509318396 ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ 3 rÇj2gã@s:ddlZddljZddljZddlTddlmZGdd„dƒZGdd„dƒZGdd „d e ƒZ Gd d„dƒZedkr6ddl Z e jd dkr¾ee jdƒZejƒZejƒed dZejeƒnxe jd dkr6y4ee jddddZeejdƒeejdƒƒWn2e k r4ZzeejdƒWYddZ[XnXdS)éN)Ú*)Úcopyc @sˆeZdZd3Zed4ZiZdZdZdZdZ dZ dd„Zdd„Zd d!„Z d"d#„Zd$d%„Zd&d'„Zd(d)„Zd*d+„Zd,d-„Zd.d/„Zd0d1„Zd2S)5Ú PolicyLexÚPOLICYÚALGORITHM_POLICYÚZONEÚ ALGORITHMÚ DIRECTORYÚKEYTTLÚKEY_SIZEÚROLL_PERIODÚPRE_PUBLISHÚPOST_PUBLISHÚCOVERAGEÚSTANDBYÚNONEÚ DATESUFFIXÚKEYTYPEÚALGNAMEÚSTRÚQSTRINGÚNUMBERÚLBRACEÚRBRACEÚSEMIz z (//|\#).*z\{z\}ú;cCs|jj|jjdƒ7_dS)z\n+Ú N)ÚlexerÚlinenoÚvalueÚcount)ÚselfÚt©r#ú/usr/lib/python3.6/policy.pyÚ t_newline7szPolicyLex.t_newlinecCs|jj|jjdƒ7_dS)z/\*(.|\n)*?\*/rN)rrrr )r!r"r#r#r$Ú t_comment;szPolicyLex.t_commentcCstjd|jƒjdƒjƒ|_|S)z°(?i)(?<=[0-9 \t])(y(?:ears|ear|ea|e)?|mo(?:nths|nth|nt|n)?|w(?:eeks|eek|ee|e)?|d(?:ays|ay|a)?|h(?:ours|our|ou|o)?|mi(?:nutes|nute|nut|nu|n)?|s(?:econds|econd|econ|eco|ec|e)?)\bz(?i)(y|mo|w|d|h|mi|s)([a-z]*)é)ÚreÚmatchrÚgroupÚlower)r!r"r#r#r$Út_DATESUFFIX?szPolicyLex.t_DATESUFFIXcCs|jjƒ|_|S)z(?i)\b(KSK|ZSK)\b)rÚupper)r!r"r#r#r$Ú t_KEYTYPEDszPolicyLex.t_KEYTYPEcCs|jjƒ|_|S)zƒ(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b)rr-)r!r"r#r#r$Ú t_ALGNAMEIszPolicyLex.t_ALGNAMEcCs|jj|jdƒ|_|S)z[A-Za-z._-][\w._-]*r)Úreserved_mapÚgetrÚtype)r!r"r#r#r$Út_STRNszPolicyLex.t_STRcCs&|jj|jdƒ|_|jdd…|_|S)z"([^"\n]|(\\"))*"rr'éÿÿÿÿ)r0r1rr2)r!r"r#r#r$Ú t_QSTRINGSszPolicyLex.t_QSTRINGcCst|jƒ|_|S)z\d+)Úintr)r!r"r#r#r$Út_NUMBERYszPolicyLex.t_NUMBERcCs"td|jdƒ|jjdƒdS)NzIllegal character '%s'rr')ÚprintrrÚskip)r!r"r#r#r$Út_error^szPolicyLex.t_errorcKsbdttƒkrtjddƒ}n tddƒ}x"|jD]}||j|jƒj|ƒ<q,Wtjfd|i|—Ž|_dS)NÚ maketransÚ_ú-Úobject) ÚdirÚstrr;Úreservedr0r+Ú translateÚlexr)r!ÚkwargsZtransÚrr#r#r$Ú__init__bs zPolicyLex.__init__cCs.|jj|ƒx|jjƒ}|sPt|ƒqWdS)N)rÚinputÚtokenr8)r!Útextr"r#r#r$Útestks zPolicyLex.testN) rrrrr r rrr rrrr) rrrrrrrrr)Ú__name__Ú __module__Ú__qualname__rAÚtokensr0Zt_ignoreZt_ignore_olcommentZt_LBRACEZt_RBRACEZt_SEMIr%r&r,r.r/r3r5r7r:rFrJr#r#r#r$rsN rc @s¸eZdZdZdZdZdZdZdZdZ dZ dZdZdZ dZdZdZdZdZddgddgddgddgddgddgddgddddddœZddd„Zd d „Zdd„Zd d„Zdd„Zdd„ZdS)ÚPolicyFNiii)ÚDSAÚNSEC3DSAÚRSAMD5ÚRSASHA1ÚNSEC3RSASHA1Ú RSASHA256Ú RSASHA512ÚECCGOSTÚECDSAP256SHA256ÚECDSAP384SHA384ÚED25519ÚED448cCs||_||_||_dS)N)ÚnameÚ algorithmÚparent)r!r\r]r^r#r#r$rF”szPolicy.