def test_badtime_response(self):
fix_current_time(0x4da8b9d6)
test_qid = 0x7fc4
tsig = self.createMessageAndSign(test_qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA())
# "advance the clock" and try validating, which should fail due to
# BADTIME
fix_current_time(0x4da8be86)
self.commonVerifyChecks(self.tsig_verify_ctx, tsig, DUMMY_DATA,
TSIGError.BAD_TIME,
TSIGContext.STATE_RECEIVED_REQUEST)
# make and sign a response in the context of TSIG error.
tsig = self.createMessageAndSign(test_qid, self.test_name,
self.tsig_verify_ctx,
QR_FLAG, RRType.SOA(), None, None,
True, Rcode.NOTAUTH())
expected_otherdata = b"\x00\x00\x4d\xa8\xbe\x86"
expected_mac = b"\xd4\xb0\x43\xf6\xf4\x44\x95\xec\x8a\x01\x26" +\
b"\x0e\x39\x15\x9d\x76"
self.commonSignChecks(tsig, self.message.get_qid(), 0x4da8b9d6,
expected_mac,
18, # error: BADTIME
expected_otherdata)
def test_sign_using_uppercase_algorithm_name(self):
fix_current_time(0x4da8877a)
cap_ctx = TSIGContext(
TSIGKey(self.test_name, Name("HMAC-md5.SIG-alg.REG.int"),
self.secret))
tsig = self.createMessageAndSign(self.qid, self.test_name, cap_ctx)
self.commonSignChecks(tsig, self.qid, 0x4da8877a, COMMON_EXPECTED_MAC)
def test_sign_using_uppercase_keyname(self):
fix_current_time(0x4da8877a)
cap_ctx = TSIGContext(
TSIGKey(Name("WWW.EXAMPLE.COM"), TSIGKey.HMACMD5_NAME,
self.secret))
tsig = self.createMessageAndSign(self.qid, self.test_name, cap_ctx)
self.commonSignChecks(tsig, self.qid, 0x4da8877a, COMMON_EXPECTED_MAC)
def test_badtime_response(self):
fix_current_time(0x4da8b9d6)
test_qid = 0x7fc4
tsig = self.createMessageAndSign(test_qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA)
# "advance the clock" and try validating, which should fail due to
# BADTIME
fix_current_time(0x4da8be86)
self.commonVerifyChecks(self.tsig_verify_ctx, tsig, DUMMY_DATA,
TSIGError.BAD_TIME,
TSIGContext.STATE_RECEIVED_REQUEST)
# make and sign a response in the context of TSIG error.
tsig = self.createMessageAndSign(test_qid, self.test_name,
self.tsig_verify_ctx, QR_FLAG,
RRType.SOA, None, None, True,
Rcode.NOTAUTH)
expected_otherdata = b"\x00\x00\x4d\xa8\xbe\x86"
expected_mac = b"\xd4\xb0\x43\xf6\xf4\x44\x95\xec\x8a\x01\x26" +\
b"\x0e\x39\x15\x9d\x76"
self.commonSignChecks(
tsig,
self.message.get_qid(),
0x4da8b9d6,
expected_mac,
18, # error: BADTIME
expected_otherdata)
def test_sign_using_uppercase_algorithm_name(self):
fix_current_time(0x4da8877a)
cap_ctx = TSIGContext(TSIGKey(self.test_name,
Name("HMAC-md5.SIG-alg.REG.int"),
self.secret))
tsig = self.createMessageAndSign(self.qid, self.test_name, cap_ctx)
self.commonSignChecks(tsig, self.qid, 0x4da8877a, COMMON_EXPECTED_MAC)
def test_too_short_mac(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify10.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.BAD_SIG,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_too_short_mac(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify10.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.BAD_SIG,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_verify_forward_message(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify6.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_to_wire_with_edns_tsig(self):
fix_current_time(0x4db60d1f)
self.r.set_qid(0x6cd)
self.__common_tsigmessage_setup()
edns = EDNS()
edns.set_udp_size(4096)
self.r.set_edns(edns)
self.__common_tsig_checks("message_toWire3.wire")
def test_to_wire_with_edns_tsig(self):
fix_current_time(0x4db60d1f)
self.r.set_qid(0x6cd)
self.__common_tsigmessage_setup()
edns = EDNS()
edns.set_udp_size(4096)
self.r.set_edns(edns)
self.__common_tsig_checks("message_toWire3.wire")
def test_verify_forward_message(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify6.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_badtime_overflow(self):
fix_current_time(200)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA())
