Don't throw a KeyError when a record is invalid

[public/dnssec-swede-utility.git] / swede

diff --git a/swede b/swede
index 861211e85b9834b674f487bcd53c2e3d8efd27d5..d7a6041d4f9dcd51966efa629a62b613d26091b6 100755 (executable)
--- a/swede
+++ b/swede
@@ -295,7 +295,7 @@ class TLSARecord:
 
        def isNameValid(self):
                """Check if the name if in the correct format"""
-               if not re.match('^(_\d{1,5}|\*)\._(tcp|udp|sctp)\.([a-z0-9]*\.){2,}$', self.name):
+               if not re.match('^(_\d{1,5}|\*)\._(tcp|udp|sctp)\.([-a-z0-9]*\.){2,}$', self.name):
                        return False
                return True
 
@@ -415,16 +415,16 @@ if __name__ == '__main__':
                        # First, check if the first three fields have correct values.
                        if not args.quiet:
                                print 'Received the following record for name %s:' % record.name
-                               print '\tUsage:\t\t\t\t%d (%s)' % (record.usage, {0:'CA Constraint', 1:'End-Entity Constraint', 2:'Trust Anchor'}[record.usage])
-                               print '\tSelector:\t\t\t%d (%s)' % (record.selector, {0:'Certificate', 1:'SubjectPublicKeyInfo'}[record.selector])
-                               print '\tMatching Type:\t\t\t%d (%s)' % (record.mtype, {0:'Full Certificate', 1:'SHA-256', 2:'SHA-512'}[record.mtype])
+                               print '\tUsage:\t\t\t\t%d (%s)' % (record.usage, {0:'CA Constraint', 1:'End-Entity Constraint', 2:'Trust Anchor'}.setdefault(record.usage, 'INVALID'))
+                               print '\tSelector:\t\t\t%d (%s)' % (record.selector, {0:'Certificate', 1:'SubjectPublicKeyInfo'}.setdefault(record.usage, 'INVALID'))
+                               print '\tMatching Type:\t\t\t%d (%s)' % (record.mtype, {0:'Full Certificate', 1:'SHA-256', 2:'SHA-512'}.setdefault(record.usage, 'INVALID'))
                                print '\tCertificate for Association:\t%s' % record.cert
 
                        try:
                                record.isValid(raiseException=True)
                        except RecordValidityException, e:
-                               print sys.stderr, 'Error: %s' % str(e)
-                               sys.exit(1)
+                               print >> sys.stderr, 'Error: %s' % str(e)
+                               continue
                        else:
                                if not args.quiet:
                                        print 'This record is valid (well-formed).'
@@ -469,7 +469,7 @@ if __name__ == '__main__':
                                        cert = chain[0]
                                        if verifyCertMatch(record, cert):
                                                if verify_result == 0: # The cert chains to a valid CA cert according to the system-certificates
-                                                       print 'SUCCES (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record and chains to a valid CA certificate'
+                                                       print 'SUCCESS (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record and chains to a valid CA certificate'
                                                else:
                                                        print 'FAIL (Usage 1): Certificate offered by the server matches the one mentioned in the TLSA record but the following error was raised during PKIX validation: %s' % getVerificationErrorReason(verify_result)
                                                        if pre_exit == 0: pre_exit = 2
@@ -488,7 +488,7 @@ if __name__ == '__main__':
                                        if matched:
                                                if cert.check_ca():
                                                        if verify_result == 0:
-                                                               print 'SUCCES (Usage 0): A certificate in the certificate chain offered by the server matches the one mentioned in the TLSA record and is a CA certificate'
+                                                               print 'SUCCESS (Usage 0): A certificate in the certificate chain offered by the server matches the one mentioned in the TLSA record and is a CA certificate'
                                                        else:
                                                                print 'FAIL (Usage 0): A certificate in the certificate chain offered by the server matches the one mentioned in the TLSA record and is a CA certificate, but the following error was raised during PKIX validation:' % getVerificationErrorReason(verify_result)
                                                                if pre_exit == 0: pre_exit = 2
@@ -507,7 +507,7 @@ if __name__ == '__main__':
                                                        matched = True
                                                        continue
                                        if matched:
-                                               print 'SUCCES (usage 2): A certificate in the certificate chain (including the end-entity certificate) offered by the server matches the TLSA record'
+                                               print 'SUCCESS (usage 2): A certificate in the certificate chain (including the end-entity certificate) offered by the server matches the TLSA record'
                                                if not args.quiet: print 'The matched certificate has Subject: %s' % cert.get_subject()
                                        else:
                                                print 'FAIL (usage 2): No certificate in the certificate chain (including the end-entity certificate) offered by the server matches the TLSA record'
@@ -588,14 +588,14 @@ if __name__ == '__main__':
                                                        break
 
                                if cert: # Print the requested records based on the retrieved certificates
-                                       if args.output == 'b':
+                                       if args.output == 'both':
                                                print genTLSA(args.host, args.protocol, args.port, cert, 'draft', args.usage, args.selector, args.mtype)
                                                print genTLSA(args.host, args.protocol, args.port, cert, 'rfc', args.usage, args.selector, args.mtype)
                                        else:
                                                print genTLSA(args.host, args.protocol, args.port, cert, args.output, args.usage, args.selector, args.mtype)
 
                else: # Pass the path to the certificate to the genTLSA function
-                       if args.output == 'b':
+                       if args.output == 'both':
                                print genTLSA(args.host, args.protocol, args.port, args.certificate, 'draft', args.usage, args.selector, args.mtype)
                                print genTLSA(args.host, args.protocol, args.port, args.certificate, 'rfc', args.usage, args.selector, args.mtype)
                        else: