3

�
�i�N�c@s�
dd
lZdd
l
Z
dd
lZdd
lZdd
lZdd
lZdd
lZdd
lZdd
l	Zdd
l
Zdd
lZddlm
Z

ejrneZe
je�
Zd
add�Zdd�Zdd�Zd	d
�Zdd�ZGd
d�dejj�ZGdd�dejj�Zej Gdd�dej!j"��
Z#e#ej!j$�
e#_$e#ej!j%�
e#_%e#d��
e#_&e#d��
e#_'dd�d�D�
Z(d{d|�Z)d}d~�Z*dd��Z+d�d��Z,d�d��Z-d�d��Z.d�d��Z/d�d�d��
Z0d�d��Z1d�d��Z2d�d�d��
Z3d
S)��N)
�UnsafeIPAddresscCstdkrt
�atS)
N)�ipa_resolver�DNSResolver�rr�/usr/lib/python3.6/dnsutil.py�get_ipa_resolver.s

rcOst�j
||
�
S)
N)r�resolve)�args�kwargsrrrr5s
rcOst�j
||
�
S)
N)r�resolve_address)r	r
rrrr9s
rcOs d
|
krt�|
d
<t
jj||
�
S)N�resolver)r�dnsr�
zone_for_name)r	r
rrrr=s


rc
Cs
t�a
d
S)z Re-initialize ipa resolver.
    N)rrrrrr�reset_default_resolverDsrcsHeZ
dZd
Z�f
dd�Zdd�Z�f
dd�Zdd	�Z�f
d
d�Z�Z	S)ra4DNS stub resolver compatible with both dnspython < 2.0.0
    and dnspython >= 2.0.0.

    Set `use_search_by_default` attribute to `True`, which
    determines the default for whether the search list configured
    in the system's resolver configuration is used for relative
    names, and whether the resolver's domain may be added to relative
    names.

    Increase the default lifetime which determines the number of seconds
    to spend trying to get an answer to the question. dnspython 2.0.0
    changes this to 5sec, while the previous one was 30sec.
    c
sDd|_t
�j|
|�

|j�
tt
�d
|j�|_tt
�d|j�|_dS)Nrr)	Z_nameservers�super�__init__�reset_ipa_defaults�getattr�queryr�_resolve_addressr)�selfr	r
)
�	__class__rrrYs







zDNSResolver.__init__c

Cs,d|_t
|jt|j�
dd�|_d|_dS)a

        BIND's default timeout for resolver is 10sec.
        If that changes then it causes Timeout (instead of SERVFAIL)
        exception for dnspython if BIND under high load. So, let's make
        it the same + operation time.

        dnspython default is 2sec
        �
��-TN�)Ztimeout�min�len�nameserversZlifetimeZuse_search_by_default)
rrrrrds	
zDNSResolver.reset_ipa_defaultsc


st�j
�
|j�
dS)
N)r�resetr)
r)
rrrrss


zDNSResolver.resetcOs&|jt
jj|
�
f
|�d
t
jji
|��
S)zzQuery nameservers for PTR records.

        :param ip_address: IPv4 or IPv6 address
        :type ip_address: str
        �rdtype)rr
ZreversenameZfrom_address�	rdatatypeZPTR)rZ
ip_addressr	r
rrrrws

zDNSResolver._resolve_addressc
sJt�j
|
|�

ttj|j�
�
}d
}d}||kr@||kr@|j|�

||_dS)z�
        dnspython tries nameservers sequentially(not parallel).
        IPA controlled BIND always listen on IPv6 if available,
        so no need to send requests to both IPv4 and IPv6 endpoints
        of the same NS(though BIND handles this).
        z::1z	127.0.0.1N)r�read_resolv_conf�list�dict�fromkeysr�remove)rr	r
rZ
ipv6_loopbackZ
ipv4_loopback)
rrrr"�s





zDNSResolver.read_resolv_conf)
�__name__�
__module__�__qualname__�__doc__rrrrr"�
__classcell__rr)
rrrKs


rc@seZ
dZd
dhZdZdS)�DNSZoneAlreadyExists�zone�nszGDNS zone {zone} already exists in DNS and is handled by server(s): {ns}N)r'r(r)Zsupp_kwargsZfmtrrrrr,�s

r,cs�eZ
dZd
Zed(dd�
�
Zd)�f
dd�	Zdd�ZeZdd	�Z	d
d�Z
dd
�Zej
r\dd�Zndd�Z�f
dd�Z�f
dd�Z�f
dd�Z�f
dd�Zd*�f
dd�	Zdd�Zdd�Zd d!�Zd"d#�Zd$d%�Zd&d'�Z�ZS)+�DNSNameNcCs|tj
j|
|��
S)
N)r
�name�	from_text)�cls�labels�originrrrr1�szDNSName.from_textcs|yHt|
t
�r"tjjt|
�
|�j}
nt|
tjj�r6|
j}
tt	|�j
|
�

