Gecko [ www.corporacionhdm.com.pe ]

Name	Size	Permission	Date
__pycache__	[ DIR ]	drwxr-xr-x	2025-04-04 08:00
dnssecalgs	[ DIR ]	drwxr-xr-x	2025-04-04 08:00
quic	[ DIR ]	drwxr-xr-x	2025-04-04 08:00
rdtypes	[ DIR ]	drwxr-xr-x	2025-04-04 08:00
__init__.py	1.62 KB	-rw-r--r--	2025-04-04 08:00
_asyncbackend.py	2.34 KB	-rw-r--r--	2025-04-04 08:00
_asyncio_backend.py	8.84 KB	-rw-r--r--	2025-04-04 08:00
_ddr.py	5.12 KB	-rw-r--r--	2025-04-04 08:00
_features.py	2.43 KB	-rw-r--r--	2025-04-04 08:00
_immutable_ctx.py	2.4 KB	-rw-r--r--	2025-04-04 08:00
_trio_backend.py	8.27 KB	-rw-r--r--	2025-04-04 08:00
asyncbackend.py	2.73 KB	-rw-r--r--	2025-04-04 08:00
asyncquery.py	30.1 KB	-rw-r--r--	2025-04-04 08:00
asyncresolver.py	17.43 KB	-rw-r--r--	2025-04-04 08:00
dnssec.py	40.74 KB	-rw-r--r--	2025-04-04 08:00
dnssectypes.py	1.76 KB	-rw-r--r--	2025-04-04 08:00
e164.py	3.88 KB	-rw-r--r--	2025-04-04 08:00
edns.py	16.69 KB	-rw-r--r--	2025-04-04 08:00
entropy.py	4.14 KB	-rw-r--r--	2025-04-04 08:00
enum.py	3.6 KB	-rw-r--r--	2025-04-04 08:00
exception.py	5.81 KB	-rw-r--r--	2025-04-04 08:00
flags.py	2.69 KB	-rw-r--r--	2025-04-04 08:00
grange.py	2.09 KB	-rw-r--r--	2025-04-04 08:00
immutable.py	1.97 KB	-rw-r--r--	2025-04-04 08:00
inet.py	5.64 KB	-rw-r--r--	2025-04-04 08:00
ipv4.py	2.49 KB	-rw-r--r--	2025-04-04 08:00
ipv6.py	6.4 KB	-rw-r--r--	2025-04-04 08:00
message.py	66.59 KB	-rw-r--r--	2025-04-04 08:00
name.py	41.78 KB	-rw-r--r--	2025-04-04 08:00
namedict.py	3.91 KB	-rw-r--r--	2025-04-04 08:00
nameserver.py	9.88 KB	-rw-r--r--	2025-04-04 08:00
node.py	12.37 KB	-rw-r--r--	2025-04-04 08:00
opcode.py	2.67 KB	-rw-r--r--	2025-04-04 08:00
py.typed	0 B	-rw-r--r--	2025-04-04 08:00
query.py	54.98 KB	-rw-r--r--	2025-04-04 08:00
rcode.py	4.06 KB	-rw-r--r--	2025-04-04 08:00
rdata.py	30.29 KB	-rw-r--r--	2025-04-04 08:00
rdataclass.py	2.91 KB	-rw-r--r--	2025-04-04 08:00
rdataset.py	16.27 KB	-rw-r--r--	2025-04-04 08:00
rdatatype.py	7.27 KB	-rw-r--r--	2025-04-04 08:00
renderer.py	10.99 KB	-rw-r--r--	2025-04-04 08:00
resolver.py	72 KB	-rw-r--r--	2025-04-04 08:00
reversename.py	3.74 KB	-rw-r--r--	2025-04-04 08:00
rrset.py	8.96 KB	-rw-r--r--	2025-04-04 08:00
serial.py	3.52 KB	-rw-r--r--	2025-04-04 08:00
set.py	9 KB	-rw-r--r--	2025-04-04 08:00
tokenizer.py	23.03 KB	-rw-r--r--	2025-04-04 08:00
transaction.py	22.06 KB	-rw-r--r--	2025-04-04 08:00
tsig.py	11.15 KB	-rw-r--r--	2025-04-04 08:00
tsigkeyring.py	2.57 KB	-rw-r--r--	2025-04-04 08:00
ttl.py	2.91 KB	-rw-r--r--	2025-04-04 08:00
update.py	11.96 KB	-rw-r--r--	2025-04-04 08:00
version.py	1.88 KB	-rw-r--r--	2025-04-04 08:00
versioned.py	11.49 KB	-rw-r--r--	2025-04-04 08:00
win32util.py	8.67 KB	-rw-r--r--	2025-04-04 08:00
wire.py	2.76 KB	-rw-r--r--	2025-04-04 08:00
xfr.py	12.96 KB	-rw-r--r--	2025-04-04 08:00
zone.py	50.87 KB	-rw-r--r--	2025-04-04 08:00
zonefile.py	27.27 KB	-rw-r--r--	2025-04-04 08:00
zonetypes.py	690 B	-rw-r--r--	2025-04-04 08:00

