
)
|
|
return (response, True)
|
|
|
|
|
|
def _net_read(sock, count, expiration):
|
|
"""Read the specified number of bytes from sock. Keep trying until we
|
|
either get the desired amount, or we hit EOF.
|
|
A Timeout exception will be raised if the operation is not completed
|
|
by the expiration time.
|
|
"""
|
|
s = b""
|
|
while count > 0:
|
|
try:
|
|
n = sock.recv(count)
|
|
if n == b"":
|
|
raise EOFError
|
|
count -= len(n)
|
|
s += n
|
|
except (BlockingIOError, ssl.SSLWantReadError):
|
|
_wait_for_readable(sock, expiration)
|
|
except ssl.SSLWantWriteError: # pragma: no cover
|
|
_wait_for_writable(sock, expiration)
|
|
return s
|
|
|
|
|
|
def _net_write(sock, data, expiration):
|
|
"""Write the specified data to the socket.
|
|
A Timeout exception will be raised if the operation is not completed
|
|
by the expiration time.
|
|
"""
|
|
current = 0
|
|
l = len(data)
|
|
while current < l:
|
|
try:
|
|
current += sock.send(data[current:])
|
|
except (BlockingIOError, ssl.SSLWantWriteError):
|
|
_wait_for_writable(sock, expiration)
|
|
except ssl.SSLWantReadError: # pragma: no cover
|
|
_wait_for_readable(sock, expiration)
|
|
|
|
|
|
def send_tcp(
|
|
sock: Any,
|
|
what: Union[dns.message.Message, bytes],
|
|
expiration: Optional[float] = None,
|
|
) -> Tuple[int, float]:
|
|
"""Send a DNS message to the specified TCP socket.
|
|
|
|
*sock*, a ``socket``.
|
|
|
|
*what*, a ``bytes`` or ``dns.message.Message``, the message to send.
|
|
|
|
*expiration*, a ``float`` or ``None``, the absolute time at which
|
|
a timeout exception should be raised. If ``None``, no timeout will
|
|
occur.
|
|
|
|
Returns an ``(int, float)`` tuple of bytes sent and the sent time.
|
|
"""
|
|
|
|
if isinstance(what, dns.message.Message):
|
|
tcpmsg = what.to_wire(prepend_length=True)
|
|
else:
|
|
# copying the wire into tcpmsg is inefficient, but lets us
|
|
# avoid writev() or doing a short write that would get pushed
|
|
# onto the net
|
|
tcpmsg = len(what).to_bytes(2, "big") + what
|
|
sent_time = time.time()
|
|
_net_write(sock, tcpmsg, expiration)
|
|
return (len(tcpmsg), sent_time)
|
|
|
|
|
|
def receive_tcp(
|
|
sock: Any,
|
|
expiration: Optional[float] = None,
|
|
one_rr_per_rrset: bool = False,
|
|
keyring: Optional[Dict[dns.name.Name, dns.tsig.Key]] = None,
|
|
request_mac: Optional[bytes] = b"",
|
|
ignore_trailing: bool = False,
|
|
) -> Tuple[dns.message.Message, float]:
|
|
"""Read a DNS message from a TCP socket.
|
|
|
|
*sock*, a ``socket``.
|
|
|
|
*expiration*, a ``float`` or ``None``, the absolute time at which
|
|
a timeout exception should be raised. If ``None``, no timeout will
|
|
occur.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own
|
|
RRset.
|
|
|
|
*keyring*, a ``dict``, the keyring to use for TSIG.
|
|
|
|
*request_mac*, a ``bytes`` or ``None``, the MAC of the request (for TSIG).