Wn.tk
rv
}
ztjj
|�
�
WYdd}~XnXdS)
N)�
isinstance�strr
r0r1�unicoder3�Namerr/r�UnicodeError�	exception�SyntaxError)rr3r4�
e)
rrrr�s






zDNSName.__init__c


Csd
S)NTr)
rrrr�__bool__�szDNSName.__bool__c

Cs
t|j
�
S)
N)r/r3)
rrrr�__copy__�s
zDNSName.__copy__cCstt
j|j|
��
S)
N)r/�copy�deepcopyr3)r�memorrr�__deepcopy__�s
zDNSName.__deepcopy__c


Cs|j�S)
N)
Z
to_unicode)
rrrr�__str__�s
zDNSName.__str__c

Cs|j�j
d
�
S)N�ascii)�to_text�decode)
rrrr�ToASCII�szDNSName.ToASCIIc


Cs|j�S)
N)
rE)
rrrrrG�s
c

stt
t|�j��
S)
N)r/r�canonicalize)
r)
rrrrH�s
zDNSName.canonicalizecstt
t|�j|
�
�
S)
N)r/r�concatenate)r�other)
rrrrI�s
zDNSName.concatenatecstt
t|�j|
�
�
S)
N)r/r�
relativize)rr4)
rrrrK�s
zDNSName.relativizecstt
t|�j|
�
�
S)
N)r/r�derelativize)rr4)
rrrrL�s
zDNSName.derelativizeTcstt
t|�j|
|d
��
S)N)r4rK)r/r�choose_relativity)rr4rK)
rrrrM�s

zDNSName.choose_relativityc

Cs|j|j
�
S)
N)rL�root)
rrrr�
make_absolute�s
zDNSName.make_absolutec

Cstd
d�|j
D�
�
S)Nc
ss|]}
|
jd�
V
qd
S)zxn--N)
�
startswith)�.0Zlabelrrr�	<genexpr>�sz!DNSName.is_idn.<locals>.<genexpr>)�anyr3)
rrrr�is_idn�s
zDNSName.is_idnc

Cs|j|j
�
S)
N)�is_subdomain�ip4_rev_zone)
rrrr�is_ip4_reverse�s
zDNSName.is_ip4_reversec

Cs|j|j
�
S)
N)rU�ip6_rev_zone)
rrrr�is_ip6_reverse�s
zDNSName.is_ip6_reversec


Cs|j�p|j
�S)
N)rWrY)
rrrr�
is_reverse�s
zDNSName.is_reversec

Cst|j
�
d
kS)Nr
)rr3)
rrrr�is_empty�s
zDNSName.is_empty)
N)
N)NT)r'r(r)r3�classmethodr1rr=Z__nonzero__r>rBrC�sixZPY2rGrHrIrKrLrMrOrTrWrYrZr[r+rr)
rrr/�s.



r/�in-addr�arpa��ip6c
Csg|]}
t|
�
j
��qSr)r/rO)rQ�aezrrr�
<listcomp>�src�10.IN-ADDR.ARPA�16.172.IN-ADDR.ARPA�17.172.IN-ADDR.ARPA�18.172.IN-ADDR.ARPA�19.172.IN-ADDR.ARPA�20.172.IN-ADDR.ARPA�21.172.IN-ADDR.ARPA�22.172.IN-ADDR.ARPA�23.172.IN-ADDR.ARPA�24.172.IN-ADDR.ARPA�25.172.IN-ADDR.ARPA�26.172.IN-ADDR.ARPA�27.172.IN-ADDR.ARPA�28.172.IN-ADDR.ARPA�29.172.IN-ADDR.ARPA�30.172.IN-ADDR.ARPA�31.172.IN-ADDR.ARPA�168.192.IN-ADDR.ARPA�64.100.IN-ADDR.ARPA�65.100.IN-ADDR.ARPA�66.100.IN-ADDR.ARPA�67.100.IN-ADDR.ARPA�68.100.IN-ADDR.ARPA�69.100.IN-ADDR.ARPA�70.100.IN-ADDR.ARPA�71.100.IN-ADDR.ARPA�72.100.IN-ADDR.ARPA�73.100.IN-ADDR.ARPA�74.100.IN-ADDR.ARPA�75.100.IN-ADDR.ARPA�76.100.IN-ADDR.ARPA�77.100.IN-ADDR.ARPA�78.100.IN-ADDR.ARPA�79.100.IN-ADDR.ARPA�80.100.IN-ADDR.ARPA�81.100.IN-ADDR.ARPA�82.100.IN-ADDR.ARPA�83.100.IN-ADDR.ARPA�84.100.IN-ADDR.ARPA�85.100.IN-ADDR.ARPA�86.100.IN-ADDR.ARPA�87.100.IN-ADDR.ARPA�88.100.IN-ADDR.ARPA�89.100.IN-ADDR.ARPA�90.100.IN-ADDR.ARPA�91.100.IN-ADDR.ARPA�92.100.IN-ADDR.ARPA�93.100.IN-ADDR.ARPA�94.100.IN-ADDR.ARPA�95.100.IN-ADDR.ARPA�96.100.IN-ADDR.ARPA�97.100.IN-ADDR.ARPA�98.100.IN-ADDR.ARPA�99.100.IN-ADDR.ARPA�100.100.IN-ADDR.ARPA�101.100.IN-ADDR.ARPA�102.100.IN-ADDR.ARPA�103.100.IN-ADDR.ARPA�104.100.IN-ADDR.ARPA�105.100.IN-ADDR.ARPA�106.100.IN-ADDR.ARPA�107.100.IN-ADDR.ARPA�108.100.IN-ADDR.ARPA�109.100.IN-ADDR.ARPA�110.100.IN-ADDR.ARPA�111.100.IN-ADDR.ARPA�112.100.IN-ADDR.ARPA�113.100.IN-ADDR.ARPA�114.100.IN-ADDR.ARPA�115.100.IN-ADDR.ARPA�116.100.IN-ADDR.ARPA�117.100.IN-ADDR.ARPA�118.100.IN-ADDR.ARPA�119.100.IN-ADDR.ARPA�120.100.IN-ADDR.ARPA�121.100.IN-ADDR.ARPA�122.100.IN-ADDR.ARPA�123.100.IN-ADDR.ARPA�124.100.IN-ADDR.ARPA�125.100.IN-ADDR.ARPA�126.100.IN-ADDR.ARPA�127.100.IN-ADDR.ARPA�0.IN-ADDR.ARPA�127.IN-ADDR.ARPA�254.169.IN-ADDR.ARPA�2.0.192.IN-ADDR.ARPA�100.51.198.IN-ADDR.ARPA�113.0.203.IN-ADDR.ARPA�255.255.255.255.IN-ADDR.ARPA�H0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA�H1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA�D.F.IP6.ARPA�8.E.F.IP6.ARPA�9.E.F.IP6.ARPA�A.E.F.IP6.ARPA�B.E.F.IP6.ARPA�8.B.D.0.1.0.0.2.IP6.ARPA�EMPTY.AS112.ARPAc

Cs2t|t
�std
t|�
�
�
|j�s.td|�
�
dS)a�
Raise AssertionError if name is not DNSName or is not absolute.

    >>> assert_absolute_dnsname(DNSName('absolute.name.example.'))
    >>> assert_absolute_dnsname(DNSName('relative.name.example'))
    Traceback (most recent call last):
      ...
    AssertionError: name must be absolute, ...
    >>> assert_absolute_dnsname('absolute.string.example.')
    Traceback (most recent call last):
      ...
    AssertionError: name must be DNSName instance, ...
    z'name must be DNSName instance, got '%s'zname must be absolute, got '%s'N)r5r/�AssertionError�typeZis_absolute)
r0rrr�assert_absolute_dnsname,
s

r�c

Cst|�

|t
kS)
a�
True if specified zone name exactly matches an automatic empty zone.

