Gecko [ primetaxinc.net ]

Name	Size	Permission
__pycache__	[ DIR ]	drwxr-xr-x
dnssecalgs	[ DIR ]	drwxr-xr-x
quic	[ DIR ]	drwxr-xr-x
rdtypes	[ DIR ]	drwxr-xr-x
__init__.py	1.62 KB	-rw-r--r--
_asyncbackend.py	2.34 KB	-rw-r--r--
_asyncio_backend.py	8.84 KB	-rw-r--r--
_ddr.py	5.12 KB	-rw-r--r--
_features.py	2.43 KB	-rw-r--r--
_immutable_ctx.py	2.4 KB	-rw-r--r--
_trio_backend.py	8.27 KB	-rw-r--r--
asyncbackend.py	2.73 KB	-rw-r--r--
asyncquery.py	30.1 KB	-rw-r--r--
asyncresolver.py	17.43 KB	-rw-r--r--
dnssec.py	40.74 KB	-rw-r--r--
dnssectypes.py	1.76 KB	-rw-r--r--
e164.py	3.88 KB	-rw-r--r--
edns.py	16.69 KB	-rw-r--r--
entropy.py	4.14 KB	-rw-r--r--
enum.py	3.6 KB	-rw-r--r--
exception.py	5.81 KB	-rw-r--r--
flags.py	2.69 KB	-rw-r--r--
grange.py	2.09 KB	-rw-r--r--
immutable.py	1.97 KB	-rw-r--r--
inet.py	5.64 KB	-rw-r--r--
ipv4.py	2.49 KB	-rw-r--r--
ipv6.py	6.4 KB	-rw-r--r--
message.py	66.59 KB	-rw-r--r--
name.py	41.78 KB	-rw-r--r--
namedict.py	3.91 KB	-rw-r--r--
nameserver.py	9.88 KB	-rw-r--r--
node.py	12.37 KB	-rw-r--r--
opcode.py	2.67 KB	-rw-r--r--
py.typed	0 B	-rw-r--r--
query.py	54.98 KB	-rw-r--r--
rcode.py	4.06 KB	-rw-r--r--
rdata.py	30.29 KB	-rw-r--r--
rdataclass.py	2.91 KB	-rw-r--r--
rdataset.py	16.27 KB	-rw-r--r--
rdatatype.py	7.27 KB	-rw-r--r--
renderer.py	10.99 KB	-rw-r--r--
resolver.py	72 KB	-rw-r--r--
reversename.py	3.74 KB	-rw-r--r--
rrset.py	8.96 KB	-rw-r--r--
serial.py	3.52 KB	-rw-r--r--
set.py	9 KB	-rw-r--r--
tokenizer.py	23.03 KB	-rw-r--r--
transaction.py	22.06 KB	-rw-r--r--
tsig.py	11.15 KB	-rw-r--r--
tsigkeyring.py	2.57 KB	-rw-r--r--
ttl.py	2.91 KB	-rw-r--r--
update.py	11.96 KB	-rw-r--r--
version.py	1.88 KB	-rw-r--r--
versioned.py	11.49 KB	-rw-r--r--
win32util.py	8.67 KB	-rw-r--r--
wire.py	2.76 KB	-rw-r--r--
xfr.py	12.96 KB	-rw-r--r--
zone.py	50.87 KB	-rw-r--r--
zonefile.py	27.27 KB	-rw-r--r--
zonetypes.py	690 B	-rw-r--r--

Code Editor : _ddr.py

# Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license
#
# Support for Discovery of Designated Resolvers

import socket
import time
from urllib.parse import urlparse

import dns.asyncbackend
import dns.inet
import dns.name
import dns.nameserver
import dns.query
import dns.rdtypes.svcbbase