__init__cCsFd|jrdp"|jrdp"|jr dp"d|jp*d|jr8|jjp:d|jrRdt|jƒdpTd|jp\d|jrlt|jƒpnd|j r~t|j ƒp€d|j rt|j ƒp’d|jr¢t|jƒp¤d|jr´t|jƒp¶d|j rÆt|j ƒpÈd|jrØt|jƒpÚd|jrêt|jƒpìd|jrüt|jƒpþd|jrt|jƒpd|jr(t|jƒp*d|jr>t|jƒp@dfS) Na%spolicy %s: inherits %s directory %s algorithm %s coverage %s ksk_keysize %s zsk_keysize %s ksk_rollperiod %s zsk_rollperiod %s ksk_prepublish %s ksk_postpublish %s zsk_prepublish %s zsk_postpublish %s ksk_standby %s zsk_standby %s keyttl %s zconstructed zzone z algorithm ÚZUNKNOWNÚNoneú")Úis_constructedÚis_zoneÚis_algr\r^Ú directoryr@r]ÚcoverageÚksk_keysizeÚzsk_keysizeÚksk_rollperiodÚzsk_rollperiodÚksk_prepublishÚksk_postpublishÚzsk_prepublishÚzsk_postpublishÚksk_standbyÚzsk_standbyÚkeyttl)r!r#r#r$Ú__repr__šs( zPolicy.__repr__cCs |d|ko|dkSS)Nrr'r#)r!Zkey_sizeZ size_ranger#r#r$Z __verify_sizeÀszPolicy.__verify_sizecCs|jS)N)r\)r!r#r#r$Úget_nameÃszPolicy.get_namecCs|jS)N)rb)r!r#r#r$ÚconstructedÆszPolicy.constructedcCs$|jr:|jdk r:|j|jkr:t|jƒdd|j|jffS|jrj|jdk rj|j|jkrjdd|j|jffS|jrš|jdk rš|j|jkršdd|j|jffS|jrÊ|jdk rÊ|j|jkrÊdd|j|jffS|joì|joì|joì|j|j|jkrdd|j|j|jffS|jrL|jrL|jrL|j|j|jkrLdd|j|j|jffS|jdk r |jj |jƒ}|dk r´|j |j|ƒs’dd |j|ffS|j |j|ƒs´dd|j|ffS|jdkrÞ|jddkrÞdd|jfS|jdkr|jddkrdd|jfS|jd kr d|_d|_d!S)"zr Check if the values in the policy make sense :return: True/False if the policy passes validation NFz6KSK pre-publish period (%d) exceeds rollover period %dz7KSK post-publish period (%d) exceeds rollover period %dz6ZSK pre-publish period (%d) exceeds rollover period %dz7ZSK post-publish period (%d) exceeds rollover period %dz%KSK pre/post-publish periods (%d/%d) z"combined exceed rollover period %dz%ZSK pre/post-publish periods (%d/%d) z&KSK key size %d outside valid range %sz&ZSK key size %d outside valid range %srPrQé@rz$KSK key size %d not divisible by 64 zas required for DSAz$ZSK key size %d not divisible by 64 rWrXrYrZr[Tr_zGKSK pre/post-publish periods (%d/%d) combined exceed rollover period %dzGZSK pre/post-publish periods (%d/%d) combined exceed rollover period %d)rPrQz7KSK key size %d not divisible by 64 as required for