# This should be in the okay range, but since "200 - fudge" overflows
# and we compare them as 64-bit unsigned integers, it results in a
# false positive (we intentionally accept that).
fix_current_time(100)
self.assertEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
def test_badtime_overflow(self):
fix_current_time(200)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA)
# This should be in the okay range, but since "200 - fudge" overflows
# and we compare them as 64-bit unsigned integers, it results in a
# false positive (we intentionally accept that).
fix_current_time(100)
self.assertEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
def test_nosig_then_validate(self):
fix_current_time(0x4da8877a)
self.createMessageAndSign(self.qid, self.test_name, self.tsig_ctx)
self.commonVerifyChecks(self.tsig_ctx, None, DUMMY_DATA,
TSIGError.FORMERR,
TSIGContext.STATE_SENT_REQUEST, True)
self.createMessageFromFile("tsig_verify5.wire")
self.commonVerifyChecks(self.tsig_ctx, self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_VERIFIED_RESPONSE)
def test_nosig_then_validate(self):
fix_current_time(0x4da8877a)
self.createMessageAndSign(self.qid, self.test_name, self.tsig_ctx)
self.commonVerifyChecks(self.tsig_ctx, None, DUMMY_DATA,
TSIGError.FORMERR, TSIGContext.STATE_SENT_REQUEST,
True)
self.createMessageFromFile("tsig_verify5.wire")
self.commonVerifyChecks(self.tsig_ctx, self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_VERIFIED_RESPONSE)
def test_badkey_response(self):
# A similar test as badsigResponse but for BADKEY
fix_current_time(0x4da8877a)
tsig_ctx = TSIGContext(self.badkey_name, TSIGKey.HMACMD5_NAME,
self.keyring)
self.commonVerifyChecks(tsig_ctx, self.dummy_record, DUMMY_DATA,
TSIGError.BAD_KEY,
TSIGContext.STATE_RECEIVED_REQUEST)
sig = self.createMessageAndSign(self.qid, self.test_name, tsig_ctx)
self.assertEqual(self.badkey_name, sig.get_name())
self.commonSignChecks(sig, self.qid, 0x4da8877a, None, 17) # 17: BADKEY
def test_to_wire_tsig_no_truncation(self):
fix_current_time(0x4e17b38d)
data = factoryFromFile(self.p, "message_fromWire18.wire")
self.assertEqual(TSIGError.NOERROR,
self.tsig_ctx.verify(self.p.get_tsig_record(), data))
self.r.set_qid(0xd6e2)
self.__common_tsigmessage_setup([Message.HEADERFLAG_QR,
Message.HEADERFLAG_AA,
Message.HEADERFLAG_RD],
RRType("TXT"),
[LONG_TXT1, LONG_TXT4])
self.__common_tsig_checks("message_toWire5.wire")
def test_badtime_response2(self):
fix_current_time(0x4da8b9d6)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA())
# "rewind the clock" and try validating, which should fail due to
# BADTIME
fix_current_time(0x4da8b9d6 - 600)
self.commonVerifyChecks(self.tsig_verify_ctx, tsig, DUMMY_DATA,
TSIGError.BAD_TIME,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_to_wire_tsig_no_truncation(self):
fix_current_time(0x4e17b38d)
data = factoryFromFile(self.p, "message_fromWire18.wire")
self.assertEqual(TSIGError.NOERROR,
self.tsig_ctx.verify(self.p.get_tsig_record(), data))
self.r.set_qid(0xd6e2)