Rename

# Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license
#
# Support for Discovery of Designated Resolvers

import socket
import time
from urllib.parse import urlparse

import dns.asyncbackend
import dns.inet
import dns.name
import dns.nameserver
import dns.query
import dns.rdtypes.svcbbase

# The special name of the local resolver when using DDR
_local_resolver_name = dns.name.from_text("_dns.resolver.arpa")

#
# Processing is split up into I/O independent and I/O dependent parts to
# make supporting sync and async versions easy.
#

class _SVCBInfo:
    def __init__(self, bootstrap_address, port, hostname, nameservers):
        self.bootstrap_address = bootstrap_address
        self.port = port
        self.hostname = hostname
        self.nameservers = nameservers

def ddr_check_certificate(self, cert):
        """Verify that the _SVCBInfo's address is in the cert's subjectAltName (SAN)"""
        for name, value in cert["subjectAltName"]:
            if name == "IP Address" and value == self.bootstrap_address:
                return True
        return False

def make_tls_context(self):
        ssl = dns.query.ssl
        ctx = ssl.create_default_context()
        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
        return ctx

def ddr_tls_check_sync(self, lifetime):
        ctx = self.make_tls_context()
        expiration = time.time() + lifetime
        with socket.create_connection(
            (self.bootstrap_address, self.port), lifetime
        ) as s:
            with ctx.wrap_socket(s, server_hostname=self.hostname) as ts:
                ts.settimeout(dns.query._remaining(expiration))
                ts.do_handshake()
                cert = ts.getpeercert()
                return self.ddr_check_certificate(cert)

async def ddr_tls_check_async(self, lifetime, backend=None):
        if backend is None:
            backend = dns.asyncbackend.get_default_backend()
        ctx = self.make_tls_context()
        expiration = time.time() + lifetime
        async with await backend.make_socket(
            dns.inet.af_for_address(self.bootstrap_address),
            socket.SOCK_STREAM,
            0,
            None,
            (self.bootstrap_address, self.port),
            lifetime,
            ctx,
            self.hostname,
        ) as ts:
            cert = await ts.getpeercert(dns.query._remaining(expiration))
            return self.ddr_check_certificate(cert)

def _extract_nameservers_from_svcb(answer):
    bootstrap_address = answer.nameserver
    if not dns.inet.is_address(bootstrap_address):
        return []
    infos = []
    for rr in answer.rrset.processing_order():
        nameservers = []
        param = rr.params.get(dns.rdtypes.svcbbase.ParamKey.ALPN)
        if param is None:
            continue
        alpns = set(param.ids)
        host = rr.target.to_text(omit_final_dot=True)
        port = None
        param = rr.params.get(dns.rdtypes.svcbbase.ParamKey.PORT)
        if param is not None:
            port = param.port
        # For now we ignore address hints and address resolution and always use the
        # bootstrap address
        if b"h2" in alpns:
            param = rr.params.get(dns.rdtypes.svcbbase.ParamKey.DOHPATH)
            if param is None or not param.value.endswith(b"{?dns}"):
                continue
            path = param.value[:-6].decode()
            if not path.startswith("/"):
                path = "/" + path
            if port is None:
                port = 443
            url = f"https://{host}:{port}{path}"
            # check the URL
            try:
                urlparse(url)
                nameservers.append(dns.nameserver.DoHNameserver(url, bootstrap_address))
            except Exception:
                # continue processing other ALPN types
                pass
        if b"dot" in alpns:
            if port is None:
                port = 853
            nameservers.append(
                dns.nameserver.DoTNameserver(bootstrap_address, port, host)
            )
        if b"doq" in alpns:
            if port is None:
                port = 853
            nameservers.append(
                dns.nameserver.DoQNameserver(bootstrap_address, port, True, host)
            )
        if len(nameservers) > 0:
            infos.append(_SVCBInfo(bootstrap_address, port, host, nameservers))
    return infos

def _get_nameservers_sync(answer, lifetime):
    """Return a list of TLS-validated resolver nameservers extracted from an SVCB
    answer."""
    nameservers = []
    infos = _extract_nameservers_from_svcb(answer)
    for info in infos:
        try:
            if info.ddr_tls_check_sync(lifetime):
                nameservers.extend(info.nameservers)
        except Exception:
            pass
    return nameservers

async def _get_nameservers_async(answer, lifetime):
    """Return a list of TLS-validated resolver nameservers extracted from an SVCB
    answer."""
    nameservers = []
    infos = _extract_nameservers_from_svcb(answer)
    for info in infos:
        try:
            if await info.ddr_tls_check_async(lifetime):
                nameservers.extend(info.nameservers)
        except Exception:
            pass
    return nameservers