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing
|
|
junk at end of the received message.
|
|
|
|
Raises if the message is malformed, if network errors occur, of if
|
|
there is a timeout.
|
|
|
|
Returns a ``(dns.message.Message, float)`` tuple of the received message
|
|
and the received time.
|
|
"""
|
|
|
|
ldata = _net_read(sock, 2, expiration)
|
|
(l,) = struct.unpack("!H", ldata)
|
|
wire = _net_read(sock, l, expiration)
|
|
received_time = time.time()
|
|
r = dns.message.from_wire(
|
|
wire,
|
|
keyring=keyring,
|
|
request_mac=request_mac,
|
|
one_rr_per_rrset=one_rr_per_rrset,
|
|
ignore_trailing=ignore_trailing,
|
|
)
|
|
return (r, received_time)
|
|
|
|
|
|
def _connect(s, address, expiration):
|
|
err = s.connect_ex(address)
|
|
if err == 0:
|
|
return
|
|
if err in (errno.EINPROGRESS, errno.EWOULDBLOCK, errno.EALREADY):
|
|
_wait_for_writable(s, expiration)
|
|
err = s.getsockopt(socket.SOL_SOCKET, socket.SO_ERROR)
|
|
if err != 0:
|
|
raise OSError(err, os.strerror(err))
|
|
|
|
|
|
def tcp(
|
|
q: dns.message.Message,
|
|
where: str,
|
|
timeout: Optional[float] = None,
|
|
port: int = 53,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
one_rr_per_rrset: bool = False,
|
|
ignore_trailing: bool = False,
|
|
sock: Optional[Any] = None,
|
|
) -> dns.message.Message:
|
|
"""Return the response obtained after sending a query via TCP.
|
|
|
|
*q*, a ``dns.message.Message``, the query to send
|
|
|
|
*where*, a ``str`` containing an IPv4 or IPv6 address, where
|
|
to send the message.
|
|
|
|
*timeout*, a ``float`` or ``None``, the number of seconds to wait before the
|
|
query times out. If ``None``, the default, wait forever.
|
|
|
|
*port*, an ``int``, the port send the message to. The default is 53.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying
|
|
the source address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message.
|
|
The default is 0.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own
|
|
RRset.
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing
|
|
junk at end of the received message.
|
|
|
|
*sock*, a ``socket.socket``, or ``None``, the connected socket to use for the
|
|
query. If ``None``, the default, a socket is created. Note that
|
|
if a socket is provided, it must be a nonblocking connected stream
|
|
socket, and *where*, *port*, *source* and *source_port* are ignored.
|
|
|
|
Returns a ``dns.message.Message``.
|
|
"""
|
|
|
|
wire = q.to_wire()
|
|
(begin_time, expiration) = _compute_times(timeout)
|
|
if sock:
|
|
cm: contextlib.AbstractContextManager = contextlib.nullcontext(sock)
|
|
else:
|
|
(af, destination, source) = _destination_and_source(
|
|
where, port, source, source_port
|
|
)
|
|
cm = _make_socket(af, socket.SOCK_STREAM, source)
|
|
with cm as s:
|
|
if not sock:
|
|
_connect(s, destination, expiration)
|
|
send_tcp(s, wire, expiration)
|
|
(r, received_time) = receive_tcp(
|
|
s, expiration, one_rr_per_rrset, q.keyring, q.mac, ignore_trailing
|
|
)
|
|
r.time = received_time - begin_time
|
|
if not q.is_response(r):
|
|
raise BadResponse
|
|
return r
|
|
assert (
|
|
False # help mypy figure out we can't get here lgtm[py/unreachable-statement]
|
|
)
|
|
|
|
|
|
def _tls_handshake(s, expiration):
|
|
while True:
|
|
try:
|
|
s.do_handshake()
|
|
return
|
|
except ssl.SSLWantReadError:
|
|
_wait_for_readable(s, expiration)
|
|
except ssl.SSLWantWriteError: # pragma: no cover
|
|
_wait_for_writable(s, expiration)
|
|
|
|
|
|
def _make_dot_ssl_context(
|
|
server_hostname: Optional[str], verify: Union[bool, str]
|
|
) -> ssl.SSLContext:
|
|
cafile: Optional[str] = None
|
|
capath: Optional[str] = None
|
|
if isinstance(verify, str):
|
|
if os.path.isfile(verify):
|
|
cafile = verify
|
|
elif os.path.isdir(verify):
|
|
capath = verify
|
|
else:
|
|
raise ValueError("invalid verify string")
|
|
ssl_context = ssl.create_default_context(cafile=cafile, capath=capath)
|
|
ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2
|
|
if server_hostname is None:
|
|
ssl_context.check_hostname = False
|
|
ssl_context.set_alpn_protocols(["dot"])
|
|
if verify is False:
|
|
ssl_context.verify_mode = ssl.CERT_NONE
|
|
return ssl_context
|
|
|
|
|
|
def tls(
|
|
q: dns.message.Message,
|
|
where: str,
|
|
timeout: Optional[float] = None,
|
|
port: int = 853,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
one_rr_per_rrset: bool = False,
|
|
ignore_trailing: bool = False,
|
|
sock: Optional[ssl.SSLSocket] = None,
|
|
ssl_context: Optional[ssl.SSLContext] = None,
|
|
server_hostname: Optional[str] = None,
|
|
verify: Union[bool, str] = True,
|
|
) -> dns.message.Message:
|
|
"""Return the response obtained after sending a query via TLS.
|
|
|
|
*q*, a ``dns.message.Message``, the query to send
|
|
|
|
*where*, a ``str`` containing an IPv4 or IPv6 address, where
|
|
to send the message.
|
|
|
|
*timeout*, a ``float`` or ``None``, the number of seconds to wait before the
|
|
query times out. If ``None``, the default, wait forever.
|
|
|
|
*port*, an ``int``, the port send the message to. The default is 853.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying
|
|
the source address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message.
|
|
The default is 0.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own
|
|
RRset.
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing
|
|
junk at end of the received message.
|
|
|
|
*sock*, an ``ssl.SSLSocket``, or ``None``, the socket to use for
|
|
the query. If ``None``, the default, a socket is created. Note
|
|
that if a socket is provided, it must be a nonblocking connected
|
|
SSL stream socket, and *where*, *port*, *source*, *source_port*,
|
|
and *ssl_context* are ignored.
|
|
|
|
*ssl_context*, an ``ssl.SSLContext``, the context to use when establishing
|
|
a TLS connection. If ``None``, the default, creates one with the default
|
|
configuration.
|
|
|
|
*server_hostname*, a ``str`` containing the server's hostname. The
|
|
default is ``None``, which means that no hostname is known, and if an
|
|
SSL context is created, hostname checking will be disabled.
|
|
|
|
*verify*, a ``bool`` or ``str``. If a ``True``, then TLS certificate verification
|
|
of the server is done using the default CA bundle; if ``False``, then no
|
|
verification is done; if a `str` then it specifies the path to a certificate file or
|
|
directory which will be used for verification.
|
|
|
|
Returns a ``dns.message.Message``.
|
|
|
|
"""
|
|
|
|
if sock:
|
|
#
|
|
# If a socket was provided, there's no special TLS handling needed.
|
|
#
|
|
return tcp(
|
|
q,
|
|
where,
|
|
timeout,
|
|
port,
|
|
source,
|
|
source_port,
|
|
one_rr_per_rrset,
|
|
ignore_trailing,
|
|
sock,
|
|
)
|
|
|
|
wire = q.to_wire()
|
|
(begin_time, expiration) = _compute_times(timeout)
|
|
(af, destination, source) = _destination_and_source(
|
|
where, port, source, source_port
|
|
)
|
|
if ssl_context is None and not sock:
|
|
ssl_context = _make_dot_ssl_context(server_hostname, verify)
|
|
|
|
with _make_socket(
|
|
af,
|
|
socket.SOCK_STREAM,
|
|
source,
|
|
ssl_context=ssl_context,
|
|
server_hostname=server_hostname,
|
|
) as s:
|
|
_connect(s, destination, expiration)
|
|
_tls_handshake(s, expiration)
|
|
send_tcp(s, wire, expiration)
|
|
(r, received_time) = receive_tcp(
|
|
s, expiration, one_rr_per_rrset, q.keyring, q.mac, ignore_trailing
|
|
)
|
|
r.time = received_time - begin_time
|
|
if not q.is_response(r):
|
|
raise BadResponse
|
|
return r
|
|
assert (
|
|
False # help mypy figure out we can't get here lgtm[py/unreachable-statement]
|
|
)
|
|
|
|
|
|
def quic(
|
|
q: dns.message.Message,
|
|
where: str,
|
|
timeout: Optional[float] = None,
|
|
port: int = 853,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
one_rr_per_rrset: bool = False,
|
|
ignore_trailing: bool = False,
|
|
connection: Optional[dns.quic.SyncQuicConnection] = None,
|
|
verify: Union[bool, str] = True,
|
|
server_hostname: Optional[str] = None,
|
|
) -> dns.message.Message:
|
|
"""Return the response obtained after sending a query via DNS-over-QUIC.
|
|
|
|
*q*, a ``dns.message.Message``, the query to send.
|
|
|
|
*where*, a ``str``, the nameserver IP address.
|
|
|
|
*timeout*, a ``float`` or ``None``, the number of seconds to wait before the query
|
|
times out. If ``None``, the default, wait forever.
|
|
|
|
*port*, a ``int``, the port to send the query to. The default is 853.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying the source
|
|
address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message. The default is
|
|
0.
|
|
|
|
*one_rr_per_rrset*, a ``bool``. If ``True``, put each RR into its own RRset.
|
|
|
|
*ignore_trailing*, a ``bool``. If ``True``, ignore trailing junk at end of the
|
|
received message.
|
|
|
|
*connection*, a ``dns.quic.SyncQuicConnection``. If provided, the
|
|
connection to use to send the query.
|
|
|
|
*verify*, a ``bool`` or ``str``. If a ``True``, then TLS certificate verification
|
|
of the server is done using the default CA bundle; if ``False``, then no
|
|
verification is done; if a `str` then it specifies the path to a certificate file or
|
|
directory which will be used for verification.
|
|
|
|
*server_hostname*, a ``str`` containing the server's hostname. The
|
|
default is ``None``, which means that no hostname is known, and if an
|
|
SSL context is created, hostname checking will be disabled.
|
|
|
|
Returns a ``dns.message.Message``.
|
|
"""
|
|
|
|
if not dns.quic.have_quic:
|
|
raise NoDOQ("DNS-over-QUIC is not available.") # pragma: no cover
|
|
|
|
q.id = 0
|
|
wire = q.to_wire()
|
|
the_connection: dns.quic.SyncQuicConnection
|
|
the_manager: dns.quic.SyncQuicManager
|
|
if connection:
|
|
manager: contextlib.AbstractContextManager = contextlib.nullcontext(None)
|
|
the_connection = connection
|
|
else:
|
|
manager = dns.quic.SyncQuicManager(
|
|
verify_mode=verify, server_name=server_hostname
|
|
)
|
|
the_manager = manager # for type checking happiness
|
|
|
|
with manager:
|
|
if not connection:
|
|
the_connection = the_manager.connect(where, port, source, source_port)
|
|
(start, expiration) = _compute_times(timeout)
|
|
with the_connection.make_stream(timeout) as stream:
|
|
stream.send(wire, True)
|
|
wire = stream.receive(_remaining(expiration))
|
|
finish = time.time()
|
|
r = dns.message.from_wire(
|
|
wire,
|
|
keyring=q.keyring,
|
|
request_mac=q.request_mac,
|
|
one_rr_per_rrset=one_rr_per_rrset,
|
|
ignore_trailing=ignore_trailing,
|
|
)
|
|
r.time = max(finish - start, 0.0)
|
|
if not q.is_response(r):
|
|
raise BadResponse
|
|
return r
|
|
|
|
|
|
def xfr(
|
|
where: str,
|
|
zone: Union[dns.name.Name, str],
|
|
rdtype: Union[dns.rdatatype.RdataType, str] = dns.rdatatype.AXFR,
|
|
rdclass: Union[dns.rdataclass.RdataClass, str] = dns.rdataclass.IN,
|
|
timeout: Optional[float] = None,
|
|
port: int = 53,
|
|
keyring: Optional[Dict[dns.name.Name, dns.tsig.Key]] = None,
|
|
keyname: Optional[Union[dns.name.Name, str]] = None,
|
|
relativize: bool = True,
|
|
lifetime: Optional[float] = None,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
serial: int = 0,
|
|
use_udp: bool = False,
|
|
keyalgorithm: Union[dns.name.Name, str] = dns.tsig.default_algorithm,
|
|
) -> Any:
|
|
"""Return a generator for the responses to a zone transfer.
|
|
|
|
*where*, a ``str`` containing an IPv4 or IPv6 address, where
|
|
to send the message.
|
|
|
|
*zone*, a ``dns.name.Name`` or ``str``, the name of the zone to transfer.