DSA)rPrQz7ZSK key size %d not divisible by 64 as required for DSA)rWrXrYrZr[)Tr_) rirkr8rlrjrmrnr]Úvalid_key_sz_per_algor1Ú_Policy__verify_sizergrh)r!Zkey_sz_ranger#r#r$ÚvalidateÉsŒ zPolicy.validate)NNN)rKrLrMrcrdrbrirjrkrmrlrnrgrhrorprqrfrervrFrrrwrsrtrxr#r#r#r$rOvsD &rOc@seZdZdS)ÚPolicyExceptionN)rKrLrMr#r#r#r$ry)sryc@s.eZdZiZiZiZdZdZdZdEdd„Z dd„Z dd„Zd d „Zdd„Z d d„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd„Zdd „Zd!d"„Zd#d$„Zd%d&„Zd'd(„Zd)d*„Zd+d,„Zd-d.„Zd/d0„Zd1d2„Z d3d4„Z!d5d6„Z"d7d8„Z#d9d:„Z$d;d<„Z%d=d>„Z&d?d@„Z'dAdB„Z(dCdD„Z)dS)FÚ dnssec_policyNTcKsÄtƒ|_|jj|_d|kr"d|d<d|kr2d|d<tjfd|i|—Ž|_|jdƒtƒ}d|_d|_d|_ d|_ t|ƒ|jd<d|jd_d|jd_ d |jd_ t|ƒ|jd <d |jd _d |jd _ d |jd _ t|ƒ|jd<d|jd_d|jd_ t|ƒ|jd<d|jd_d|jd_ t|ƒ|jd <d |jd _d |jd _ t|ƒ|jd<d|jd_d|jd_ t|ƒ|jd<d|jd_d|jd_ t|ƒ|jd<d|jd_d|jd_ t|ƒ|jd<d|jd_d|jd_ d|jd_ d|jd_ t|ƒ|jd<d|jd_d|jd_ d|jd_ d|jd_ t|ƒ|jd<d|jd_d|jd_ d|jd_ d|jd_ t|ƒ|jd<d|jd_d|jd_ d|jd_ d|jd_ |rÀ|j|ƒdS)NÚdebugFÚwrite_tablesÚmoduleapolicy global { algorithm rsasha256; key-size ksk 2048; key-size zsk 2048; roll-period ksk 0; roll-period zsk 1y; pre-publish ksk 1mo; pre-publish zsk 1mo; post-publish ksk 1mo; post-publish zsk 1mo; standby ksk 0; standby zsk 0; keyttl 1h; coverage 6mo; }; policy default { policy global; };TirPirQrRrSrTrUrVrWrXrYrZr[)rÚplexrNÚyaccÚparserÚsetuprOr]rdrgrhrÚ alg_policyr\Úload)r!ÚfilenamerDÚpr#r#r$rF4s| zdnssec_policy.__init__c CsH||_d|_t|ƒ$}|jƒ}d|jj_|jj|ƒWdQRXd|_dS)NTr) r„ÚinitialÚopenÚreadr~rrr€Úparse)r!r„ÚfrIr#r#r$rƒ“s zdnssec_policy.loadcCs d|_d|jj_|jj|ƒdS)NTr)r†r~rrr€r‰)r!rIr#r#r$rs zdnssec_policy.setupc Ks`|jƒ}d}||jkr |j|}|dkrBt|jdƒ}||_d|_|jdkr„|jpZ|jd}x|rr|jrr|j}q^W|r~|jp€d|_|j|jkrž|j|j}nt dƒ‚|j dkrè|jp¾|jd}x|dk rÚ|j rÚ|j}qÂW|oä|j |_ |jdkr:|jp|jd}x|r"|jr"|j}qW|r2|jp6|j|_|jdkrŽ|jpV|jd}x|jrv|jrv|j}qZW|r†|jpŠ|j|_|j dkrâ|jpª|jd}x|jrÊ|j rÊ|j}q®W|rÚ|j pÞ|j |_ |jdkr6|jpþ|jd}x|jr|jr|j}qW|r.|jp2|j|_|jdkrŠ|jpR|jd}x|jrr|jrr|j}qVW|r‚|jp†|j|_|jdkrÞ|jp¦|jd}x|jrÆ|jrÆ|j}qªW|rÖ|jpÚ|j|_|jdkr2|jpú|jd}x|jr|jr|j}qþW|r*|jp.