o .jQJ@sdZddlZddlmZddlmZmZddlZddl Zzddl Z Wn e y/ddl Z Ynwddl mZeeZGdddeZeGdd d Zd ed ed efd dZded eeedBffddZded edBfddZ d+dededed eeeeeeffddZd+dededed edBfddZ d,dedededed edBf d d!Z "    d-dedededed#ed$ed edBfd%d&Z    d.dededed#ed$ed edBf d'd(Z    d.dededed#ed$ed edBf d)d*Z!dS)/a3 RFC 6764 - Locating Services for Calendaring and Contacts (CalDAV/CardDAV) This module implements DNS-based service discovery for CalDAV and CardDAV servers as specified in RFC 6764. It allows clients to discover service endpoints from just a domain name or email address. Discovery methods (in order of preference): 1. DNS SRV records (_caldavs._tcp / _carddavs._tcp for TLS) 2. DNS TXT records (for path information) 3. Well-Known URIs (/.well-known/caldav or /.well-known/carddav) SECURITY CONSIDERATIONS: DNS-based discovery is vulnerable to attacks if DNS is not secured with DNSSEC: - DNS Spoofing: Attackers can provide malicious SRV/TXT records pointing to attacker-controlled servers - Downgrade Attacks: Malicious DNS can specify non-TLS services, causing credentials to be sent in plaintext - Man-in-the-Middle: Even with HTTPS, attackers can redirect to their servers MITIGATIONS: - require_tls=True (DEFAULT): Only accept HTTPS connections, preventing downgrade attacks - ssl_verify_cert=True (DEFAULT): Verify TLS certificates per RFC 6125 - Domain validation (RFC 6764 Section 8): Discovered hostnames must be in the same domain as the queried domain to prevent redirection attacks - Use DNSSEC when possible for DNS integrity - Manually verify discovered endpoints for sensitive applications - Consider certificate pinning for known domains For high-security environments, manual configuration may be preferable to automatic discovery. See: https://datatracker.ietf.org/doc/html/rfc6764 N) dataclass)urljoinurlparse)DAVErrorc@seZdZdZdS)DiscoveryErrorz#Raised when service discovery failsN)__name__ __module__ __qualname____doc__r r E/home/thesage/.local/lib/python3.10/site-packages/caldav/discovery.pyr8src@s|eZdZUdZeed<eed<eed<eed<eed<dZeed<dZ eed <d Z eed <d Z ed Bed <defddZ d S) ServiceInfoz5Information about a discovered CalDAV/CardDAV serviceurlhostnameportpathtlsrpriorityweightunknownsourceNusernamereturnc Cs&d|jd|jd|jd|jd S)NzServiceInfo(url=z , source=z , priority=z , username=))rrrr)selfr r r __str__Ls&zServiceInfo.__str__) rrr r str__annotations__intboolrrrrrr r r r r >s    r discovered_domainoriginal_domainrcCs>|d}|d}||krdS|d|rdSdS)a Check if discovered domain is the same as or a subdomain of the original domain. This prevents DNS hijacking attacks where malicious DNS records redirect to completely different domains (e.g., acme.com -> evil.hackers.are.us). Args: discovered_domain: The hostname discovered via DNS SRV/TXT or well-known URI original_domain: The domain from the user's identifier Returns: True if discovered_domain is safe (same domain or subdomain), False otherwise Examples: >>> _is_subdomain_or_same('calendar.example.com', 'example.com') True >>> _is_subdomain_or_same('example.com', 'example.com') True >>> _is_subdomain_or_same('evil.com', 'example.com') False >>> _is_subdomain_or_same('subdomain.calendar.example.com', 'example.com') True >>> _is_subdomain_or_same('exampleXcom.evil.com', 'example.com') False .TF)lowerstripendswith)r r! discoveredoriginalr r r _is_subdomain_or_samePsr( identifiercCshd|vrt|}|jp |dfSd|vr.