|
|
|
|
*rdtype*, an ``int`` or ``str``, the type of zone transfer. The
|
|
default is ``dns.rdatatype.AXFR``. ``dns.rdatatype.IXFR`` can be
|
|
used to do an incremental transfer instead.
|
|
|
|
*rdclass*, an ``int`` or ``str``, the class of the zone transfer.
|
|
The default is ``dns.rdataclass.IN``.
|
|
|
|
*timeout*, a ``float``, the number of seconds to wait for each
|
|
response message. If None, the default, wait forever.
|
|
|
|
*port*, an ``int``, the port send the message to. The default is 53.
|
|
|
|
*keyring*, a ``dict``, the keyring to use for TSIG.
|
|
|
|
*keyname*, a ``dns.name.Name`` or ``str``, the name of the TSIG
|
|
key to use.
|
|
|
|
*relativize*, a ``bool``. If ``True``, all names in the zone will be
|
|
relativized to the zone origin. It is essential that the
|
|
relativize setting matches the one specified to
|
|
``dns.zone.from_xfr()`` if using this generator to make a zone.
|
|
|
|
*lifetime*, a ``float``, the total number of seconds to spend
|
|
doing the transfer. If ``None``, the default, then there is no
|
|
limit on the time the transfer may take.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying
|
|
the source address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message.
|
|
The default is 0.
|
|
|
|
*serial*, an ``int``, the SOA serial number to use as the base for
|
|
an IXFR diff sequence (only meaningful if *rdtype* is
|
|
``dns.rdatatype.IXFR``).
|
|
|
|
*use_udp*, a ``bool``. If ``True``, use UDP (only meaningful for IXFR).
|
|
|
|
*keyalgorithm*, a ``dns.name.Name`` or ``str``, the TSIG algorithm to use.
|
|
|
|
Raises on errors, and so does the generator.
|
|
|
|
Returns a generator of ``dns.message.Message`` objects.
|
|
"""
|
|
|
|
if isinstance(zone, str):
|
|
zone = dns.name.from_text(zone)
|
|
rdtype = dns.rdatatype.RdataType.make(rdtype)
|
|
q = dns.message.make_query(zone, rdtype, rdclass)
|
|
if rdtype == dns.rdatatype.IXFR:
|
|
rrset = dns.rrset.from_text(zone, 0, "IN", "SOA", ". . %u 0 0 0 0" % serial)
|
|
q.authority.append(rrset)
|
|
if keyring is not None:
|
|
q.use_tsig(keyring, keyname, algorithm=keyalgorithm)
|
|
wire = q.to_wire()
|
|
(af, destination, source) = _destination_and_source(
|
|
where, port, source, source_port
|
|
)
|
|
if use_udp and rdtype != dns.rdatatype.IXFR:
|
|
raise ValueError("cannot do a UDP AXFR")
|
|
sock_type = socket.SOCK_DGRAM if use_udp else socket.SOCK_STREAM
|
|
with _make_socket(af, sock_type, source) as s:
|
|
(_, expiration) = _compute_times(lifetime)
|
|
_connect(s, destination, expiration)
|
|
l = len(wire)
|
|
if use_udp:
|
|
_udp_send(s, wire, None, expiration)
|
|
else:
|
|
tcpmsg = struct.pack("!H", l) + wire
|
|
_net_write(s, tcpmsg, expiration)
|
|
done = False
|
|
delete_mode = True
|
|
expecting_SOA = False
|
|
soa_rrset = None
|
|
if relativize:
|
|
origin = zone
|
|
oname = dns.name.empty
|
|
else:
|
|
origin = None
|
|
oname = zone
|
|
tsig_ctx = None
|
|
while not done:
|
|
(_, mexpiration) = _compute_times(timeout)
|
|
if mexpiration is None or (
|
|
expiration is not None and mexpiration > expiration
|
|
):
|
|
mexpiration = expiration
|
|
if use_udp:
|
|
(wire, _) = _udp_recv(s, 65535, mexpiration)
|
|
else:
|
|
ldata = _net_read(s, 2, mexpiration)
|
|
(l,) = struct.unpack("!H", ldata)
|
|
wire = _net_read(s, l, mexpiration)
|
|
is_ixfr = rdtype == dns.rdatatype.IXFR
|
|
r = dns.message.from_wire(
|
|
wire,
|
|
keyring=q.keyring,
|
|
request_mac=q.mac,
|
|
xfr=True,
|
|
origin=origin,
|
|
tsig_ctx=tsig_ctx,
|
|
multi=True,
|
|
one_rr_per_rrset=is_ixfr,
|
|
)
|
|
rcode = r.rcode()
|
|
if rcode != dns.rcode.NOERROR:
|
|
raise TransferError(rcode)
|
|
tsig_ctx = r.tsig_ctx
|
|
answer_index = 0
|
|
if soa_rrset is None:
|
|
if not r.answer or r.answer[0].name != oname:
|
|
raise dns.exception.FormError("No answer or RRset not for qname")
|
|
rrset = r.answer[0]
|
|
if rrset.rdtype != dns.rdatatype.SOA:
|
|
raise dns.exception.FormError("first RRset is not an SOA")
|
|
answer_index = 1
|
|
soa_rrset = rrset.copy()
|
|
if rdtype == dns.rdatatype.IXFR:
|
|
if dns.serial.Serial(soa_rrset[0].serial) <= serial:
