dnspython 2.9.0__tar.gz → 2.9.1__tar.gz

dnspython-2.9.1/LICENSE

@@ -0,0 +1,35 @@
+ISC License
+
+Copyright (C) Dnspython Contributors
+
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+
+
+Copyright (C) 2001-2017 Nominum, Inc.
+Copyright (C) Google Inc.
+
+Permission to use, copy, modify, and distribute this software and its
+documentation for any purpose with or without fee is hereby granted,
+provided that the above copyright notice and this permission notice
+appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

{dnspython-2.9.0 → dnspython-2.9.1}/PKG-INFO

@@ -1,10 +1,11 @@
 Metadata-Version: 2.4
 Name: dnspython
-Version: 2.9.0
+Version: 2.9.1
 Summary: DNS toolkit
 Author: Bob Halley
 Author-email: Bob Halley <halley@dnspython.org>
 License-Expression: ISC
+License-File: LICENSE
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Intended Audience :: Developers
 Classifier: Intended Audience :: System Administrators
@@ -18,6 +19,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Requires-Dist: black>=26.5 ; extra == 'dev'
 Requires-Dist: coverage>=7.15 ; extra == 'dev'
 Requires-Dist: hypercorn>=0.18.0 ; extra == 'dev'
@@ -83,7 +85,7 @@ testing of DNS software.
 
 ## ABOUT THIS RELEASE
 
-This is `dnspython` 2.9.0.
+This is `dnspython` 2.9.1.
 Please read
 [What's New](https://dnspython.readthedocs.io/en/stable/whatsnew.html) for
 information about the changes in this release.

{dnspython-2.9.0 → dnspython-2.9.1}/README.md

@@ -29,7 +29,7 @@ testing of DNS software.
 
 ## ABOUT THIS RELEASE
 
-This is `dnspython` 2.9.0.
+This is `dnspython` 2.9.1.
 Please read
 [What's New](https://dnspython.readthedocs.io/en/stable/whatsnew.html) for
 information about the changes in this release.

{dnspython-2.9.0 → dnspython-2.9.1}/dns/asyncquery.py

@@ -698,7 +698,7 @@ async def https(
     r = dns.message.from_wire(
         response.content,
         keyring=q.keyring,
-        request_mac=q.request_mac,
+        request_mac=q.mac,
         one_rr_per_rrset=one_rr_per_rrset,
         ignore_trailing=ignore_trailing,
     )
@@ -732,7 +732,7 @@ async def _http3(
     if url_parts.port is not None:
         port = url_parts.port
 
-    q.id = 0
+    q.set_id(0)
     wire = q.to_wire()
     the_connection: dns.quic.AsyncQuicConnection
     if connection:
@@ -762,7 +762,7 @@ async def _http3(
         r = dns.message.from_wire(
             wire,
             keyring=q.keyring,
-            request_mac=q.request_mac,
+            request_mac=q.mac,
             one_rr_per_rrset=one_rr_per_rrset,
             ignore_trailing=ignore_trailing,
         )
@@ -804,7 +804,7 @@ async def quic(
     if server_hostname is not None and hostname is None:
         hostname = server_hostname
 
-    q.id = 0
+    q.set_id(0)
     wire = q.to_wire()
     the_connection: dns.quic.AsyncQuicConnection
     if connection:
@@ -818,7 +818,7 @@ async def quic(
         async with mfactory(
             context,
             verify_mode=verify,
-            server_name=server_hostname,
+            server_name=hostname,
         ) as the_manager:
             if not connection:
                 the_connection = the_manager.connect(  # pyright: ignore
@@ -833,7 +833,7 @@ async def quic(
         r = dns.message.from_wire(
             wire,
             keyring=q.keyring,
-            request_mac=q.request_mac,
+            request_mac=q.mac,
             one_rr_per_rrset=one_rr_per_rrset,
             ignore_trailing=ignore_trailing,
         )
@@ -869,6 +869,7 @@ async def _inbound_xfr(
         txn_manager, rdtype, serial, is_udp, raise_on_serial_went_backwards
     ) as inbound:
         done = False
+        first = True
         tsig_ctx = None
         while not done:
             _, mexpiration = _compute_times(timeout)
@@ -893,6 +894,9 @@ async def _inbound_xfr(
                 multi=(not is_udp),
                 one_rr_per_rrset=is_ixfr,
             )
+            if not query.is_response(r, xfr_continuation=not first):
+                raise BadResponse
+            first = False
             done = inbound.process_message(r)
             yield r
             tsig_ctx = r.tsig_ctx