self.__common_tsigmessage_setup([Message.HEADERFLAG_QR,
Message.HEADERFLAG_AA,
Message.HEADERFLAG_RD],
RRType("TXT"),
[LONG_TXT1, LONG_TXT4])
self.__common_tsig_checks("message_toWire5.wire")
def test_sign_using_hmacsha1(self):
fix_current_time(0x4dae7d5f)
secret = base64.b64decode(b"MA+QDhXbyqUak+qnMFyTyEirzng=")
sha1_ctx = TSIGContext(
TSIGKey(self.test_name, TSIGKey.HMACSHA1_NAME, secret))
qid = 0x0967
expected_mac = b"\x41\x53\x40\xc7\xda\xf8\x24\xed\x68\x4e\xe5\x86" + \
b"\xf7\xb5\xa6\x7a\x2f\xeb\xc0\xd3"
tsig = self.createMessageAndSign(qid, self.test_name, sha1_ctx)
self.commonSignChecks(tsig, qid, 0x4dae7d5f, expected_mac, 0, None,
TSIGKey.HMACSHA1_NAME)
def test_sign_using_hmacsha1(self):
fix_current_time(0x4dae7d5f)
secret = base64.b64decode(b"MA+QDhXbyqUak+qnMFyTyEirzng=")
sha1_ctx = TSIGContext(TSIGKey(self.test_name, TSIGKey.HMACSHA1_NAME,
secret))
qid = 0x0967
expected_mac = b"\x41\x53\x40\xc7\xda\xf8\x24\xed\x68\x4e\xe5\x86" + \
b"\xf7\xb5\xa6\x7a\x2f\xeb\xc0\xd3"
tsig = self.createMessageAndSign(qid, self.test_name, sha1_ctx)
self.commonSignChecks(tsig, qid, 0x4dae7d5f, expected_mac,
0, None, TSIGKey.HMACSHA1_NAME)
def test_badtime_response2(self):
fix_current_time(0x4da8b9d6)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA)
# "rewind the clock" and try validating, which should fail due to
# BADTIME
fix_current_time(0x4da8b9d6 - 600)
self.commonVerifyChecks(self.tsig_verify_ctx, tsig, DUMMY_DATA,
TSIGError.BAD_TIME,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_sign_after_verified(self):
fix_current_time(0x4da8877a)
self.createMessageAndSign(self.qid, self.test_name, self.tsig_ctx)
self.createMessageFromFile("tsig_verify5.wire")
self.tsig_ctx.verify(self.message.get_tsig_record(),
self.received_data)
self.assertEqual(TSIGContext.STATE_VERIFIED_RESPONSE,
self.tsig_ctx.get_state())
# Now trying further signing.
self.assertRaises(TSIGContextError, self.createMessageAndSign,
self.qid, self.test_name, self.tsig_ctx)
def test_badkey_response(self):
# A similar test as badsigResponse but for BADKEY
fix_current_time(0x4da8877a)
tsig_ctx = TSIGContext(self.badkey_name, TSIGKey.HMACMD5_NAME,
self.keyring)
self.commonVerifyChecks(tsig_ctx, self.dummy_record, DUMMY_DATA,
TSIGError.BAD_KEY,
TSIGContext.STATE_RECEIVED_REQUEST)
sig = self.createMessageAndSign(self.qid, self.test_name, tsig_ctx)
self.assertEqual(self.badkey_name, sig.get_name())
self.commonSignChecks(sig, self.qid, 0x4da8877a, None,
17) # 17: BADKEY
def test_sign_after_verified(self):
fix_current_time(0x4da8877a)
self.createMessageAndSign(self.qid, self.test_name, self.tsig_ctx)
self.createMessageFromFile("tsig_verify5.wire")
self.tsig_ctx.verify(self.message.get_tsig_record(),
self.received_data)
self.assertEqual(TSIGContext.STATE_VERIFIED_RESPONSE,
self.tsig_ctx.get_state())
# Now trying further signing.
self.assertRaises(TSIGContextError, self.createMessageAndSign,
self.qid, self.test_name, self.tsig_ctx)
def test_badsig_response(self):
fix_current_time(0x4da8877a)