|
|
#
|
|
# We're already up-to-date.
|
|
#
|
|
done = True
|
|
else:
|
|
expecting_SOA = True
|
|
#
|
|
# Process SOAs in the answer section (other than the initial
|
|
# SOA in the first message).
|
|
#
|
|
for rrset in r.answer[answer_index:]:
|
|
if done:
|
|
raise dns.exception.FormError("answers after final SOA")
|
|
if rrset.rdtype == dns.rdatatype.SOA and rrset.name == oname:
|
|
if expecting_SOA:
|
|
if rrset[0].serial != serial:
|
|
raise dns.exception.FormError("IXFR base serial mismatch")
|
|
expecting_SOA = False
|
|
elif rdtype == dns.rdatatype.IXFR:
|
|
delete_mode = not delete_mode
|
|
#
|
|
# If this SOA RRset is equal to the first we saw then we're
|
|
# finished. If this is an IXFR we also check that we're
|
|
# seeing the record in the expected part of the response.
|
|
#
|
|
if rrset == soa_rrset and (
|
|
rdtype == dns.rdatatype.AXFR
|
|
or (rdtype == dns.rdatatype.IXFR and delete_mode)
|
|
):
|
|
done = True
|
|
elif expecting_SOA:
|
|
#
|
|
# We made an IXFR request and are expecting another
|
|
# SOA RR, but saw something else, so this must be an
|
|
# AXFR response.
|
|
#
|
|
rdtype = dns.rdatatype.AXFR
|
|
expecting_SOA = False
|
|
if done and q.keyring and not r.had_tsig:
|
|
raise dns.exception.FormError("missing TSIG")
|
|
yield r
|
|
|
|
|
|
class UDPMode(enum.IntEnum):
|
|
"""How should UDP be used in an IXFR from :py:func:`inbound_xfr()`?
|
|
|
|
NEVER means "never use UDP; always use TCP"
|
|
TRY_FIRST means "try to use UDP but fall back to TCP if needed"
|
|
ONLY means "raise ``dns.xfr.UseTCP`` if trying UDP does not succeed"
|
|
"""
|
|
|
|
NEVER = 0
|
|
TRY_FIRST = 1
|
|
ONLY = 2
|
|
|
|
|
|
def inbound_xfr(
|
|
where: str,
|
|
txn_manager: dns.transaction.TransactionManager,
|
|
query: Optional[dns.message.Message] = None,
|
|
port: int = 53,
|
|
timeout: Optional[float] = None,
|
|
lifetime: Optional[float] = None,
|
|
source: Optional[str] = None,
|
|
source_port: int = 0,
|
|
udp_mode: UDPMode = UDPMode.NEVER,
|
|
) -> None:
|
|
"""Conduct an inbound transfer and apply it via a transaction from the
|
|
txn_manager.
|
|
|
|
*where*, a ``str`` containing an IPv4 or IPv6 address, where
|
|
to send the message.
|
|
|
|
*txn_manager*, a ``dns.transaction.TransactionManager``, the txn_manager
|
|
for this transfer (typically a ``dns.zone.Zone``).