|d}|dr"|dnd}|d}||fS|dfS)a  Extract domain and optional username from an email address or URL. Args: identifier: Email address (user@example.com) or domain (example.com) Returns: A tuple of (domain, username) where username is None if not present Examples: >>> _extract_domain('user@example.com') ('example.com', 'user') >>> _extract_domain('example.com') ('example.com', None) >>> _extract_domain('https://caldav.example.com/path') ('caldav.example.com', None) ://N@r)rrsplitr$)r)parsedpartsrdomainr r r _extract_domainzs   r1txt_datacCsF|D]}d|vr |dd\}}|dkr |SqdS)a Parse TXT record data to extract the path attribute. According to RFC 6764, TXT records contain attribute=value pairs. We're looking for the 'path' attribute. Args: txt_data: TXT record data (e.g., "path=/caldav/") Returns: The path value or None if not found Examples: >>> _parse_txt_record('path=/caldav/') '/caldav/' >>> _parse_txt_record('path=/caldav/ other=value') '/caldav/' =rN)r-r$r#)r2pairkeyvaluer r r _parse_txt_records  r8Tr0 service_typeuse_tlsc Cs|rdnd}d||d|}td|zKtj|d}g}|D]4}t|jd}t|j } t|j } t|j } td|d | d | d | d | || | | fq$|j d dd|WStjjtjjtjjfy} ztd|d| gWYd} ~ Sd} ~ ww)an Perform DNS SRV record lookup. Args: domain: The domain to query service_type: Either 'caldav' or 'carddav' use_tls: If True, query for TLS service (_caldavs), else non-TLS (_caldav) Returns: List of tuples: (hostname, port, priority, weight) Sorted by priority (lower is better), then randomized by weight s_._tcp.zPerforming SRV lookup for SRVr"zFound SRV record: :z (priority=z , weight=rcSs|d|d fS)Nr )xr r r sz_srv_lookup..)r6zSRV lookup failed for : N)logdebugdnsresolverresolvertargetrstriprrrrappendsortNXDOMAINNoAnswer exception DNSException) r0r9r:service_suffixsrv_nameanswersresultsrdatarrrrer r r _srv_lookups0    $ rYc Cs|rdnd}d||d|}td|z-tj|d}|D] }ddd|jD}td |t|}|rB|WSq"Wd Stjjtjj tj j fyl} ztd |d | WYd } ~ d Sd } ~ ww) a? Perform DNS TXT record lookup to find the service path. Args: domain: The domain to query service_type: Either 'caldav' or 'carddav' use_tls: If True, query for TLS service (_caldavs), else non-TLS (_caldav) Returns: The path from the TXT record, or None if not found r;r<r=r>zPerforming TXT lookup for TXTcSs$g|]}t|tr|dn|qS)zutf-8) isinstancebytesdecode).0r;r r r s$z_txt_lookup..zFound TXT record: zTXT lookup failed for rEN) rFrGrHrIrJjoinstringsr8rOrPrQrR) r0r9r:rStxt_namerUrWr2rrXr r r _txt_lookups2   rc timeoutssl_verify_certc CsPd|}d||}td|zvtj|||dd}|jdvrp|jd}|rptd|t||}t|} | jp@|} t | |sUt d |d | d Wd St || | j pc| j d krbdnd| jpgd| j d kddWS|jdkrtd|t ||d|dddWSWd Stjjy} ztd| WYd } ~ d Sd } ~ ww)a8 Try to discover service via Well-Known URI (RFC 5785). According to RFC 6764, if SRV/TXT lookup fails, clients should try: - https://domain/.well-known/caldav - https://domain/.well-known/carddav Security: Redirects to different domains are validated per RFC 6764 Section 8. Args: domain: The domain to query service_type: Either 'caldav' or 'carddav' timeout: Request timeout in seconds ssl_verify_cert: Whether to verify SSL certificates Returns: ServiceInfo if successful, None otherwise z /.well-known/zhttps://zTrying well-known URI: F)reverifyallow_redirects)i-i.i/i3i4LocationzWell-known URI redirected to: zVRFC 6764 Security: Rejecting well-known redirect to different domain. Queried domain: z, Redirect target: z&. Ignoring this redirect for security.NhttpsP/z well-known)rrrrrrz(Well-known URI is the service endpoint: TzWell-known URI lookup failed: )rFrGrequestsget status_codeheadersrrrr(warningr rschemer exceptionsRequestException) r0r9rerfwell_known_pathrresponselocation final_urlr.redirect_hostnamerXr r r _well_known_lookupsf       r|caldav prefer_tls require_tlsc Cs|dvr td|ddt|\}}td|d||r(td||r3dg}td n|r9dd