# Try to sign a simple message with bogus secret. It should fail
# with BADSIG.
self.createMessageFromFile("message_toWire2.wire")
bad_ctx = TSIGContext(TSIGKey(self.test_name, TSIGKey.HMACMD5_NAME,
DUMMY_DATA))
self.commonVerifyChecks(bad_ctx, self.message.get_tsig_record(),
self.received_data, TSIGError.BAD_SIG,
TSIGContext.STATE_RECEIVED_REQUEST)
# Sign the same message (which doesn't matter for this test) with the
# context of "checked state".
tsig = self.createMessageAndSign(self.qid, self.test_name, bad_ctx)
self.commonSignChecks(tsig, self.message.get_qid(), 0x4da8877a, None,
16) # 16: BADSIG
def test_empty_mac(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify7.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.BAD_SIG,
TSIGContext.STATE_RECEIVED_REQUEST)
# If the empty MAC comes with a BADKEY error, the error is passed
# transparently.
self.createMessageFromFile("tsig_verify8.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.BAD_KEY,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_badsig_response(self):
fix_current_time(0x4da8877a)
# Try to sign a simple message with bogus secret. It should fail
# with BADSIG.
self.createMessageFromFile("message_toWire2.wire")
bad_ctx = TSIGContext(
TSIGKey(self.test_name, TSIGKey.HMACMD5_NAME, DUMMY_DATA))
self.commonVerifyChecks(bad_ctx, self.message.get_tsig_record(),
self.received_data, TSIGError.BAD_SIG,
TSIGContext.STATE_RECEIVED_REQUEST)
# Sign the same message (which doesn't matter for this test) with the
# context of "checked state".
tsig = self.createMessageAndSign(self.qid, self.test_name, bad_ctx)
self.commonSignChecks(tsig, self.message.get_qid(), 0x4da8877a, None,
16) # 16: BADSIG
def test_verify_then_sign_response(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("message_toWire2.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_RECEIVED_REQUEST)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_verify_ctx,
QR_FLAG | AA_FLAG | RD_FLAG, RRType.A,
"192.0.2.1")
expected_mac = b"\x8f\xcd\xa6\x6a\x7c\xd1\xa3\xb9\x94\x8e\xb1\x86" + \
b"\x9d\x38\x4a\x9f"
self.commonSignChecks(tsig, self.qid, 0x4da8877a, expected_mac)
def test_verify_then_sign_response(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("message_toWire2.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_RECEIVED_REQUEST)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_verify_ctx,
QR_FLAG|AA_FLAG|RD_FLAG,
RRType.A(), "192.0.2.1")
expected_mac = b"\x8f\xcd\xa6\x6a\x7c\xd1\xa3\xb9\x94\x8e\xb1\x86" + \
b"\x9d\x38\x4a\x9f"
self.commonSignChecks(tsig, self.qid, 0x4da8877a, expected_mac)
def test_verify_after_sendresponse(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("message_toWire2.wire")
self.tsig_verify_ctx.verify(self.message.get_tsig_record(),
self.received_data)
self.assertEqual(TSIGContext.STATE_RECEIVED_REQUEST,
self.tsig_verify_ctx.get_state())
self.createMessageAndSign(self.qid, self.test_name,
self.tsig_verify_ctx,
QR_FLAG|AA_FLAG|RD_FLAG, RRType.A(),
"192.0.2.1")
self.assertEqual(TSIGContext.STATE_SENT_RESPONSE,
self.tsig_verify_ctx.get_state())
# Now trying further verification.
self.createMessageFromFile("message_toWire2.wire")
self.assertRaises(TSIGContextError, self.tsig_verify_ctx.verify,
self.message.get_tsig_record(), self.received_data)
def test_empty_mac(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify7.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data,
TSIGError.BAD_SIG,
TSIGContext.STATE_RECEIVED_REQUEST)