|
|
|
|
*query*, the query to send. If not supplied, a default query is
|
|
constructed using information from the *txn_manager*.
|
|
|
|
*port*, an ``int``, the port send the message to. The default is 53.
|
|
|
|
*timeout*, a ``float``, the number of seconds to wait for each
|
|
response message. If None, the default, wait forever.
|
|
|
|
*lifetime*, a ``float``, the total number of seconds to spend
|
|
doing the transfer. If ``None``, the default, then there is no
|
|
limit on the time the transfer may take.
|
|
|
|
*source*, a ``str`` containing an IPv4 or IPv6 address, specifying
|
|
the source address. The default is the wildcard address.
|
|
|
|
*source_port*, an ``int``, the port from which to send the message.
|
|
The default is 0.
|
|
|
|
*udp_mode*, a ``dns.query.UDPMode``, determines how UDP is used
|
|
for IXFRs. The default is ``dns.UDPMode.NEVER``, i.e. only use
|
|
TCP. Other possibilities are ``dns.UDPMode.TRY_FIRST``, which
|
|
means "try UDP but fallback to TCP if needed", and
|
|
``dns.UDPMode.ONLY``, which means "try UDP and raise
|
|
``dns.xfr.UseTCP`` if it does not succeed.
|
|
|
|
Raises on errors.
|
|
"""
|
|
if query is None:
|
|
(query, serial) = dns.xfr.make_query(txn_manager)
|
|
else:
|
|
serial = dns.xfr.extract_serial_from_query(query)
|
|
rdtype = query.question[0].rdtype
|
|
is_ixfr = rdtype == dns.rdatatype.IXFR
|
|
origin = txn_manager.from_wire_origin()
|
|
wire = query.to_wire()
|
|
(af, destination, source) = _destination_and_source(
|
|
where, port, source, source_port
|
|
)
|
|
(_, expiration) = _compute_times(lifetime)
|
|
retry = True
|
|
while retry:
|
|
retry = False
|
|
if is_ixfr and udp_mode != UDPMode.NEVER:
|
|
sock_type = socket.SOCK_DGRAM
|
|
is_udp = True
|
|
else:
|
|
sock_type = socket.SOCK_STREAM
|
|
is_udp = False
|
|
with _make_socket(af, sock_type, source) as s:
|
|
_connect(s, destination, expiration)
|
|
if is_udp:
|
|
_udp_send(s, wire, None, expiration)
|
|
else:
|
|
tcpmsg = struct.pack("!H", len(wire)) + wire
|
|
_net_write(s, tcpmsg, expiration)
|
|
with dns.xfr.Inbound(txn_manager, rdtype, serial, is_udp) as inbound:
|
|
done = False
|
|
tsig_ctx = None
|
|
while not done:
|
|
(_, mexpiration) = _compute_times(timeout)
|
|
if mexpiration is None or (
|
|
expiration is not None and mexpiration > expiration
|
|
):
|
|
mexpiration = expiration
|
|
if is_udp:
|
|
(rwire, _) = _udp_recv(s, 65535, mexpiration)
|
|
else:
|
|
ldata = _net_read(s, 2, mexpiration)
|
|
(l,) = struct.unpack("!H", ldata)
|
|
rwire = _net_read(s, l, mexpiration)
|
|
r = dns.message.from_wire(
|
|
rwire,
|
|
keyring=query.keyring,
|
|
request_mac=query.mac,
|
|
xfr=True,
|
|
origin=origin,
|
|
tsig_ctx=tsig_ctx,
|
|
multi=(not is_udp),
|
|
one_rr_per_rrset=is_ixfr,
|
|
)
|
|
try:
|
|
done = inbound.process_message(r)
|
|
except dns.xfr.UseTCP:
|
|
assert is_udp # should not happen if we used TCP!
|
|
if udp_mode == UDPMode.ONLY:
|
|
raise
|
|
done = True
|
|
retry = True
|
|
udp_mode = UDPMode.NEVER
|
|
continue
|
|
tsig_ctx = r.tsig_ctx
|
|
if not retry and query.keyring and not r.had_tsig:
|
|
raise dns.exception.FormError("missing TSIG")
|