← Back
Editing: xfr.py
# Copyright (C) Dnspython Contributors, see LICENSE for text of ISC license # Copyright (C) 2003-2017 Nominum, Inc. # # Permission to use, copy, modify, and distribute this software and its # documentation for any purpose with or without fee is hereby granted, # provided that the above copyright notice and this permission notice # appear in all copies. # # THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. from typing import Any, List, Optional, Tuple, Union import dns.exception import dns.message import dns.name import dns.rcode import dns.rdataset import dns.rdatatype import dns.serial import dns.transaction import dns.tsig import dns.zone class TransferError(dns.exception.DNSException): """A zone transfer response got a non-zero rcode.""" def __init__(self, rcode): message = f"Zone transfer error: {dns.rcode.to_text(rcode)}" super().__init__(message) self.rcode = rcode class SerialWentBackwards(dns.exception.FormError): """The current serial number is less than the serial we know.""" class UseTCP(dns.exception.DNSException): """This IXFR cannot be completed with UDP.""" class Inbound: """ State machine for zone transfers. """ def __init__( self, txn_manager: dns.transaction.TransactionManager, rdtype: dns.rdatatype.RdataType = dns.rdatatype.AXFR, serial: Optional[int] = None, is_udp: bool = False, ): """Initialize an inbound zone transfer. *txn_manager* is a :py:class:`dns.transaction.TransactionManager`. *rdtype* can be `dns.rdatatype.AXFR` or `dns.rdatatype.IXFR` *serial* is the base serial number for IXFRs, and is required in that case. *is_udp*, a ``bool`` indidicates if UDP is being used for this XFR. """ self.txn_manager = txn_manager self.txn: Optional[dns.transaction.Transaction] = None self.rdtype = rdtype if rdtype == dns.rdatatype.IXFR: if serial is None: raise ValueError("a starting serial must be supplied for IXFRs") elif is_udp: raise ValueError("is_udp specified for AXFR") self.serial = serial self.is_udp = is_udp (_, _, self.origin) = txn_manager.origin_information() self.soa_rdataset: Optional[dns.rdataset.Rdataset] = None self.done = False self.expecting_SOA = False self.delete_mode = False def process_message(self, message: dns.message.Message) -> bool: """Process one message in the transfer. The message should have the same relativization as was specified when the `dns.xfr.Inbound` was created. The message should also have been created with `one_rr_per_rrset=True` because order matters. Returns `True` if the transfer is complete, and `False` otherwise. """ if self.txn is None: replacement = self.rdtype == dns.rdatatype.AXFR self.txn = self.txn_manager.writer(replacement) rcode = message.rcode() if rcode != dns.rcode.NOERROR: raise TransferError(rcode) # # We don't require a question section, but if it is present is # should be correct. # if len(message.question) > 0: if message.question[0].name != self.origin: raise dns.exception.FormError("wrong question name") if message.question[0].rdtype != self.rdtype: raise dns.exception.FormError("wrong question rdatatype") answer_index = 0 if self.soa_rdataset is None: # # This is the first message. We're expecting an SOA at # the origin. # if not message.answer or message.answer[0].name != self.origin: raise dns.exception.FormError("No answer or RRset not for zone origin") rrset = message.answer[0] rdataset = rrset if rdataset.rdtype != dns.rdatatype.SOA: raise dns.exception.FormError("first RRset is not an SOA") answer_index = 1 self.soa_rdataset = rdataset.copy() if self.rdtype == dns.rdatatype.IXFR: if self.soa_rdataset[0].serial == self.serial: # # We're already up-to-date. # self.done = True elif dns.serial.Serial(self.soa_rdataset[0].serial) < self.serial: # It went backwards! raise SerialWentBackwards else: if self.is_udp and len(message.answer[answer_index:]) == 0: # # There are no more records, so this is the # "truncated" response. Say to use TCP # raise UseTCP # # Note we're expecting another SOA so we can detect # if this IXFR response is an AXFR-style response. # self.expecting_SOA = True # # Process the answer section (other than the initial SOA in # the first message). # for rrset in message.answer[answer_index:]: name = rrset.name rdataset = rrset if self.done: raise dns.exception.FormError("answers after final SOA") assert self.txn is not None # for mypy if rdataset.rdtype == dns.rdatatype.SOA and name == self.origin: # # Every time we see an origin SOA delete_mode inverts # if self.rdtype == dns.rdatatype.IXFR: self.delete_mode = not self.delete_mode # # If this SOA Rdataset is equal to the first we saw # then we're finished. If this is an IXFR we also # check that we're seeing the record in the expected # part of the response. # if rdataset == self.soa_rdataset and ( self.rdtype == dns.rdatatype.AXFR or (self.rdtype == dns.rdatatype.IXFR and self.delete_mode) ): # # This is the final SOA # if self.expecting_SOA: # We got an empty IXFR sequence! raise dns.exception.FormError("empty IXFR sequence") if ( self.rdtype == dns.rdatatype.IXFR and self.serial != rdataset[0].serial ): raise dns.exception.FormError("unexpected end of IXFR sequence") self.txn.replace(name, rdataset) self.txn.commit() self.txn = None self.done = True else: # # This is not the final SOA # self.expecting_SOA = False if self.rdtype == dns.rdatatype.IXFR: if self.delete_mode: # This is the start of an IXFR deletion set if rdataset[0].serial != self.serial: raise dns.exception.FormError( "IXFR base serial mismatch" ) else: # This is the start of an IXFR addition set self.serial = rdataset[0].serial self.txn.replace(name, rdataset) else: # We saw a non-final SOA for the origin in an AXFR. raise dns.exception.FormError("unexpected origin SOA in AXFR") continue if self.expecting_SOA: # # We made an IXFR request and are expecting another # SOA RR, but saw something else, so this must be an # AXFR response. # self.rdtype = dns.rdatatype.AXFR self.expecting_SOA = False self.delete_mode = False self.txn.rollback() self.txn = self.txn_manager.writer(True) # # Note we are falling through into the code below # so whatever rdataset this was gets written. # # Add or remove the data if self.delete_mode: self.txn.delete_exact(name, rdataset) else: self.txn.add(name, rdataset) if self.is_udp and not self.done: # # This is a UDP IXFR and we didn't get to done, and we didn't # get the proper "truncated" response # raise dns.exception.FormError("unexpected end of UDP IXFR") return self.done # # Inbounds are context managers. # def __enter__(self): return self def __exit__(self, exc_type, exc_val, exc_tb): if self.txn: self.txn.rollback() return False def make_query( txn_manager: dns.transaction.TransactionManager, serial: Optional[int] = 0, use_edns: Optional[Union[int, bool]] = None, ednsflags: Optional[int] = None, payload: Optional[int] = None, request_payload: Optional[int] = None, options: Optional[List[dns.edns.Option]] = None, keyring: Any = None, keyname: Optional[dns.name.Name] = None, keyalgorithm: Union[dns.name.Name, str] = dns.tsig.default_algorithm, ) -> Tuple[dns.message.QueryMessage, Optional[int]]: """Make an AXFR or IXFR query. *txn_manager* is a ``dns.transaction.TransactionManager``, typically a ``dns.zone.Zone``. *serial* is an ``int`` or ``None``. If 0, then IXFR will be attempted using the most recent serial number from the *txn_manager*; it is the caller's responsibility to ensure there are no write transactions active that could invalidate the retrieved serial. If a serial cannot be determined, AXFR will be forced. Other integer values are the starting serial to use. ``None`` forces an AXFR. Please see the documentation for :py:func:`dns.message.make_query` and :py:func:`dns.message.Message.use_tsig` for details on the other parameters to this function. Returns a `(query, serial)` tuple. """ (zone_origin, _, origin) = txn_manager.origin_information() if zone_origin is None: raise ValueError("no zone origin") if serial is None: rdtype = dns.rdatatype.AXFR elif not isinstance(serial, int): raise ValueError("serial is not an integer") elif serial == 0: with txn_manager.reader() as txn: rdataset = txn.get(origin, "SOA") if rdataset: serial = rdataset[0].serial rdtype = dns.rdatatype.IXFR else: serial = None rdtype = dns.rdatatype.AXFR elif serial > 0 and serial < 4294967296: rdtype = dns.rdatatype.IXFR else: raise ValueError("serial out-of-range") rdclass = txn_manager.get_class() q = dns.message.make_query( zone_origin, rdtype, rdclass, use_edns, False, ednsflags, payload, request_payload, options, ) if serial is not None: rdata = dns.rdata.from_text(rdclass, "SOA", f". . {serial} 0 0 0 0") rrset = q.find_rrset( q.authority, zone_origin, rdclass, dns.rdatatype.SOA, create=True ) rrset.add(rdata, 0) if keyring is not None: q.use_tsig(keyring, keyname, algorithm=keyalgorithm) return (q, serial) def extract_serial_from_query(query: dns.message.Message) -> Optional[int]: """Extract the SOA serial number from query if it is an IXFR and return it, otherwise return None. *query* is a dns.message.QueryMessage that is an IXFR or AXFR request. Raises if the query is not an IXFR or AXFR, or if an IXFR doesn't have an appropriate SOA RRset in the authority section. """ if not isinstance(query, dns.message.QueryMessage): raise ValueError("query not a QueryMessage") question = query.question[0] if question.rdtype == dns.rdatatype.AXFR: return None elif question.rdtype != dns.rdatatype.IXFR: raise ValueError("query is not an AXFR or IXFR") soa = query.find_rrset( query.authority, question.name, question.rdclass, dns.rdatatype.SOA ) return soa[0].serial
Save File
Cancel