pymensago/dnssec.py
def check_dnssec(domain: str) -> RetVal:
	'''Checks if the domain given is covered by DNSSEC and validates records found.'''

	global drdnssec_support, drdnssec_ips

	if not drdnssec_support:
		check_resolver_support()

	# Get the nameserver for the domain
	ns_ips = list()
	if drdnssec_support == 'upstream':
		try:
			response = dns.resolver.resolve(domain, dns.rdatatype.NS)
		except Exception as e:
			return RetVal().wrap_exception(e).set_error(ErrNotFound)

		nslist = list()
		for rr in range(response.rrset):
			nslist.append(rr.to_text())
		
		if len(nslist) < 1:
			return RetVal(ErrDNSError, 'no nameservers found for domain')
		
		response = None
		for ns in nslist:
			try:
				response = dns.resolver.resolve(ns, dns.rdatatype.NS)
			except:
				# We'll skip the ones that have errors and just use the good entries
				continue

			if len(response.rrset) > 0:
				ns_ips.append(response.rrset[0].to_text())
		
		if len(ns_ips) == 0:
			return RetVal(ErrDNSError, 'no IP addresses found for nameservers')

	else:
		ns_ips.extend(drdnssec_ips)

	# Now that we have the IP address(es) to query for a DNSSEC record, start checking to see
	# if the domain is signed by DNSSEC
	
	# The DNSKEY record contains the verification key for the zone
	
	for ns_ip in ns_ips:
		request = dns.message.make_query(domain, dns.rdatatype.DNSKEY, want_dnssec=True)
		try:
			response = dns.query.udp(request, ns_ip, timeout=2.0)
		except:
			continue
		else:
			break

	if response.rcode():
		# Query failed -- either a server error or no DNSKEY record
		return RetVal(ErrNoDNSSEC)
	
	# The response should contain two RRSET items: DNSKEY and RRSIG
	records = response.answer
	if len(records) != 2:
		return RetVal(ErrNetworkError)

	# the DNSKEY should be self-signed, validate it

	dname = dns.name.from_text(domain)
	try:
		dns.dnssec.validate(records[0], records[1], { dname: records[0] } )
	except dns.dnssec.ValidationFailure as e:
		return RetVal().wrap_exception(e).set_error(ErrValidationFailure)

	return RetVal()
Checks if the domain given is covered by DNSSEC and validates records found.
Checks if the domain given is covered by DNSSEC and validates records found.
Checks if the domain given is covered by DNSSEC and validates records found .
def check_dnssec(domain: str) -> RetVal:
	global drdnssec_support, drdnssec_ips
	if not drdnssec_support:
		check_resolver_support()
	ns_ips = list()
	if drdnssec_support == 'upstream':
		try:
			response = dns.resolver.resolve(domain, dns.rdatatype.NS)
		except Exception as e:
			return RetVal().wrap_exception(e).set_error(ErrNotFound)
		nslist = list()
		for rr in range(response.rrset):
			nslist.append(rr.to_text())
		if len(nslist) < 1:
			return RetVal(ErrDNSError, 'no nameservers found for domain')
		response = None
		for ns in nslist:
			try:
				response = dns.resolver.resolve(ns, dns.rdatatype.NS)
			except:
				continue
			if len(response.rrset) > 0:
				ns_ips.append(response.rrset[0].to_text())
		if len(ns_ips) == 0:
			return RetVal(ErrDNSError, 'no IP addresses found for nameservers')
	else:
		ns_ips.extend(drdnssec_ips)
	for ns_ip in ns_ips:
		request = dns.message.make_query(domain, dns.rdatatype.DNSKEY, want_dnssec=True)
		try:
			response = dns.query.udp(request, ns_ip, timeout=2.0)
		except:
			continue
		else:
			break
	if response.rcode():
		return RetVal(ErrNoDNSSEC)
	records = response.answer
	if len(records) != 2:
		return RetVal(ErrNetworkError)
	dname = dns.name.from_text(domain)
	try:
		dns.dnssec.validate(records[0], records[1], { dname: records[0] } )
	except dns.dnssec.ValidationFailure as e:
		return RetVal().wrap_exception(e).set_error(ErrValidationFailure)
	return RetVal()
def check_dnssec ( domain : str ) -> RetVal : global drdnssec_support , drdnssec_ips if not drdnssec_support : check_resolver_support ( ) ns_ips = list ( ) if drdnssec_support == 'upstream' : try : response = dns . resolver . resolve ( domain , dns . rdatatype . NS ) except Exception as e : return RetVal ( ) . wrap_exception ( e ) . set_error ( ErrNotFound ) nslist = list ( ) for rr in range ( response . rrset ) : nslist . append ( rr . to_text ( ) ) if len ( nslist ) < 1 : return RetVal ( ErrDNSError , 'no nameservers found for domain' ) response = None for ns in nslist : try : response = dns . resolver . resolve ( ns , dns . rdatatype . NS ) except : continue if len ( response . rrset ) > 0 : ns_ips . append ( response . rrset [ 0 ] . to_text ( ) ) if len ( ns_ips ) == 0 : return RetVal ( ErrDNSError , 'no IP addresses found for nameservers' ) else : ns_ips . extend ( drdnssec_ips ) for ns_ip in ns_ips : request = dns . message . make_query ( domain , dns . rdatatype . DNSKEY , want_dnssec = True ) try : response = dns . query . udp ( request , ns_ip , timeout = 2.0 ) except : continue else : break if response . rcode ( ) : return RetVal ( ErrNoDNSSEC ) records = response . answer if len ( records ) != 2 : return RetVal ( ErrNetworkError ) dname = dns . name . from_text ( domain ) try : dns . dnssec . validate ( records [ 0 ] , records [ 1 ] , { dname : records [ 0 ] } ) except dns . dnssec . ValidationFailure as e : return RetVal ( ) . wrap_exception ( e ) . set_error ( ErrValidationFailure ) return RetVal ( )
Checks if the domain given is covered by DNSSEC and validates records found.
Checks if the domain given is covered by DNSSEC and validates records found .
'''Checks if the domain given is covered by DNSSEC and validates records found.''' # Get the nameserver for the domain # We'll skip the ones that have errors and just use the good entries # Now that we have the IP address(es) to query for a DNSSEC record, start checking to see # if the domain is signed by DNSSEC # The DNSKEY record contains the verification key for the zone # Query failed -- either a server error or no DNSKEY record # The response should contain two RRSET items: DNSKEY and RRSIG # the DNSKEY should be self-signed, validate it
domain
str