gnd dg}td |D]s} t||| } | r| d \} } } }t| |shtd |d| dqDt||| }|swtdd}| r{dnd}| rdnd}| |kr|d| d| |}n |d| |}td|d|t || | || | |d|d SqDtdt ||||}|r||_ td|d|j |Std|d|d S)!a Discover CalDAV or CardDAV service for a domain or email address. This is the main entry point for RFC 6764 service discovery. It tries multiple methods in order: 1. DNS SRV records (with TLS preferred) 2. DNS TXT records for path information 3. Well-Known URIs as fallback SECURITY WARNING: RFC 6764 discovery relies on DNS, which can be spoofed if not using DNSSEC. An attacker controlling DNS could: - Redirect connections to a malicious server - Downgrade from HTTPS to HTTP to capture credentials - Perform man-in-the-middle attacks By default, require_tls=True prevents HTTP downgrade attacks. For production use, consider: - Using DNSSEC-validated domains - Manual verification of discovered endpoints - Pinning certificates for known domains Args: identifier: Domain name (example.com) or email address (user@example.com) service_type: Either 'caldav' or 'carddav' timeout: Timeout for HTTP requests in seconds ssl_verify_cert: Whether to verify SSL certificates prefer_tls: If True, try TLS services first (only used if require_tls=False) require_tls: If True (default), ONLY accept TLS connections. This prevents DNS-based downgrade attacks to plaintext HTTP. Set to False only if you explicitly need to support non-TLS servers and trust your DNS infrastructure. Returns: ServiceInfo object with discovered service details, or None if discovery fails Raises: DiscoveryError: If service_type is invalid Examples: >>> info = discover_service('user@example.com', 'caldav') >>> if info: ... print(f"Service URL: {info.url}") >>> # Allow non-TLS (INSECURE - only for testing) >>> info = discover_service('user@example.com', 'caldav', require_tls=False) )r}carddavzInvalid service_type: z. Must be 'caldav' or 'carddav')reasonz Discovering z service for domain: z$Username extracted from identifier: Tz/require_tls=True: Only attempting TLS discoveryFz:require_tls=False: Allowing non-TLS connections (INSECURE)rzVRFC 6764 Security: Rejecting SRV record pointing to different domain. Queried domain: z, Target FQDN: z6. This may indicate DNS hijacking or misconfiguration.z$No TXT record found, using root pathrmrjhttprkrlr*r@z Discovered z service via SRV: srv) rrrrrrrrrz(SRV lookup failed, trying well-known URIz service via well-known URI: zFailed to discover z service for N) rr1rFinforGrsrYr(rcr r|rr)r)r9rerfr~rr0r tls_optionsr: srv_recordsrrrrrrt default_portrwell_known_infor r r discover_servicedsp7            .rcCt|d||||dS)a Convenience function to discover CalDAV service. Args: identifier: Domain name or email address timeout: Timeout for HTTP requests in seconds ssl_verify_cert: Whether to verify SSL certificates prefer_tls: If True, try TLS services first require_tls: If True (default), only accept TLS connections Returns: ServiceInfo object or None r}r)r9rerfr~rrr)rerfr~rr r r discover_caldavrcCr)a Convenience function to discover CardDAV service. Args: identifier: Domain name or email address timeout: Timeout for HTTP requests in seconds ssl_verify_cert: Whether to verify SSL certificates prefer_tls: If True, try TLS services first require_tls: If True (default), only accept TLS connections Returns: ServiceInfo object or None rrrrr r r discover_carddav rr)T)rdT)r}rdTTT)rdTTT)"r logging dataclassesr urllib.parserr dns.exceptionrH dns.resolverniquestsro ImportErrorcaldav.lib.errorr getLoggerrrFrr rrr(tupler1r8listrrYrcr|rrrr r r r s%      *" 0* U