#!/usr/bin/env python

#

# DNSSEC Trust Anchor Fetcher

# https://github.com/kirei/get_trust_anchor

#

# Copyright (c) 2016, Paul Hoffman. All rights reserved.

#

# Redistribution and use in source and binary forms, with or without

# modification, are permitted provided that the following conditions are met:

#

# * Redistributions of source code must retain the above copyright notice, this

# list of conditions and the following disclaimer.

#

# * Redistributions in binary form must reproduce the above copyright notice,

# this list of conditions and the following disclaimer in the documentation

# and/or other materials provided with the distribution.

#

# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE

# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER

# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,

# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

"""

DNSSEC Trust Anchor Fetcher (get_trust_anchor.py)

This tool writes out a copy of the current DNSSEC trust anchor.

The primary design goal for this software is that it should be able to be run on any system

that has just Python (either 2.7 or 3.x) and the OpenSSL command line tool.

The steps it uses are:

Step 1. Fetch the trust anchor file from IANA using HTTPS

Step 2. Fetch the S/MIME signature for the trust anchor file from IANA using HTTPS

Step 3. Validate the signature on the trust anchor file using a built-in IANA CA key

Step 4. Extract the trust anchor key digests from the trust anchor file

Step 5. Check the validity period for each digest

Step 6. Verify that the trust anchors match the KSK in the root zone file

Step 7. Write out the trust anchors as a DNSKEY and DS records

Note that the validation is done against a built-in ICANN CA, not one retrieved through a

URL. This means that even if HTTPS authentication checking isn't done, the resulting

trust anchors are still cryptographically validated.

"""

# pylint: disable=wrong-import-order,wrong-import-position,import-error,no-name-in-module,broad-except,bare-except,too-many-locals

from __future__ import print_function

import argparse

import base64

import codecs

import datetime

import hashlib

import json

import os

import pprint

import re

import struct

import subprocess

import sys

import tempfile

import xml.etree.ElementTree

ICANN_ROOT_CA_CERT = '''

'''

URL_ROOT_ANCHORS = "https://data.iana.org/root-anchors/root-anchors.xml"

URL_ROOT_ANCHORS_SIGNATURE = "https://data.iana.org/root-anchors/root-anchors.p7s"

URL_ROOT_ZONE = "https://www.internic.net/domain/root.zone"

URL_RESOLVER_API = "https://dns.google.com/resolve?name=.&type=dnskey"

def die(*Strings):

"""Generic way to leave the program early"""

sys.stderr.write("".join(Strings) + " Exiting.\n")

exit(1)

PYTHON_MAJOR = int(sys.version_info[0])

PYTHON_MINOR = int(sys.version_info[1])

if (PYTHON_MAJOR == 2) and (PYTHON_MINOR != 7):

die("If this program is running in Python 2, it must be Python 2.7.")

# Get the urlopen and StringIO functions

if PYTHON_MAJOR == 2:

from urllib2 import urlopen

from StringIO import StringIO

else:

from urllib.request import urlopen

from io import StringIO

def bytes_to_string(byte_array):

return ascii_codec.decode(byte_array)[0]

def write_out_file(file_name, file_contents):

return

def dnskey_to_hex_of_hash(dnskey_dict, hash_type):

return (this_hash.hexdigest()).upper()

def fetch_ksk():

return ksks

def fetch_ksk_from_google():

return ksks

def fetch_ksk_from_zonefile():

return ksks

def validate_detached_signature(contents_filename, signature_filename, ca_filename):

print("Validation of the signature over the file succeeded.")

def extract_trust_anchors_from_xml(trust_anchor_xml):

return trust_anchors

def get_valid_trust_anchors(trust_anchors):

return valid_trust_anchors

def get_matching_ksk(ksk_records, valid_trust_anchors):

return matched_ksks

def export_ksk(valid_ksks, ds_record_filename, dnskey_record_filename):

write_out_file(ds_record_filename, ds_record_contents)

def main():

print("Could not delete {}: '{}'. Continuing".format(this_file, this_exception))

if __name__ == "__main__":

main()