Skip to content

Commit 2d70b59

Browse files
MelindaShoreMelindaShore
committed
replaced examples with Shumons scripts
1 parent f79728e commit 2d70b59

13 files changed

+303
-123
lines changed

‎examples/checkdanecert.py

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
#!/usr/bin/env python
2+
#
3+
# Get a TLS certificate from a HTTP server and verify it with
4+
# DANE/DNSSEC. Only supports TLSA usage type 3 (DANE-EE).
5+
#
6+
7+
import sys, socket, hashlib
8+
from M2Crypto import SSL, X509
9+
import getdns
10+
11+
12+
def compute_hash(func, string):
13+
"""compute hash of string using given hash function"""
14+
h = func()
15+
h.update(string)
16+
return h.hexdigest()
17+
18+
19+
def get_tlsa_rdata_set(replies):
20+
tlsa_rdata_set = []
21+
for reply in replies:
22+
for rr in reply['answer']:
23+
if rr['type'] == getdns.GETDNS_RRTYPE_TLSA:
24+
rdata = rr['rdata']
25+
usage = rdata['certificate_usage']
26+
selector = rdata['selector']
27+
matching_type = rdata['matching_type']
28+
cadata = rdata['certificate_association_data']
29+
cadata = str(cadata).encode('hex')
30+
tlsa_rdata_set.append(
31+
(usage, selector, matching_type, cadata) )
32+
return tlsa_rdata_set
33+
34+
35+
def get_tlsa(port, proto, hostname):
36+
37+
qname = "_%d._%s.%s" % (port, proto, hostname)
38+
ctx = getdns.Context()
39+
extensions = { "dnssec_return_only_secure": getdns.GETDNS_EXTENSION_TRUE }
40+
results = ctx.general(name=qname,
41+
request_type=getdns.GETDNS_RRTYPE_TLSA,
42+
extensions=extensions)
43+
status = results['status']
44+
45+
if status == getdns.GETDNS_RESPSTATUS_GOOD:
46+
return get_tlsa_rdata_set(results['replies_tree'])
47+
else:
48+
print "getdns: failed looking up TLSA record, code: %d" % status
49+
return None
50+
51+
52+
def verify_tlsa(cert, usage, selector, matchtype, hexdata1):
53+
54+
if usage != 3:
55+
print "Only TLSA usage type 3 is currently supported"
56+
return
57+
58+
if selector == 0:
59+
certdata = cert.as_der()
60+
elif selector == 1:
61+
certdata = cert.get_pubkey().as_der()
62+
else:
63+
raise ValueError("selector type %d not recognized" % selector)
64+
65+
if matchtype == 0:
66+
hexdata2 = hexdump(certdata)
67+
elif matchtype == 1:
68+
hexdata2 = compute_hash(hashlib.sha256, certdata)
69+
elif matchtype == 2:
70+
hexdata2 = compute_hash(hashlib.sha512, certdata)
71+
else:
72+
raise ValueError("matchtype %d not recognized" % matchtype)
73+
74+
if hexdata1 == hexdata2:
75+
return True
76+
else:
77+
return False
78+
79+
80+
if __name__ == '__main__':
81+
82+
hostname, port = sys.argv[1:]
83+
port = int(port)
84+
tlsa_rdata_set = get_tlsa(port, "tcp", hostname)
85+
86+
ctx = SSL.Context()
87+
88+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
89+
sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
90+
91+
connection = SSL.Connection(ctx, sock=sock)
92+
connection.connect((hostname, port))
93+
94+
chain = connection.get_peer_cert_chain()
95+
# Get the first certificate from the chain (which will be the EE cert)
96+
cert = chain[0]
97+
98+
# find a matching TLSA record entry for the certificate
99+
tlsa_match = False
100+
for (usage, selector, matchtype, hexdata) in tlsa_rdata_set:
101+
if verify_tlsa(cert, usage, selector, matchtype, hexdata):
102+
tlsa_match = True
103+
print "Certificate matched TLSA record %d %d %d %s" % \
104+
(usage, selector, matchtype, hexdata)
105+
else:
106+
print "Certificate did not match TLSA record %d %d %d %s"% \
107+
(usage, selector, matchtype, hexdata)
108+
if tlsa_match:
109+
print "Found at least one matching TLSA record"
110+
111+
connection.close()
112+
ctx.close()
113+

‎examples/example_address.py

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎examples/example_dnssec.py

Lines changed: 0 additions & 44 deletions
This file was deleted.

‎examples/example_hostname.py

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎examples/get-general.py

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env python
2+
#
3+
# Given a DNS name and type, return the records in the DNS answer
4+
# section only, excluding any RRSIG records.
5+
#
6+
7+
import getdns, pprint, sys
8+
9+
extensions = { "dnssec_return_status" : getdns.GETDNS_EXTENSION_TRUE }
10+
11+
def get_rrtype(qtype):
12+
try:
13+
rrtype = eval("getdns.GETDNS_RRTYPE_%s" % qtype.upper())
14+
except AttributeError:
15+
print "Unknown DNS record type: %s" % qtype
16+
sys.exit(1)
17+
else:
18+
return rrtype
19+
20+
21+
def print_answer(r):
22+
pprint.pprint(r['replies_tree'][0]['answer'])
23+
return
24+
25+
26+
if __name__ == '__main__':
27+
28+
qname, qtype = sys.argv[1:]
29+
rrtype = get_rrtype(qtype)
30+
31+
ctx = getdns.Context()
32+
results = ctx.general(name=qname, request_type=rrtype,
33+
extensions=extensions)
34+
status = results['status']
35+
36+
if status == getdns.GETDNS_RESPSTATUS_GOOD:
37+
for reply in results['replies_tree']:
38+
answers = reply['answer'] # list of 1 here
39+
for answer in answers:
40+
if answer['type'] != getdns.GETDNS_RRTYPE_RRSIG:
41+
pprint.pprint(answer)
42+
elif status == getdns.GETDNS_RESPSTATUS_NO_NAME:
43+
print "%s, %s: no such name" % (qname, qtype)
44+
elif status == getdns.GETDNS_RESPSTATUS_ALL_TIMEOUT:
45+
print "%s, %s: query timed out" % (qname, qtype)
46+
else:
47+
print "%s, %s: unknown return code: %d" % results["status"]

‎examples/get-ip-many.py

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env python
2+
3+
import getdns, sys
4+
5+
ctx = getdns.Context()
6+
extensions = { "return_both_v4_and_v6" : getdns.GETDNS_EXTENSION_TRUE }
7+
8+
for hostname in sys.argv[1:]:
9+
results = ctx.address(name=hostname, extensions=extensions)
10+
if results["status"] == getdns.GETDNS_RESPSTATUS_GOOD:
11+
for addr in results["just_address_answers"]:
12+
print "%s: %s" % (hostname, addr["IPSTRING"])
13+
else:
14+
print "getdns.address() returned an error: %d" % results["status"]
15+

‎examples/get-ip-only-secure.py

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env python
2+
3+
import getdns, sys
4+
5+
hostname = sys.argv[1]
6+
7+
ctx = getdns.Context()
8+
extensions = {
9+
"return_both_v4_and_v6" : getdns.GETDNS_EXTENSION_TRUE,
10+
"dnssec_return_only_secure": getdns.GETDNS_EXTENSION_TRUE,
11+
}
12+
results = ctx.address(name=hostname, extensions=extensions)
13+
status = results['status']
14+
15+
if status == getdns.GETDNS_RESPSTATUS_GOOD:
16+
for addr in results["just_address_answers"]:
17+
print addr["IPSTRING"]
18+
elif status == getdns.GETDNS_RESPSTATUS_NO_SECURE_ANSWERS:
19+
print "No DNSSEC secured responses found"
20+
else:
21+
print "getdns.address() returned error: %d" % status

‎examples/get-ip.py

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python
2+
3+
import getdns, sys
4+
5+
hostname = sys.argv[1]
6+
7+
ctx = getdns.Context()
8+
extensions = { "return_both_v4_and_v6" : getdns.GETDNS_EXTENSION_TRUE }
9+
results = ctx.address(name=hostname, extensions=extensions)
10+
11+
if results["status"] == getdns.GETDNS_RESPSTATUS_GOOD:
12+
for addr in results["just_address_answers"]:
13+
print addr["IPSTRING"]
14+
else:
15+
print "getdns.address() returned an error: %d" % results["status"]
16+

‎examples/get-mx-ip.py

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#!/usr/bin/env python
2+
#
3+
4+
"""
5+
Lookup an MX record and printout all the MX preference, target, and
6+
associated IP addresses of the targets.
7+
"""
8+
9+
import getdns, pprint, sys
10+
11+
extensions = { "return_both_v4_and_v6" : getdns.GETDNS_EXTENSION_TRUE }
12+
13+
14+
def get_ip(ctx, qname):
15+
iplist = []
16+
results = ctx.address(name=qname, extensions=extensions)
17+
if results['status'] == getdns.GETDNS_RESPSTATUS_GOOD:
18+
for addr in results["just_address_answers"]:
19+
iplist.append(addr['IPSTRING'])
20+
else:
21+
print "getdns.address() returned an error: %d" % results['status']
22+
return iplist
23+
24+
25+
if __name__ == '__main__':
26+
27+
qname = sys.argv[1]
28+
29+
ctx = getdns.Context()
30+
results = ctx.general(name=qname, request_type=getdns.GETDNS_RRTYPE_MX)
31+
status = results['status']
32+
33+
hostlist = []
34+
if status == getdns.GETDNS_RESPSTATUS_GOOD:
35+
for reply in results['replies_tree']:
36+
answers = reply['answer']
37+
for answer in answers:
38+
if answer['type'] == getdns.GETDNS_RRTYPE_MX:
39+
iplist = get_ip(ctx, answer['rdata']['exchange'])
40+
for ip in iplist:
41+
hostlist.append( (answer['rdata']['preference'], \
42+
answer['rdata']['exchange'], ip) )
43+
elif status == getdns.GETDNS_RESPSTATUS_NO_NAME:
44+
print "%s, %s: no such name" % (qname, qtype)
45+
elif status == getdns.GETDNS_RESPSTATUS_ALL_TIMEOUT:
46+
print "%s, %s: query timed out" % (qname, qtype)
47+
else:
48+
print "%s, %s: unknown return code: %d" % results["status"]
49+
50+
for (pref, mx, addr) in sorted(hostlist):
51+
print pref, mx, addr

0 commit comments

Comments
 (0)