# The special name of the local resolver when using DDR
_local_resolver_name = dns.name.from_text("_dns.resolver.arpa")

#
# Processing is split up into I/O independent and I/O dependent parts to
# make supporting sync and async versions easy.
#

class _SVCBInfo:
    def __init__(self, bootstrap_address, port, hostname, nameservers):
        self.bootstrap_address = bootstrap_address
        self.port = port
        self.hostname = hostname
        self.nameservers = nameservers

def ddr_check_certificate(self, cert):
        """Verify that the _SVCBInfo's address is in the cert's subjectAltName (SAN)"""
        for name, value in cert["subjectAltName"]:
            if name == "IP Address" and value == self.bootstrap_address:
                return True
        return False

def make_tls_context(self):
        ssl = dns.query.ssl
        ctx = ssl.create_default_context()
        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
        return ctx

def ddr_tls_check_sync(self, lifetime):
        ctx = self.make_tls_context()
        expiration = time.time() + lifetime
        with socket.create_connection(
            (self.bootstrap_address, self.port), lifetime
        ) as s:
            with ctx.wrap_socket(s, server_hostname=self.hostname) as ts:
                ts.settimeout(dns.query._remaining(expiration))
                ts.do_handshake()
                cert = ts.getpeercert()
                return self.ddr_check_certificate(cert)

async def ddr_tls_check_async(self, lifetime, backend=None):
        if backend is None:
            backend = dns.asyncbackend.get_default_backend()
        ctx = self.make_tls_context()
        expiration = time.time() + lifetime
        async with await backend.make_socket(
            dns.inet.af_for_address(self.bootstrap_address),
            socket.SOCK_STREAM,
            0,
            None,
            (self.bootstrap_address, self.port),
            lifetime,
            ctx,
            self.hostname,
        ) as ts:
            cert = await ts.getpeercert(dns.query._remaining(expiration))
            return self.ddr_check_certificate(cert)

def _extract_nameservers_from_svcb(answer):
    bootstrap_address = answer.nameserver
    if not dns.inet.is_address(bootstrap_address):
        return []
    infos = []
    for rr in answer.rrset.processing_order():
        nameservers = []
        param = rr.params.get(dns.rdtypes.svcbbase.ParamKey.ALPN)
        if param is None:
            continue
        alpns = set(param.ids)
        host = rr.target.to_text(omit_final_dot=True)
        port = None
        param = rr.params.get(dns.rdtypes.svcbbase.ParamKey.PORT)
        if param is not None:
            port = param.port
        # For now we ignore address hints and address resolution and always use the
        # bootstrap address
        if b"h2" in alpns:
            param = rr.params.get(dns.rdtypes.svcbbase.ParamKey.DOHPATH)
            if param is None or not param.value.endswith(b"{?dns}"):
                continue
            path = param.value[:-6].decode()
            if not path.startswith("/"):
                path = "/" + path
            if port is None:
                port = 443
            url = f"https://{host}:{port}{path}"
            # check the URL
            try:
                urlparse(url)
                nameservers.append(dns.nameserver.DoHNameserver(url, bootstrap_address))
            except Exception:
                # continue processing other ALPN types
                pass
        if b"dot" in alpns:
            if port is None:
                port = 853
            nameservers.append(
                dns.nameserver.DoTNameserver(bootstrap_address, port, host)
            )
        if b"doq" in alpns:
            if port is None:
                port = 853
            nameservers.append(
                dns.nameserver.DoQNameserver(bootstrap_address, port, True, host)
            )
        if len(nameservers) > 0:
            infos.append(_SVCBInfo(bootstrap_address, port, host, nameservers))
    return infos

def _get_nameservers_sync(answer, lifetime):
    """Return a list of TLS-validated resolver nameservers extracted from an SVCB
    answer."""
    nameservers = []
    infos = _extract_nameservers_from_svcb(answer)
    for info in infos:
        try:
            if info.ddr_tls_check_sync(lifetime):
                nameservers.extend(info.nameservers)
        except Exception:
            pass
    return nameservers

async def _get_nameservers_async(answer, lifetime):
    """Return a list of TLS-validated resolver nameservers extracted from an SVCB
    answer."""
    nameservers = []
    infos = _extract_nameservers_from_svcb(answer)
    for info in infos:
        try:
            if await info.ddr_tls_check_async(lifetime):
                nameservers.extend(info.nameservers)
        except Exception:
            pass
    return nameservers

${this.title}

Code Editor : _ddr.py