    >>> is_auto_empty_zone(DNSName('in-addr.arpa.'))
    False
    >>> is_auto_empty_zone(DNSName('10.in-addr.arpa.'))
    True
    >>> is_auto_empty_zone(DNSName('1.10.in-addr.arpa.'))
    False
    >>> is_auto_empty_zone(DNSName('10.in-addr.arpa'))
    Traceback (most recent call last):
      ...
    AssertionError: ...
    )r��EMPTY_ZONES)
r-rrr�is_auto_empty_zone?
s
r�c
Cs(t|�

xt
D]}
|j|
�
rd
SqWdS)a
True if specified absolute name is a subdomain of an automatic empty
    zone.

    DNS domain is a subdomain of itself so this function
    returns True for zone apexes, too.

    >>> inside_auto_empty_zone(DNSName('in-addr.arpa.'))
    False
    >>> inside_auto_empty_zone(DNSName('10.in-addr.arpa.'))
    True
    >>> inside_auto_empty_zone(DNSName('1.10.in-addr.arpa.'))
    True
    >>> inside_auto_empty_zone(DNSName('1.10.in-addr.arpa'))
    Traceback (most recent call last):
      ...
    AssertionError: ...
    TF)r�r�rU)r0rbrrr�inside_auto_empty_zoneQ
s






r�c

s6t��

t
jjt
jjt
jjh�
t��
fd
d�tD�
�
S)a�True if specified absolute name is a sub/superdomain of an automatic
    empty zone.

    DNS domain is a subdomain of itself so this function
    returns True for zone apexes, too.

    >>> related_to_auto_empty_zone(DNSName('.'))
    True
    >>> related_to_auto_empty_zone(DNSName('in-addr.arpa.'))
    True
    >>> related_to_auto_empty_zone(DNSName('10.in-addr.arpa.'))
    True
    >>> related_to_auto_empty_zone(DNSName('1.10.in-addr.arpa.'))
    True
    >>> related_to_auto_empty_zone(DNSName('unrelated.example.'))
    False
    >>> related_to_auto_empty_zone(DNSName('1.10.in-addr.arpa'))
    Traceback (most recent call last):
      ...
    AssertionError: ...
    c
3s |]}
�j|
�
d�
kV
qd
S)r
N)
Zfullcompare)rQrb)r0�	relationsrrrR�
s
z-related_to_auto_empty_zone.<locals>.<genexpr>)r�r
r0ZNAMERELN_SUBDOMAINZNAMERELN_EQUALZNAMERELN_SUPERDOMAINrSr�)
r0r)r0r�r�related_to_auto_empty_zonej
s





r�c
Cst|�
}
t
d
d�|
D�
�
S)a^
Detect if given host is using IP address belonging to
    an automatic empty zone.

    Information from --ip-address option used in installed is lost by
    the time when upgrade is run. Use IP addresses from DNS as best
    approximation.

    This is brain-dead and duplicates logic from DNS installer
    but I did not find other way around.
    c
ss|]}
tt
|
j�
�
V
qdS)
N)r�r/Zreverse_dns)rQ�iprrrrR�
s
z+has_empty_zone_addresses.<locals>.<genexpr>)�resolve_ip_addressesrS)Zhostname�ip_addressesrrr�has_empty_zone_addresses�
s


r�cCs
|
std
�
�
t
|t�st|�
}|j�}g}x�|
D]�}y@t||�}tjdt|�
||djdd�|D�
�
�
|j	|j
�

Wq0tjj
k
r�
}
ztjd|�
PWYdd}~Xq0tjjk
r�
}
ztjd|�
WYdd}~Xq0tjjk
�
r
}
ztjd|||�
�WYdd}~Xq0Xq0W|S)	a

    Get Resource Record sets for given FQDN.
    CNAME chain is followed during resolution
    but CNAMEs are not returned in the resulting rrset.