{dnspython-2.9.0 → dnspython-2.9.1}/dns/asyncresolver.py

@@ -89,6 +89,7 @@ class Resolver(dns.resolver.BaseResolver):
                 nameserver, tcp, backoff = resolution.next_nameserver()
                 if backoff:
                     await backend.sleep(backoff)
+                request.set_random_id()
                 timeout = self._compute_timeout(start, lifetime, resolution.errors)
                 try:
                     response = await nameserver.async_query(

{dnspython-2.9.0 → dnspython-2.9.1}/dns/btreezone.py

@@ -225,7 +225,7 @@ class WritableVersion(dns.zone.WritableVersion):
         if self.zone.relativize:
             return name == dns.name.empty
         else:
-            return name == self.zone.origin
+            return name == self.origin
 
     def _maybe_cow_with_name(
         self, name: dns.name.Name
@@ -236,20 +236,25 @@ class WritableVersion(dns.zone.WritableVersion):
             node.flags |= NodeFlags.ORIGIN
         elif self.delegations.is_glue(name):
             node.flags |= NodeFlags.GLUE
+        elif name in self.delegations:
+            node.flags |= NodeFlags.DELEGATION
         return (node, name)
 
     def update_glue_flag(self, name: dns.name.Name, is_glue: bool) -> None:
-        """Set or clear the ``NodeFlags.GLUE`` flag on all nodes that are
-        subdomains of *name*.
+        """Update the delegation and glue flags on proper subdomains of *name*.
+
+        An added delegation obscures any descendant delegations.  Removing
+        one exposes the first NS rdataset on each branch of its subtree.
 
         :param name: The delegation-point name whose subtree should be updated.
         :type name: :py:class:`dns.name.Name`
-        :param is_glue: ``True`` to set the GLUE flag; ``False`` to clear it.
+        :param is_glue: ``True`` to obscure the subtree; ``False`` to expose it.
         :type is_glue: bool
         """
         cursor = self.nodes.cursor()  # pyright: ignore
         cursor.seek(name, False)
         updates = []
+        cut = name if is_glue else None
         while True:
             elt = cursor.next()
             if elt is None:
@@ -257,18 +262,27 @@ class WritableVersion(dns.zone.WritableVersion):
             ename = elt.key()
             if not ename.is_subdomain(name):
                 break
-            node = cast(dns.node.Node, elt.value())
+            node = elt.value()
+            self.delegations.discard(ename)
+            if cut is not None and not ename.is_subdomain(cut):
+                cut = None
+            if cut is not None:
+                flags = NodeFlags.GLUE
+            elif node.get_rdataset(self.zone.rdclass, dns.rdatatype.NS) is not None:
+                flags = NodeFlags.DELEGATION
+                cut = ename
+                self.delegations.add(ename)
+            else:
+                flags = NodeFlags(0)
+            if node.flags == flags:
+                continue
             if ename not in self.changed:
-                new_node = self.zone.node_factory()
-                new_node.id = self.id  # type: ignore
+                new_node = cast(Node, self.zone.node_factory())
+                new_node.id = self.id
                 new_node.rdatasets.extend(node.rdatasets)
                 self.changed.add(ename)
                 node = new_node
-            assert isinstance(node, Node)
-            if is_glue:
-                node.flags |= NodeFlags.GLUE
-            else:
-                node.flags &= ~NodeFlags.GLUE
+            node.flags = flags
             # We don't update node here as any insertion could disturb the
             # btree and invalidate our cursor.  We could use the cursor in a
             # with block and avoid this, but it would do a lot of parking and
@@ -277,12 +291,28 @@ class WritableVersion(dns.zone.WritableVersion):
         for ename, node in updates:
             self.nodes[ename] = node
 
+    def _update_delegation(self, name: dns.name.Name, node: Node) -> None:
+        is_delegation = (
+            not node.is_origin_or_glue()
+            and node.get_rdataset(self.zone.rdclass, dns.rdatatype.NS) is not None
+        )
+        if is_delegation:
+            node.flags |= NodeFlags.DELEGATION
+            if name not in self.delegations:
+                self.delegations.add(name)
+                self.update_glue_flag(name, True)
+        elif name in self.delegations:
+            node.flags &= ~NodeFlags.DELEGATION
+            self.delegations.discard(name)
+            self.update_glue_flag(name, False)
+
     def delete_node(self, name: dns.name.Name) -> None:
         """Delete the node at *name*, updating delegation tracking as needed.
 