# If the empty MAC comes with a BADKEY error, the error is passed
# transparently.
self.createMessageFromFile("tsig_verify8.wire")
self.commonVerifyChecks(self.tsig_verify_ctx,
self.message.get_tsig_record(),
self.received_data,
TSIGError.BAD_KEY,
TSIGContext.STATE_RECEIVED_REQUEST)
def test_verify_after_sendresponse(self):
fix_current_time(0x4da8877a)
self.createMessageFromFile("message_toWire2.wire")
self.tsig_verify_ctx.verify(self.message.get_tsig_record(),
self.received_data)
self.assertEqual(TSIGContext.STATE_RECEIVED_REQUEST,
self.tsig_verify_ctx.get_state())
self.createMessageAndSign(self.qid, self.test_name,
self.tsig_verify_ctx,
QR_FLAG | AA_FLAG | RD_FLAG, RRType.A,
"192.0.2.1")
self.assertEqual(TSIGContext.STATE_SENT_RESPONSE,
self.tsig_verify_ctx.get_state())
# Now trying further verification.
self.createMessageFromFile("message_toWire2.wire")
self.assertRaises(TSIGContextError, self.tsig_verify_ctx.verify,
self.message.get_tsig_record(), self.received_data)
def setUp(self):
# make sure we don't use faked time unless explicitly do so in tests
fix_current_time(None)
self.qid = 0x2d65
self.test_name = Name("www.example.com")
self.tsig_ctx = TSIGContext(self.tsig_key)
self.tsig_verify_ctx = TSIGContext(self.tsig_key)
self.keyring = TSIGKeyRing()
self.message = Message(Message.RENDER)
self.renderer = MessageRenderer()
self.test_class = RRClass.IN
self.test_ttl = RRTTL(86400)
self.secret = base64.b64decode(b"SFuWd/q99SzF8Yzd1QbB9g==")
self.tsig_ctx = TSIGContext(
TSIGKey(self.test_name, TSIGKey.HMACMD5_NAME, self.secret))
self.badkey_name = Name("badkey.example.com")
self.dummy_record = TSIGRecord(self.badkey_name,
TSIG("hmac-md5.sig-alg.reg.int. " + \
"1302890362 300 0 11621 " + \
"0 0"))
def setUp(self):
# make sure we don't use faked time unless explicitly do so in tests
fix_current_time(None)
self.p = Message(Message.PARSE)
self.r = Message(Message.RENDER)
self.rrset_a = RRset(Name("example.com"), RRClass("IN"), RRType("A"),
RRTTL(3600))
self.rrset_a.add_rdata(Rdata(RRType("A"), RRClass("IN"), "192.0.2.1"))
self.rrset_a.add_rdata(Rdata(RRType("A"), RRClass("IN"), "192.0.2.2"))
self.rrset_aaaa = RRset(Name("example.com"), RRClass("IN"),
RRType("AAAA"), RRTTL(3600))
self.rrset_aaaa.add_rdata(Rdata(RRType("AAAA"), RRClass("IN"),
"2001:db8::134"))
self.bogus_section = Message.SECTION_ADDITIONAL + 1
self.bogus_below_section = Message.SECTION_QUESTION - 1
self.tsig_key = TSIGKey("www.example.com:SFuWd/q99SzF8Yzd1QbB9g==")
self.tsig_ctx = TSIGContext(self.tsig_key)
def test_badtime_boundaries(self):
fix_current_time(0x4da8b9d6)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA())
fix_current_time(0x4da8b9d6 + 301)
self.assertEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
fix_current_time(0x4da8b9d6 + 300)
self.assertNotEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
fix_current_time(0x4da8b9d6 - 301)
self.assertEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
fix_current_time(0x4da8b9d6 - 300)
self.assertNotEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
def setUp(self):
# make sure we don't use faked time unless explicitly do so in tests
fix_current_time(None)
self.p = Message(Message.PARSE)
self.r = Message(Message.RENDER)
self.rrset_a = RRset(Name("example.com"), RRClass("IN"), RRType("A"),