    :returns:
        set of dns.rrset.RRset objects, can be empty
        if the FQDN does not exist or if none of rrtypes exist
    zrdtypes must not be emptyzfound %d %s records for %s: %s�
 c
ss|]}
t|
�
V
qdS)
N)
r6)rQ�rrrrrrR�
sz!resolve_rrsets.<locals>.<genexpr>z%sNzDNS query for %s %s failed: %s)r�r5r/rOr�logger�debugr�join�append�rrsetr
rZNXDOMAINZNoAnswerr:�DNSException�error)�fqdnZrdtypes�rrsetsr �answerZexrrr�resolve_rrsets�
s.





















r�c
Cs:t|d
dg�}
t
�}x |
D]}|jdd�|D�
�

qW|S)z�Get IP addresses from DNS A/AAAA records for given host (using DNS).
    :returns:
        list of IP addresses as UnsafeIPAddress objects
    �
AZAAAAc
Ssh|]}
t|
�
�qSr)
r)rQr�rrr�	<setcomp>�
sz'resolve_ip_addresses.<locals>.<setcomp>)r��set�update)r�r�r�r�rrrr��
s





r�Tc Cs
tj
d
|�
t|t�s"t|�
j�}t|�
r.dSyt|�
}Wnntjj	k
r�
}
zNd||f}|
r�t|tj
j�r~tjd|�
dSt
|�
�
ntjd|�
dSWYdd}~XnX||k�
rydd�t|d�D�
}Wn:tjj	k
�
r
}
ztjd||�
g}WYdd}~XnXt|j�|d��
dS)	Nz'Checking DNS domain %s, please wait ...z#DNS check for domain %s failed: %s.z%sc
Ssg|]}
|
j��qSr)
rE)rQZansrrrrc�
sz&check_zone_overlap.<locals>.<listcomp>ZNSz1Failed to resolve nameserver(s) for domain %s: %s)r-r.)r��infor5r/rOr�rr
r:r�rZ
NoNameserversZwarning�
ValueErrorrr�r,rE)r-Zraise_on_errorZcontaining_zoner<�msgr.rrr�check_zone_overlap�
s0



















r�c
s�t�
�
d
k
r�
St
�
f
dd��
D�
�
r4tj�
�

�
Sd�g}
t�
�
�
xnt�
�
d
kr�tjdt�f
dd��
D�
�
�}d}x:�
j�D].}||jp��7}||kr~�
j	|�

|
j
|�

q~WqFW�
r�|
j
�
j��

|
S)z?Weighted population sorting for records with same priority
    �
c
3s|]}
|
j�djkV
qd
S)r
N)
�weight)rQr�)
�recordsrrrR�
sz_mix_weight.<locals>.<genexpr>g{�G�z�?r
c
3s|]}
|
jp�V
qdS)
N)
r�)rQr�)
�noweightrrrRsg)r�all�randomZshuffler�Zuniform�sumr?r�r&r��pop)r��resultZurnZaccr�r)r�r�r�_mix_weight�
s&















r�c
Cs�t|t
jd
�
d�}g}
t�}x:|D]2}|jt|dd�f}||kr"|
j|�

|j|�

q"Wg}g}xB|
D]:}|s�|dj|jkr�|j|�

qf|j	t
|�
�

|g
}qfW|r�|j	t
|�
�

|S)a.
RFC 2782 sorting algorithm for SRV and URI records

    RFC 2782 defines a sorting algorithms for SRV records, that is also used
    for sorting URI records. Records are sorted by priority and than randomly
    shuffled according to weight.

    This implementation also removes duplicate entries.
    �priority)
�keyZportNr
)�sorted�operator�
attrgetterr��targetrr��addr��extendr�)r�Z
uniquerecords�seenr�r�r�Zsamepriorrr�sort_prio_weights$














r�cKs<|
d
krt}nt
|
d|
j�}||f
dtjji
|��
}t|�
S)z�Query SRV records and sort reply according to RFC 2782

    :param qname: query name, _service._proto.domain.
    :return: list of dns.rdtypes.IN.SRV.SRV instances
    Nrr )rrrr
r!ZSRVr�)Zqnamerr
Z	resolve_fr�rrr�	query_srv;s



r�)r^r_r`)rar_r`)brdrerfrgrhrirjrkrlrmrnrorprqrrrsrtrurvrwrxryrzr{r|r}r~rr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�)
T)
N)4r?Zloggingr�r�Zdns.namer
Z
dns.exceptionZdns.resolverZdns.rdataclassZ
dns.rdatatypeZdns.reversenamer]Zipapython.ipautilrZPY3r6r7Z	getLoggerr'r�rrrrrrrZResolverrr:r�r,Zpython_2_unicode_compatibler0r8r/rN�emptyrVrXr�r�r�r�r�r�r�r�r�r�r�r�rrrr�<module>s�









J
Q






































'
%!(