         If *name* is a delegation point, it is removed from the delegations
-        index and the GLUE flag is cleared from its subtree.  If *name* does
-        not exist in the zone, this method is a no-op.
+        index and any exposed descendant NS nodes become delegation points.
+        Nodes beneath those delegations remain glue.  If *name* does not
+        exist in the zone, this method is a no-op.
 
         :param name: The name of the node to delete.
         :type name: :py:class:`dns.name.Name`
@@ -290,7 +320,7 @@ class WritableVersion(dns.zone.WritableVersion):
         name = self._validate_name(name)
         node = self.nodes.get(name)
         if node is not None:
-            if node.is_delegation():  # pyright: ignore
+            if name in self.delegations:
                 self.delegations.discard(name)
                 self.update_glue_flag(name, False)
             del self.nodes[name]
@@ -303,7 +333,9 @@ class WritableVersion(dns.zone.WritableVersion):
 
         If *rdataset* is an NS rdataset and *name* is not the origin or beneath
         an existing delegation, the ``DELEGATION`` flag is set on the node and
-        the ``GLUE`` flag is set on all nodes in *name*'s subtree.
+        the ``GLUE`` flag is set on all nodes in *name*'s subtree, obscuring
+        any descendant delegations.  Replacing an NS rdataset with a CNAME
+        removes the delegation and exposes descendant delegations.
 
         :param name: The owner name.
         :type name: :py:class:`dns.name.Name`
@@ -311,15 +343,8 @@ class WritableVersion(dns.zone.WritableVersion):
         :type rdataset: :py:class:`dns.rdataset.Rdataset`
         """
         node, name = self._maybe_cow_with_name(name)
-        if (
-            rdataset.rdtype == dns.rdatatype.NS
-            and not node.is_origin_or_glue()  # type: ignore
-        ):
-            node.flags |= NodeFlags.DELEGATION  # type: ignore
-            if name not in self.delegations:
-                self.delegations.add(name)
-                self.update_glue_flag(name, True)
         node.replace_rdataset(rdataset)
+        self._update_delegation(name, cast(Node, node))
 
     def delete_rdataset(
         self,
@@ -330,8 +355,9 @@ class WritableVersion(dns.zone.WritableVersion):
         """Delete the rdataset with *rdtype* and *covers* at *name*.
 
         If the deleted rdataset was the NS rdataset at a delegation point,
-        the ``DELEGATION`` flag is cleared from that node and the ``GLUE``
-        flag is cleared from all nodes in its subtree.
+        the ``DELEGATION`` flag is cleared from that node and any exposed
+        descendant NS nodes become delegation points.  Nodes beneath those
+        delegations remain glue.
 
         :param name: The owner name.
         :type name: :py:class:`dns.name.Name`
@@ -341,11 +367,8 @@ class WritableVersion(dns.zone.WritableVersion):
         :type covers: :py:class:`dns.rdatatype.RdataType`
         """
         node, name = self._maybe_cow_with_name(name)
-        if rdtype == dns.rdatatype.NS and name in self.delegations:  # pyright: ignore
-            node.flags &= ~NodeFlags.DELEGATION  # type: ignore
-            self.delegations.discard(name)  # pyright: ignore
-            self.update_glue_flag(name, False)
         node.delete_rdataset(self.zone.rdclass, rdtype, covers)
+        self._update_delegation(name, cast(Node, node))
         if len(node) == 0:
             del self.nodes[name]
 

{dnspython-2.9.0 → dnspython-2.9.1}/dns/dnssec.py

@@ -296,6 +296,10 @@ def _find_candidate_keys(
         and key_id(rd) == rrsig.key_tag
         and (rd.flags & Flag.ZONE) == Flag.ZONE  # RFC 4034 2.1.1
         and rd.protocol == 3  # RFC 4034 2.1.2
+        # A revoked key may only validate the DNSKEY RRset (RFC 5011 2.1)
+        and (
+            (rd.flags & Flag.REVOKE) == 0 or rrsig.type_covered == dns.rdatatype.DNSKEY
+        )
     ]
 
 
@@ -354,6 +358,11 @@ def _validate_rrsig(
     if policy is None:
         policy = default_policy
 
+    # RFC 4035 section 5.3.1: the RRSIG must cover the RRset's type and class.
+    _, rdataset = _get_rrname_rdataset(rrset)
+    if rrsig.type_covered != rdataset.rdtype or rrsig.rdclass != rdataset.rdclass:
+        raise ValidationFailure("RRSIG does not cover the RRset")
+
     candidate_keys = _find_candidate_keys(keys, rrsig)
     if candidate_keys is None:
         raise ValidationFailure("unknown key")
@@ -715,10 +724,6 @@ def nsec3_hash(
     :rtype: str
     """
 