RRTTL(3600))
self.rrset_a.add_rdata(Rdata(RRType("A"), RRClass("IN"), "192.0.2.1"))
self.rrset_a.add_rdata(Rdata(RRType("A"), RRClass("IN"), "192.0.2.2"))
self.rrset_aaaa = RRset(Name("example.com"), RRClass("IN"),
RRType("AAAA"), RRTTL(3600))
self.rrset_aaaa.add_rdata(Rdata(RRType("AAAA"), RRClass("IN"),
"2001:db8::134"))
self.bogus_section = Message.SECTION_ADDITIONAL + 1
self.bogus_below_section = Message.SECTION_QUESTION - 1
self.tsig_key = TSIGKey("www.example.com:SFuWd/q99SzF8Yzd1QbB9g==")
self.tsig_ctx = TSIGContext(self.tsig_key)
def test_badtime_boundaries(self):
fix_current_time(0x4da8b9d6)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx, 0, RRType.SOA)
fix_current_time(0x4da8b9d6 + 301)
self.assertEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
fix_current_time(0x4da8b9d6 + 300)
self.assertNotEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
fix_current_time(0x4da8b9d6 - 301)
self.assertEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
fix_current_time(0x4da8b9d6 - 300)
self.assertNotEqual(TSIGError.BAD_TIME,
self.tsig_verify_ctx.verify(tsig, DUMMY_DATA))
def setUp(self):
# make sure we don't use faked time unless explicitly do so in tests
fix_current_time(None)
self.qid = 0x2d65
self.test_name = Name("www.example.com")
self.tsig_ctx = TSIGContext(self.tsig_key)
self.tsig_verify_ctx = TSIGContext(self.tsig_key)
self.keyring = TSIGKeyRing()
self.message = Message(Message.RENDER)
self.renderer = MessageRenderer()
self.test_class = RRClass.IN()
self.test_ttl = RRTTL(86400)
self.secret = base64.b64decode(b"SFuWd/q99SzF8Yzd1QbB9g==")
self.tsig_ctx = TSIGContext(TSIGKey(self.test_name,
TSIGKey.HMACMD5_NAME,
self.secret))
self.badkey_name = Name("badkey.example.com")
self.dummy_record = TSIGRecord(self.badkey_name,
TSIG("hmac-md5.sig-alg.reg.int. " + \
"1302890362 300 0 11621 " + \
"0 0"))
def test_sign_continuation(self):
fix_current_time(0x4da8e951)
axfr_qid = 0x3410
zone_name = Name("example.com")
tsig = self.createMessageAndSign(axfr_qid, zone_name, self.tsig_ctx,
0, RRType.AXFR())
received_data = read_wire_data("tsig_verify1.wire")
self.commonVerifyChecks(self.tsig_verify_ctx, tsig, received_data,
TSIGError.NOERROR,
TSIGContext.STATE_RECEIVED_REQUEST)
tsig = self.createMessageAndSign(axfr_qid, zone_name,
self.tsig_verify_ctx,
AA_FLAG|QR_FLAG, RRType.AXFR(),
"ns.example.com. root.example.com." +\
" 2011041503 7200 3600 2592000 1200",
RRType.SOA())
received_data = read_wire_data("tsig_verify2.wire")
self.commonVerifyChecks(self.tsig_ctx, tsig, received_data,
TSIGError.NOERROR)
expected_mac = b"\x10\x24\x58\xf7\xf6\x2d\xdd\x7d\x63\x8d\x74" +\
b"\x60\x34\x13\x09\x68"
tsig = self.createMessageAndSign(axfr_qid, zone_name,
self.tsig_verify_ctx,
AA_FLAG|QR_FLAG, RRType.AXFR(),
"ns.example.com.", RRType.NS(),
False)
self.commonSignChecks(tsig, axfr_qid, 0x4da8e951, expected_mac)
received_data = read_wire_data("tsig_verify3.wire")
self.commonVerifyChecks(self.tsig_ctx, tsig, received_data,
TSIGError.NOERROR)
def test_sign_continuation(self):
fix_current_time(0x4da8e951)
axfr_qid = 0x3410
zone_name = Name("example.com")
tsig = self.createMessageAndSign(axfr_qid, zone_name, self.tsig_ctx, 0,
RRType.AXFR)
received_data = read_wire_data("tsig_verify1.wire")