|j|_|jdkr†|jpN|jd}x|jrn|jrn|j}qRW|r~|jp‚|j|_|jdkrÚ|jp¢|jd}x|jrÂ|jrÂ|j}q¦W|rÒ|jpÖ|j|_|jdkr(|jpö|jd}x |dk r|jr|j}qúW|o$|j|_d|ks>|dr\|jƒ\}}|s\t |ƒ‚dS|S)NÚdefaultTzalgorithm not foundZ novalidate)r+Úzone_policyrÚnamed_policyr\rbr]r^r‚ryrerfrgrhrirjrkrmrlrnrqrx) r!ZzonerDÚzr…r^ZapZvalidÚmsgr#r#r$Úpolicy¢s¦ zdnssec_policy.policycCsdS)zBpolicylist : init policy | policylist policyNr#)r!r…r#r#r$Úp_policylist szdnssec_policy.p_policylistcCs d|_dS)zinit :FN)r†)r!r…r#r#r$Úp_initszdnssec_policy.p_initcCsdS)zTpolicy : alg_policy | zone_policy | named_policyNr#)r!r…r#r#r$Úp_policyszdnssec_policy.p_policycCs|d|d<dS)zAname : STR | KEYTYPE | DATESUFFIXr'rNr#)r!r…r#r#r$Úp_nameszdnssec_policy.p_namecCs,|djƒ|d<tjd|dƒs(tdƒ‚dS)zcdomain : STR | QSTRING | KEYTYPE | DATESUFFIXr'rz^[\w.-][\w.-]*$zinvalid domainN)Ústripr(r)ry)r!r…r#r#r$Úp_domain szdnssec_policy.p_domaincCstƒ|_dS)znew_policy :N)rOÚcurrent)r!r…r#r#r$Úp_new_policy*szdnssec_policy.p_new_policycCs(|d|j_d|j_|j|j|d<dS)zFalg_policy : ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMIéTN)r—r\rdr‚)r!r…r#r#r$Úp_alg_policy.szdnssec_policy.p_alg_policycCs8|djdƒ|j_d|j_|j|j|djdƒjƒ<dS)z=zone_policy : ZONE domain new_policy policy_option_group SEMIr™Ú.TN)Úrstripr—r\rcrŒr+)r!r…r#r#r$Ú p_zone_policy5szdnssec_policy.p_zone_policycCs$|d|j_|j|j|djƒ<dS)z>named_policy : POLICY name new_policy policy_option_group SEMIr™N)r—r\rr+)r!r…r#r#r$Úp_named_policy<szdnssec_policy.p_named_policycCs|d|d<dS)zduration : NUMBERr'rNr#)r!r…r#r#r$Úp_duration_1Bszdnssec_policy.p_duration_1cCsd|d<dS)zduration : NONENrr#)r!r…r#r#r$Úp_duration_2Gszdnssec_policy.p_duration_2cCsÚ|ddkr|dd|d<n¸|ddkr<|dd|d<nš|ddkrZ|dd |d<n||dd krx|dd|d<n^|ddkr–|dd |d<n@|ddkr´|dd|d<n"|ddkrÎ|d|d<ntdƒ‚dS)zduration : NUMBER DATESUFFIXr™Úyr'i€3árÚmoi'Úwi€: Údi€QÚhiZmié<Úszinvalid durationN)ry)r!r…r#r#r$Úp_duration_3Lszdnssec_policy.p_duration_3cCsdS)z6policy_option_group : LBRACE policy_option_list RBRACENr#)r!r…r#r#r$Úp_policy_option_group_sz#dnssec_policy.p_policy_option_groupcCsdS)zmpolicy_option_list : policy_option SEMI | policy_option_list policy_option SEMINr#)r!r…r#r#r$Úp_policy_option_listcsz"dnssec_policy.p_policy_option_listcCsdS)a¥policy_option : parent_option | directory_option | coverage_option | rollperiod_option | prepublish_option | postpublish_option | keysize_option | algorithm_option | keyttl_option | standby_optionNr#)r!r…r#r#r$Úp_policy_optionhszdnssec_policy.p_policy_optioncCsdS)z0alg_option_group : LBRACE