-    b32_conversion = str.maketrans(
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567", "0123456789ABCDEFGHIJKLMNOPQRSTUV"
-    )
-
     try:
         if isinstance(algorithm, str):
             algorithm = NSEC3Hash[algorithm.upper()]
@@ -747,10 +752,7 @@ def nsec3_hash(
     for _ in range(iterations):
         digest = hashlib.sha1(digest + salt_encoded).digest()
 
-    output = base64.b32encode(digest).decode("utf-8")
-    output = output.translate(b32_conversion)
-
-    return output
+    return base64.b32hexencode(digest).decode("utf-8")
 
 
 def make_ds_rdataset(
@@ -1117,7 +1119,7 @@ def _sign_zone_nsec(
             _txn_add_nsec(txn, last_secure, name, zone.rdclass, rrsig_ttl, rrset_signer)
         last_secure = name
 
-    if last_secure:
+    if last_secure is not None:
         _txn_add_nsec(
             txn, last_secure, zone.origin, zone.rdclass, rrsig_ttl, rrset_signer
         )

{dnspython-2.9.0 → dnspython-2.9.1}/dns/dnssecalgs/cryptography.py

@@ -20,7 +20,7 @@ class CryptographyPublicKey(GenericPublicKey):
         self.key = key
 
     @classmethod
-    def from_pem(cls, public_pem: bytes) -> "GenericPublicKey":
+    def from_pem(cls, public_pem: bytes) -> GenericPublicKey:
         key = serialization.load_pem_public_key(public_pem)
         return cls(key=key)
 
@@ -34,7 +34,7 @@ class CryptographyPublicKey(GenericPublicKey):
 class CryptographyPrivateKey(GenericPrivateKey):
     key: Any = None
     key_cls: Any = None
-    public_cls: type[CryptographyPublicKey]  # pyright: ignore
+    public_cls: type[CryptographyPublicKey]  # type: ignore
 
     def __init__(self, key: Any) -> None:  # pylint: disable=super-init-not-called
         if self.key_cls is None:
@@ -51,7 +51,7 @@ class CryptographyPrivateKey(GenericPrivateKey):
     @classmethod
     def from_pem(
         cls, private_pem: bytes, password: bytes | None = None
-    ) -> "GenericPrivateKey":
+    ) -> GenericPrivateKey:
         key = serialization.load_pem_private_key(private_pem, password=password)
         return cls(key=key)
 

{dnspython-2.9.0 → dnspython-2.9.1}/dns/dnssecalgs/dsa.py

@@ -1,5 +1,6 @@
 import struct
 
+from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.asymmetric import dsa, utils
@@ -16,6 +17,11 @@ class PublicDSA(CryptographyPublicKey):
     chosen_hash = hashes.SHA1()
 
     def verify(self, signature: bytes, data: bytes) -> None:
+        # RFC 2536 section 3: the signature is T, R, and S (41 octets), where T
+        # is the same as the key's T.
+        dsa_t = (self.key.key_size // 8 - 64) // 8
+        if len(signature) != 41 or signature[0] != dsa_t:
+            raise InvalidSignature
         sig_r = signature[1:21]
         sig_s = signature[21:]
         sig = utils.encode_dss_signature(

{dnspython-2.9.0 → dnspython-2.9.1}/dns/dnssecalgs/ecdsa.py

@@ -1,3 +1,4 @@
+from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.asymmetric import ec, utils
@@ -16,6 +17,10 @@ class PublicECDSA(CryptographyPublicKey):
     octets: int
 
     def verify(self, signature: bytes, data: bytes) -> None:
+        # RFC 6605 section 4: the signature is r and s, each exactly
+        # self.octets long.
+        if len(signature) != self.octets * 2:
+            raise InvalidSignature
         sig_r = signature[0 : self.octets]
         sig_s = signature[self.octets :]
         sig = utils.encode_dss_signature(