self.commonVerifyChecks(self.tsig_verify_ctx, tsig, received_data,
TSIGError.NOERROR,
TSIGContext.STATE_RECEIVED_REQUEST)
tsig = self.createMessageAndSign(axfr_qid, zone_name,
self.tsig_verify_ctx,
AA_FLAG|QR_FLAG, RRType.AXFR,
"ns.example.com. root.example.com." +\
" 2011041503 7200 3600 2592000 1200",
RRType.SOA)
received_data = read_wire_data("tsig_verify2.wire")
self.commonVerifyChecks(self.tsig_ctx, tsig, received_data,
TSIGError.NOERROR)
expected_mac = b"\x10\x24\x58\xf7\xf6\x2d\xdd\x7d\x63\x8d\x74" +\
b"\x60\x34\x13\x09\x68"
tsig = self.createMessageAndSign(axfr_qid, zone_name,
self.tsig_verify_ctx,
AA_FLAG | QR_FLAG, RRType.AXFR,
"ns.example.com.", RRType.NS, False)
self.commonSignChecks(tsig, axfr_qid, 0x4da8e951, expected_mac)
received_data = read_wire_data("tsig_verify3.wire")
self.commonVerifyChecks(self.tsig_ctx, tsig, received_data,
TSIGError.NOERROR)
def test_badtime_then_validate(self):
fix_current_time(0x4da8877a)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx)
# "advance the clock" and try validating, which should fail due to
# BADTIME
fix_current_time(0x4da8877a + 600)
self.commonVerifyChecks(self.tsig_ctx, tsig, DUMMY_DATA,
TSIGError.BAD_TIME, TSIGContext.STATE_SENT_REQUEST)
# revert the clock again.
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify5.wire")
self.commonVerifyChecks(self.tsig_ctx, self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_VERIFIED_RESPONSE)
def test_badtime_then_validate(self):
fix_current_time(0x4da8877a)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx)
# "advance the clock" and try validating, which should fail due to
# BADTIME
fix_current_time(0x4da8877a + 600)
self.commonVerifyChecks(self.tsig_ctx, tsig, DUMMY_DATA,
TSIGError.BAD_TIME,
TSIGContext.STATE_SENT_REQUEST)
# revert the clock again.
fix_current_time(0x4da8877a)
self.createMessageFromFile("tsig_verify5.wire")
self.commonVerifyChecks(self.tsig_ctx, self.message.get_tsig_record(),
self.received_data, TSIGError.NOERROR,
TSIGContext.STATE_VERIFIED_RESPONSE)
def test_to_wire_with_tsig(self):
fix_current_time(0x4da8877a)
self.r.set_qid(0x2d65)
self.__common_tsigmessage_setup()
self.__common_tsig_checks("message_toWire2.wire")
def test_to_wire_with_tsig(self):
fix_current_time(0x4da8877a)
self.r.set_qid(0x2d65)
self.__common_tsigmessage_setup()
self.__common_tsig_checks("message_toWire2.wire")
def test_sign_using_uppercase_keyname(self):
fix_current_time(0x4da8877a)
cap_ctx = TSIGContext(TSIGKey(Name("WWW.EXAMPLE.COM"),
TSIGKey.HMACMD5_NAME, self.secret))
tsig = self.createMessageAndSign(self.qid, self.test_name, cap_ctx)
self.commonSignChecks(tsig, self.qid, 0x4da8877a, COMMON_EXPECTED_MAC)
def tearDown(self):
# reset any faked current time setting (it would affect other tests)
fix_current_time(None)
def tearDown(self):
# reset any faked current time setting (it would affect other tests)
fix_current_time(None)
def test_sign(self):
fix_current_time(0x4da8877a)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx)
self.commonSignChecks(tsig, self.qid, 0x4da8877a, COMMON_EXPECTED_MAC)
def test_sign(self):
fix_current_time(0x4da8877a)
tsig = self.createMessageAndSign(self.qid, self.test_name,
self.tsig_ctx)
self.commonSignChecks(tsig, self.qid, 0x4da8877a, COMMON_EXPECTED_MAC)
