a
{)j`
@ s@ d dl Z d dlmZ d dlmZ d dlT d dlmZ G dd dZG dd dZG dd d e Z
G d
d d Z e d krt| jp@df S ) Na %spolicy %s:
inherits %s
directory %s
algorithm %s
coverage %s
ksk_keysize %s
zsk_keysize %s
ksk_rollperiod %s
zsk_rollperiod %s
ksk_prepublish %s
ksk_postpublish %s
zsk_prepublish %s
zsk_postpublish %s
ksk_standby %s
zsk_standby %s
keyttl %s
z constructed zzone z
algorithm ZUNKNOWNNone")is_constructedis_zoneis_algrM rO directoryr4 rN coverage ksk_keysize zsk_keysizeksk_rollperiodzsk_rollperiodksk_prepublishksk_postpublishzsk_prepublishzsk_postpublish ksk_standby zsk_standbykeyttlr r r r __repr__ s2
zPolicy.__repr__c C s |d | ko|d kS S )Nr r r )r Zkey_sizeZ
size_ranger r r Z
__verify_size s zPolicy.__verify_sizec C s | j S r; )rM rc r r r get_name s zPolicy.get_namec C s | j S r; )rS rc r r r constructed s zPolicy.constructedc C s | j r:| jdur:| j| j kr:t| j dd| j| j f fS | j rj| jdurj| j| j krjdd| j| j f fS | jr| jdur| j| jkrdd| j| jf fS | jr| jdur| j| jkrdd| j| jf fS | j r| jr| jr| j| j | j krdd| j| j| j f fS | jrR| jrR| jrR| j| j | jkrRdd| j| j| jf fS | jdur| j | j}|dur|
| j |sdd | j |f fS |
| j |sdd
| j |f fS | jd v rd| _ d| _ d S )
zr Check if the values in the policy make sense
:return: True/False if the policy passes validation
NFz6KSK pre-publish period (%d) exceeds rollover period %dz7KSK post-publish period (%d) exceeds rollover period %dz6ZSK pre-publish period (%d) exceeds rollover period %dz7ZSK post-publish period (%d) exceeds rollover period %dzGKSK pre/post-publish periods (%d/%d) combined exceed rollover period %dzGZSK pre/post-publish periods (%d/%d) combined exceed rollover period %dz&KSK key size %d outside valid range %sz&ZSK key size %d outside valid range %s)rI rJ rK rL )TrP )
rZ r\ r, r] r[ r^ r_ rN valid_key_sz_per_algor% _Policy__verify_sizerX rY )r Z key_sz_ranger r r validate s
zPolicy.validate)NNN)r@ rA rB rT rU rS rZ r[ r\ r^ r] r_ rX rY r` ra rb rW rV rg r: rd rh re rf ri r r r r rD v s>
&rD c @ s e Zd ZdS )PolicyExceptionN)r@ rA rB r r r r rj s rj c @ s. e Zd Zi Zi Zi ZdZdZdZdEddZ dd Z
dd Z d d
Z d d Z
d
d Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Z d+d, Z d-d. Z d/d0 Z d1d2 Z d3d4 Z!d5d6 Z"d7d8 Z#d9d: Z$d;d< Z%d=d> Z&d?d@ Z'dAdB Z(dCdD Z)dS )F
dnssec_policyNTc K s t | _| jj| _d|vr"d|d< d|vr2d|d< tjf d| i|| _| d t }d |_d|_d|_ d|_
t || j d< d| j d _d| j d _
t || j d < d | j d _d | j d _
t || j d
< d
| j d
_d
| j d
_
t || j d < d | j d _d | j d _
t || j d < d | j d _d | j d _
d | j d _ d | j d _
t || j d
< d
| j d
_d
| j d
_
d | j d
_ d | j d
_
t || j d< d| j d _d| j d _
d | j d _ d | j d _
t || j d< d| j d _d| j d _
d | j d _ d | j d _
|r| | d S )NdebugF write_tablesmodulea policy global { algorithm rsasha256;
key-size ksk 2048;
key-size zsk 2048;
roll-period ksk 0;
roll-period zsk 1y;
pre-publish ksk 1mo;
pre-publish zsk 1mo;
post-publish ksk 1mo;
post-publish zsk 1mo;