{dnspython-2.9.0 → dnspython-2.9.1}/dns/dnssecalgs/eddsa.py

@@ -25,7 +25,7 @@ class PublicEDDSA(CryptographyPublicKey):
 
 
 class PrivateEDDSA(CryptographyPrivateKey):
-    public_cls: type[PublicEDDSA]  # pyright: ignore
+    public_cls: type[PublicEDDSA]  # type: ignore
 
     def sign(
         self,

{dnspython-2.9.0 → dnspython-2.9.1}/dns/dnssecalgs/mldsa.py

@@ -27,7 +27,7 @@ class PublicMLDSA(CryptographyPublicKey):
 
 
 class PrivateMLDSA(CryptographyPrivateKey):
-    public_cls: Type[PublicMLDSA]  # pyright: ignore
+    public_cls: Type[PublicMLDSA]  # type: ignore
 
     def sign(
         self,

{dnspython-2.9.0 → dnspython-2.9.1}/dns/edns.py

@@ -73,6 +73,22 @@ class OptionType(dns.enum.IntEnum):
         return 65535
 
 
+def _escapify_text(text: str) -> str:
+    """Escape backslash and control characters in option text so that text
+    taken from the wire cannot add lines to, or otherwise alter, the output
+    of ``to_text()``."""
+
+    escaped = ""
+    for c in text:
+        if c == "\\":
+            escaped += "\\\\"
+        elif ord(c) < 0x20 or 0x7F <= ord(c) <= 0x9F:
+            escaped += f"\\{ord(c):03d}"
+        else:
+            escaped += c
+    return escaped
+
+
 class Option:
     """Base class for all EDNS option types."""
 
@@ -432,7 +448,7 @@ class EDEOption(Option):  # lgtm[py/missing-equals]
             )
             output += f" ({desc})"
         if self.text is not None:
-            output += f": {self.text}"
+            output += f": {_escapify_text(self.text)}"
         return output
 
     def to_wire(self, file: Any | None = None) -> bytes | None:
@@ -564,7 +580,7 @@ class EDEExtraTextLanguageOption(Option):
             return self.language.encode()
 
     def to_text(self) -> str:
-        return f"EDE-EXTRA-TEXT-LANGUAGE {self.language}"
+        return f"EDE-EXTRA-TEXT-LANGUAGE {_escapify_text(self.language)}"
 
     @classmethod
     def from_wire_parser(
@@ -594,7 +610,7 @@ class FilteringContactOption(Option):
             return self.contact.encode()
 
     def to_text(self) -> str:
-        return f"FILTERING-CONTACT {self.contact}"
+        return f"FILTERING-CONTACT {_escapify_text(self.contact)}"
 
     @classmethod
     def from_wire_parser(
@@ -624,7 +640,7 @@ class FilteringOrganizationOption(Option):
             return self.organization.encode()
 
     def to_text(self) -> str:
-        return f"FILTERING-ORGANIZATION {self.organization}"
+        return f"FILTERING-ORGANIZATION {_escapify_text(self.organization)}"
 
     @classmethod
     def from_wire_parser(
@@ -658,7 +674,7 @@ class FilteringDBOption(Option):
             return self.db.encode()
 
     def to_text(self) -> str:
-        return f"FILTERING-DB {self.db}"
+        return f"FILTERING-DB {_escapify_text(self.db)}"
 
     @classmethod
     def from_wire_parser(

{dnspython-2.9.0 → dnspython-2.9.1}/dns/entropy.py

@@ -34,9 +34,9 @@ class EntropyPool:
         self.digest: bytearray | None = None
         self.next_byte = 0
         self.lock = threading.Lock()
-        self.hash = hashlib.sha1()
-        self.hash_len = 20
-        self.pool = bytearray(b"\0" * self.hash_len)
+        self.hash = None
+        self.hash_len = 0
+        self.pool = bytearray()
         if seed is not None:
             self._stir(seed)
             self.seeded = True
@@ -45,7 +45,19 @@ class EntropyPool:
             self.seeded = False
             self.seed_pid = 0
 
+    def _new_hash(self):
+        try:
+            self.hash = hashlib.sha256()
+            self.hash_len = 32
+        except AttributeError:
+            self.hash = hashlib.sha1()
+            self.hash_len = 20
+        if len(self.pool) != self.hash_len:
+            self.pool = bytearray(b"\0" * self.hash_len)
+
     def _stir(self, entropy: bytes | bytearray) -> None:
+        if self.hash is None:
+            self._new_hash()
         for c in entropy:
             if self.pool_index == self.hash_len:
                 self.pool_index = 0
@@ -77,8 +89,12 @@ class EntropyPool:
         with self.lock:
             self._maybe_seed()
             if self.digest is None or self.next_byte == self.hash_len:
+                assert self.hash is not None
                 self.hash.update(bytes(self.pool))
                 self.digest = bytearray(self.hash.digest())
+                # We make a new hash because on MicroPython you can't update
+                # and digest more than once.
+                self._new_hash()
                 self._stir(self.digest)
                 self.next_byte = 0
             value = self.digest[self.next_byte]