alg_option_list RBRACENr#)r!r…r#r#r$Úp_alg_option_groupusz dnssec_policy.p_alg_option_groupcCsdS)z^alg_option_list : alg_option SEMI | alg_option_list alg_option SEMINr#)r!r…r#r#r$Úp_alg_option_listyszdnssec_policy.p_alg_option_listcCsdS)aalg_option : coverage_option | rollperiod_option | prepublish_option | postpublish_option | keyttl_option | keysize_option | standby_optionNr#)r!r…r#r#r$Úp_alg_option~szdnssec_policy.p_alg_optioncCs|j|djƒ|j_dS)zparent_option : POLICY namer™N)rr+r—r^)r!r…r#r#r$Úp_parent_optionˆszdnssec_policy.p_parent_optioncCs|d|j_dS)z$directory_option : DIRECTORY QSTRINGr™N)r—re)r!r…r#r#r$Úp_directory_optionŒsz dnssec_policy.p_directory_optioncCs|d|j_dS)z#coverage_option : COVERAGE durationr™N)r—rf)r!r…r#r#r$Úp_coverage_optionszdnssec_policy.p_coverage_optioncCs*|ddkr|d|j_n|d|j_dS)z0rollperiod_option : ROLL_PERIOD KEYTYPE durationr™ÚKSKéN)r—rirj)r!r…r#r#r$Úp_rollperiod_option”sz!dnssec_policy.p_rollperiod_optioncCs*|ddkr|d|j_n|d|j_dS)z0prepublish_option : PRE_PUBLISH KEYTYPE durationr™r²r³N)r—rkrm)r!r…r#r#r$Úp_prepublish_option›sz!dnssec_policy.p_prepublish_optioncCs*|ddkr|d|j_n|d|j_dS)z2postpublish_option : POST_PUBLISH KEYTYPE durationr™r²r³N)r—rlrn)r!r…r#r#r$Úp_postpublish_option¢sz"dnssec_policy.p_postpublish_optioncCs*|ddkr|d|j_n|d|j_dS)z(keysize_option : KEY_SIZE KEYTYPE NUMBERr™r²r³N)r—rgrh)r!r…r#r#r$Úp_keysize_option©szdnssec_policy.p_keysize_optioncCs*|ddkr|d|j_n|d|j_dS)z'standby_option : STANDBY KEYTYPE NUMBERr™r²r³N)r—rorp)r!r…r#r#r$Úp_standby_option°szdnssec_policy.p_standby_optioncCs|d|j_dS)zkeyttl_option : KEYTTL durationr™N)r—rq)r!r…r#r#r$Úp_keyttl_option·szdnssec_policy.p_keyttl_optioncCs|d|j_dS)z$algorithm_option : ALGORITHM ALGNAMEr™N)r—r])r!r…r#r#r$Úp_algorithm_option»sz dnssec_policy.p_algorithm_optioncCsd|r.td|jpd|jrdnd|j|jfƒn2|js`td|jp@d|jrJdnd|rV|jpXdfƒ‚dS)Nz%s%s%d:syntax error near '%s'r_ú:z%s%s%d:unexpected end of inputr)r8r„rrr†ry)r!r…r#r#r$Úp_error¿szdnssec_policy.p_error)N)*rKrLrMr‚rrŒr—r„r†rFrƒrrr‘r’r“r”r–r˜ršrržrŸr r¨r©rªr«r¬rr®r¯r°r±r´rµr¶r·r¸r¹rºr¼r#r#r#r$rz,sN _ h rzÚ__main__r'rCr™)r{r‰T)r|r{r‹znonexistent.zone)r(Zply.lexrCZply.yaccrÚstringrrrOÚ ExceptionryrzrKÚsysÚargvr‡ÚfilerˆrIÚcloser~rJZppr8rrÚeÚargsr#r#r#r$Ús6 `4!