standby ksk 0;
standby zsk 0;
keyttl 1h;
coverage 6mo; };
policy default { policy global; };Ti rE rF rG rH rI rJ rK rL )r plexrC yaccparsersetuprD rN rU rX rY r
alg_policyrM load)r filenamer8 pr r r r: " s^
zdnssec_policy.__init__c C s\ || _ d| _t|.}| }d| jj_| j| W d n1 sH0 Y d | _ d S NTr ) ru initialopenreadro r r rq parse)r ru fr> r r r rt o s
*zdnssec_policy.loadc C s d| _ d| jj_| j| d S rw )rx ro r r rq r{ )r r> r r r rr y s
zdnssec_policy.setupc K s | }d }|| jv r | j| }|d u rBt| jd }||_d|_|jd u r~|jpZ| jd }|rn|jsn|j}q\|rx|jpzd |_|j| jv r| j|j }nt d|j
d u r|jp| jd }|d ur|j
s|j}q|o|j
|_
|j d u r$|jp| jd }|r|j s|j}q|r |j p |j |_ |j d u rr|jp@| jd }|jr\|j s\|j}qB|rj|j pn|j |_ |j
d u r|jp| jd }|jr|j
s|j}q|r|j
p|j
|_
|jd u r|jp| jd }|jr|js|j}q|r|jp
|j|_|jd u r\|jp*| jd }|jrF|jsF|j}q,|rT|jpX|j|_|jd u r|jpx| jd }|jr|js|j}qz|r|jp|j|_|jd u r|jp| jd }|jr|js|j}q|r|jp|j|_|jd u rF|jp| jd }|jr0|js0|j}q|r>|jpB|j|_|jd u r|jpb| jd }|jr~|js~|j}qd|r|jp|j|_|jd u r|jp| jd }|d ur|js|j}q|o|j|_d|vs|d s| \}}|st |d S |S )NdefaultTzalgorithm not foundZ
novalidate)r zone_policyr named_policyrM rS rN rO rs rj rV rW rX rY rZ r[ r\ r^ r] r_ rb ri ) r zoner8 zrv rO ZapZvalidmsgr r r policy~ s
zdnssec_policy.policyc C s dS )zBpolicylist : init policy
| policylist policyNr r rv r r r p_policylist s zdnssec_policy.p_policylistc C s
d| _ dS )zinit :FN)rx r r r r p_init s zdnssec_policy.p_initc C s dS )zTpolicy : alg_policy
| zone_policy
| named_policyNr r r r r p_policy s zdnssec_policy.p_policyc C s |d |d< dS )zAname : STR
| KEYTYPE
| DATESUFFIXr r Nr r r r r p_name s zdnssec_policy.p_namec C s, |d |d< td|d s(tddS )zcdomain : STR
| QSTRING
| KEYTYPE
| DATESUFFIXr r z^[\w.-][\w.-]*$zinvalid domainN)stripr r rj r r r r p_domain s zdnssec_policy.p_domainc C s t | _dS )z new_policy :N)rD currentr r r r p_new_policy s zdnssec_policy.p_new_policyc C s( |d | j _d| j _| j | j|d < dS )zFalg_policy : ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMI TN)r rM rU rs r r r r p_alg_policy
s zdnssec_policy.p_alg_policyc C s8 |d d| j_d| j_| j| j|d d < dS )z=zone_policy : ZONE domain new_policy policy_option_group SEMIr .TN)rstripr rM rT r~ r r r r r
p_zone_policy s zdnssec_policy.p_zone_policyc C s$ |d | j _| j | j|d < dS )z>named_policy : POLICY name new_policy policy_option_group SEMIr N)r rM r r r r r r p_named_policy s z dnssec_policy.p_named_policyc C s |d |d< dS )zduration : NUMBERr r Nr r r r r p_duration_1 s zdnssec_policy.p_duration_1c C s d|d< dS )zduration : NONENr r r r r r p_duration_2# s zdnssec_policy.p_duration_2c C s |d dkr |d d |d< n|d dkr<|d d |d< n|d dkrZ|d d |d< n||d d
krx|d d |d< n^|d d kr|d d
|d< n@|d dkr|d d |d< n"|d dkr|d |d< nt ddS )z duration : NUMBER DATESUFFIXr yr i3r moi ' wi: diQ hi mi< szinvalid durationN)rj r r r r p_duration_3( s zdnssec_policy.p_duration_3c C s dS )z6policy_option_group : LBRACE policy_option_list RBRACENr r r r r p_policy_option_group; s z#dnssec_policy.p_policy_option_groupc C s dS )zmpolicy_option_list : policy_option SEMI
| policy_option_list policy_option SEMINr r r r r p_policy_option_list? s z"dnssec_policy.p_policy_option_listc C s dS )a policy_option : parent_option
| directory_option
| coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keysize_option
| algorithm_option
| keyttl_option
| standby_optionNr r r r r p_policy_optionD s z dnssec_policy.p_policy_optionc C s dS )z0alg_option_group : LBRACE alg_option_list RBRACENr r r r r p_alg_option_groupQ s z dnssec_policy.p_alg_option_groupc C s dS )z^alg_option_list : alg_option SEMI
| alg_option_list alg_option SEMINr r r r r p_alg_option_listU s z dnssec_policy.p_alg_option_listc C s dS )a alg_option : coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keyttl_option
| keysize_option
| standby_optionNr r r r r p_alg_optionZ s zdnssec_policy.p_alg_optionc C s | j |d | j_dS )zparent_option : POLICY namer N)r r r rO r r r r p_parent_optiond s z dnssec_policy.p_parent_optionc C s |d | j _dS )z$directory_option : DIRECTORY QSTRINGr N)r rV r r r r p_directory_optionh s z dnssec_policy.p_directory_optionc C s |d | j _dS )z#coverage_option : COVERAGE durationr N)r rW r r r r p_coverage_optionl s z dnssec_policy.p_coverage_optionc C s* |d dkr|d | j _n |d | j _dS )z0rollperiod_option : ROLL_PERIOD KEYTYPE durationr KSK N)r rZ r[ r r r r p_rollperiod_optionp s z!dnssec_policy.p_rollperiod_optionc C s* |d dkr|d | j _n |d | j _dS )z0prepublish_option : PRE_PUBLISH KEYTYPE durationr r r N)r r\ r^ r r r r p_prepublish_optionw s z!dnssec_policy.p_prepublish_optionc C s* |d dkr|d | j _n |d | j _dS )z2postpublish_option : POST_PUBLISH KEYTYPE durationr r r N)r r] r_ r r r r p_postpublish_option~ s z"dnssec_policy.p_postpublish_optionc C s* |d dkr|d | j _n |d | j _dS )z(keysize_option : KEY_SIZE KEYTYPE NUMBERr r r N)r rX rY r r r r p_keysize_option s z dnssec_policy.p_keysize_optionc C s* |d dkr|d | j _n |d | j _dS )z'standby_option : STANDBY KEYTYPE NUMBERr r r N)r r` ra r r r r p_standby_option s z dnssec_policy.p_standby_optionc C s |d | j _dS )z keyttl_option : KEYTTL durationr N)r rb r r r r p_keyttl_option s z dnssec_policy.p_keyttl_optionc C s |d | j _dS )z$algorithm_option : ALGORITHM ALGNAMEr N)r rN r r r r p_algorithm_option s z dnssec_policy.p_algorithm_optionc C sd |r.t d| jpd| jrdnd|j|jf n2| js`td| jp@d| jrJdnd|rV|jpXdf d S )Nz %s%s%d:syntax error near '%s'rP :z %s%s%d:unexpected end of inputr )r, ru r r rx rj r r r r p_error s zdnssec_policy.p_error)N)*r@ rA rB rs r r~ r ru rx r: rt rr r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r rk sN
M
h
rk __main__r r7 r )rl r{ T)rm rl r} znonexistent.zone) r Zply.lexr7 Zply.yaccrp stringr r rD Exceptionrj rk r@ sysargvry filerz r> closero r? ppr, r r eargsr r r r s6 ` "