mirror of
https://github.com/adulau/pdns-qof-server.git
synced 2024-11-22 10:07:10 +00:00
70 lines
14 KiB
Python
70 lines
14 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
# -*- coding: utf-8 -*-
|
||
|
|
#
|
||
|
|
# A pdns-qof compliant passive DNS interface for the pdns-toolkit
|
||
|
|
#
|
||
|
|
# https://github.com/adulau/pdns-qof-server/
|
||
|
|
# https://github.com/adulau/pdns-toolkit/
|
||
|
|
#
|
||
|
|
# The pdns-qof - Passive DNS Query Output Format Description are described at
|
||
|
|
#
|
||
|
|
# https://github.com/adulau/pdns-qof
|
||
|
|
#
|
||
|
|
# Software is free software released under the "Modified BSD license"
|
||
|
|
#
|
||
|
|
# Copyright (c) 2013 Alexandre Dulaunoy - a@foo.be
|
||
|
|
|
||
|
|
import redis
|
||
|
|
|
||
|
|
rrset = [{"Reference": "[RFC1035]", "Type": "A", "Value": "1", "Meaning": "a host address", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "NS", "Value": "2", "Meaning": "an authoritative name server", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MD", "Value": "3", "Meaning": "a mail destination (OBSOLETE - use MX)", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MF", "Value": "4", "Meaning": "a mail forwarder (OBSOLETE - use MX)", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "CNAME", "Value": "5", "Meaning": "the canonical name for an alias", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "SOA", "Value": "6", "Meaning": "marks the start of a zone of authority", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MB", "Value": "7", "Meaning": "a mailbox domain name (EXPERIMENTAL)", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MG", "Value": "8", "Meaning": "a mail group member (EXPERIMENTAL)", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MR", "Value": "9", "Meaning": "a mail rename domain name (EXPERIMENTAL)", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "NULL", "Value": "10", "Meaning": "a null RR (EXPERIMENTAL)", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "WKS", "Value": "11", "Meaning": "a well known service description", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "PTR", "Value": "12", "Meaning": "a domain name pointer", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "HINFO", "Value": "13", "Meaning": "host information", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MINFO", "Value": "14", "Meaning": "mailbox or mail list information", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "MX", "Value": "15", "Meaning": "mail exchange", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1035]", "Type": "TXT", "Value": "16", "Meaning": "text strings", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1183]", "Type": "RP", "Value": "17", "Meaning": "for Responsible Person", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1183][RFC5864]", "Type": "AFSDB", "Value": "18", "Meaning": "for AFS Data Base location", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1183]", "Type": "X25", "Value": "19", "Meaning": "for X.25 PSDN address", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1183]", "Type": "ISDN", "Value": "20", "Meaning": "for ISDN address", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1183]", "Type": "RT", "Value": "21", "Meaning": "for Route Through", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1706]", "Type": "NSAP", "Value": "22", "Meaning": "for NSAP address, NSAP style A record", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1348][RFC1637][RFC1706]", "Type": "NSAP-PTR", "Value": "23", "Meaning": "for domain name pointer, NSAP style", "Template": "", "Registration Date": ""}, {"Reference": "[RFC4034][RFC3755][RFC2535][RFC2536][RFC2537][RFC2931][RFC3110][RFC3008]", "Type": "SIG", "Value": "24", "Meaning": "for security signature", "Template": "", "Registration Date": ""}, {"Reference": "[RFC4034][RFC3755][RFC2535][RFC2536][RFC2537][RFC2539][RFC3008][RFC3110]", "Type": "KEY", "Value": "25", "Meaning": "for security key", "Template": "", "Registration Date": ""}, {"Reference": "[RFC2163]", "Type": "PX", "Value": "26", "Meaning": "X.400 mail mapping information", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1712]", "Type": "GPOS", "Value": "27", "Meaning": "Geographical Position", "Template": "", "Registration Date": ""}, {"Reference": "[RFC3596]", "Type": "AAAA", "Value": "28", "Meaning": "IP6 Address", "Template": "", "Registration Date": ""}, {"Reference": "[RFC1876]"
|
||
|
|
|
||
|
|
r=redis.StrictRedis(host='localhost', port=6379, db=0)
|
||
|
|
|
||
|
|
def getFirstSeen(t1 = None, t2 = None):
|
||
|
|
if t1 is None or t2 is None:
|
||
|
|
return False
|
||
|
|
rec = "s:"+t1.lower()+":"+t2.lower()
|
||
|
|
recget = r.get(rec)
|
||
|
|
if recget is not None:
|
||
|
|
return recget.decode(encoding='UTF-8')
|
||
|
|
|
||
|
|
def getLastSeen(t1 = None, t2 = None):
|
||
|
|
if t1 is None or t2 is None:
|
||
|
|
return False
|
||
|
|
rec = "l:"+t1.lower()+":"+t2.lower()
|
||
|
|
recget = r.get(rec)
|
||
|
|
if recget is not None:
|
||
|
|
return recget.decode(encoding='UTF-8')
|
||
|
|
|
||
|
|
def getCount(t1 = None, t2 = None):
|
||
|
|
if t1 is None or t2 is None:
|
||
|
|
return False
|
||
|
|
rec = "o:"+t1.lower()+":"+t2.lower()
|
||
|
|
recget = r.get(rec)
|
||
|
|
if recget is not None:
|
||
|
|
return recget.decode(encoding='UTF-8')
|
||
|
|
|
||
|
|
def getRecord(t = None):
|
||
|
|
if t is None:
|
||
|
|
return False
|
||
|
|
rrfound = []
|
||
|
|
for rr in rrset:
|
||
|
|
if (rr['Value']) is not None:
|
||
|
|
rec = "r:"+t+":"+rr['Value']
|
||
|
|
if r.smembers(rec):
|
||
|
|
rrval = {}
|
||
|
|
for v in r.smembers(rec):
|
||
|
|
rdata = v.decode(encoding='UTF-8')
|
||
|
|
rrval['time_first'] = getFirstSeen(t1=t, t2=rdata)
|
||
|
|
rrval['time_last'] = getLastSeen(t1=t, t2=rdata)
|
||
|
|
if rrval['time_first'] is None:
|
||
|
|
break
|
||
|
|
rrval['count'] = getCount(t1=t, t2=rdata)
|
||
|
|
rrval['rrtype'] = rr['Type']
|
||
|
|
rrval['rrname'] = t
|
||
|
|
rrval['rrdata'] = rdata
|
||
|
|
rrfound.append(rrval)
|
||
|
|
return rrfound
|
||
|
|
|
||
|
|
print (getRecord(t = "foo.be"))
|