Source code for dns_sprockets_lib.validators.rrsig_missing
'''
rrsig_missing - RRSet test: RrsigMissing
.. Copyright (c) 2015 Neustar, Inc. All rights reserved.
.. See COPYRIGHT.txt for full notice. See LICENSE.txt for terms and conditions.
'''
import dns.rdatatype
import dns.rdtypes.ANY.RRSIG
import dns.dnssec
import dns_sprockets_lib.validators as validators
[docs]class RrsigMissing(validators.RRSetTest):
# pylint: disable=too-few-public-methods
'''
Checks that all (non-RRSIG, non-delegated) RRSets are covered with an RRSIG.
'''
TEST_DNSSECTYPE = True
TEST_OPTARGS = {
'now': (None, 'Time to use for validating RRSIG time windows, e.g. 20150101123000')}
[docs] def __init__(self, args):
'''
'''
self.now = None
super(RrsigMissing, self).__init__(args)
self.posix_now = (self.now
and dns.rdtypes.ANY.RRSIG.sigtime_to_posixtime(self.now)
or None)
[docs] def run(self, context, suggested_tested, name, rdataset):
tested = None
result = None
# Only do this test for non-RRSIG, non-delegated RRSets:
if (rdataset.rdtype != dns.rdatatype.RRSIG
and not context.is_delegated(name)):
tested = suggested_tested
# Make sure there's a valid RRSIG for the rdataset:
rrsigset = context.zone_obj.get_rdataset(
name, 'RRSIG', covers=rdataset.rdtype)
if not rrsigset:
result = 'No RRSIG for name: %s' % (name)
else:
# Use dnspython's RRSIG validator:
try:
dns.dnssec.validate(
(name, rdataset),
(name, rrsigset),
{context.zone_name: context.dnskey_rdataset},
now=self.posix_now)
except dns.dnssec.UnsupportedAlgorithm, err:
result = str(err)
except dns.dnssec.ValidationFailure, err:
result = str(err)
return (tested, result)
# end of file