|
62 | 62 | for v in rtype:
|
63 | 63 | dnstype[(v['type'])] = v['value']
|
64 | 64 |
|
65 |
| -while (True): |
66 |
| - expiration = None |
67 |
| - if not (args.filetoimport): |
68 |
| - parser.print_help() |
69 |
| - sys.exit(0) |
70 |
| - with open(args.filetoimport) as dnsimport: |
71 |
| - records = json.load(dnsimport) |
72 |
| - |
73 |
| - print (records) |
74 |
| - if records is False: |
75 |
| - logger.debug('Parsing of passive DNS line failed: {}'.format(l.strip())) |
| 65 | +expiration = None |
| 66 | +if not (args.filetoimport): |
| 67 | + parser.print_help() |
| 68 | + sys.exit(0) |
| 69 | +with open(args.filetoimport) as dnsimport: |
| 70 | + records = json.load(dnsimport) |
| 71 | + |
| 72 | +print (records) |
| 73 | +for rdns in records: |
| 74 | + logger.debug("parsed record: {}".format(r)) |
| 75 | + if 'rrname' not in rdns: |
| 76 | + logger.debug('Parsing of passive DNS line is incomplete: {}'.format(l.strip())) |
76 | 77 | continue
|
77 |
| - for rdns in records: |
78 |
| - logger.debug("parsed record: {}".format(r)) |
79 |
| - if 'rrname' not in rdns: |
80 |
| - logger.debug('Parsing of passive DNS line is incomplete: {}'.format(l.strip())) |
81 |
| - continue |
82 |
| - if rdns['rrname'] and rdns['rrtype']: |
83 |
| - rdns['type'] = dnstype[rdns['rrtype']] |
84 |
| - rdns['v'] = rdns['rdata'] |
85 |
| - excludeflag = False |
86 |
| - for exclude in excludesubstrings: |
87 |
| - if exclude in rdns['rrname']: |
88 |
| - excludeflag = True |
89 |
| - if excludeflag: |
90 |
| - logger.debug('Excluded {}'.format(rdns['rrname'])) |
91 |
| - continue |
92 |
| - if rdns['type'] == '16': |
93 |
| - rdns['v'] = rdns['v'].replace("\"", "", 1) |
94 |
| - query = "r:{}:{}".format(rdns['rrname'],rdns['type']) |
95 |
| - logger.debug('redis sadd: {} -> {}'.format(query,rdns['v'])) |
96 |
| - r.sadd(query, rdns['v']) |
97 |
| - res = "v:{}:{}".format(rdns['v'], rdns['type']) |
98 |
| - logger.debug('redis sadd: {} -> {}'.format(res,rdns['rrname'])) |
99 |
| - r.sadd(res, rdns['q']) |
100 |
| - |
101 |
| - firstseen = "s:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
102 |
| - if not r.exists(firstseen): |
103 |
| - r.set(firstseen, rdns['time_first']) |
104 |
| - logger.debug('redis set: {} -> {}'.format(firstseen, rdns['time_first'])) |
105 |
| - |
106 |
| - |
107 |
| - lastseen = "l:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
108 |
| - last = r.get(lastseen) |
109 |
| - if last is None or int(last) < int(rdns['timestamp']): |
110 |
| - r.set(lastseen, rdns['time_last']) |
111 |
| - logger.debug('redis set: {} -> {}'.format(lastseen, rdns['time_last'])) |
112 |
| - |
113 |
| - occ = "o:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
114 |
| - r.set(occ, rdns['count']) |
115 |
| - |
116 |
| - |
117 |
| - if stats: |
118 |
| - r.incrby('stats:processed', amount=1) |
119 |
| - if not r: |
120 |
| - logger.info('empty passive dns record') |
| 78 | + if rdns['rrname'] and rdns['rrtype']: |
| 79 | + rdns['type'] = dnstype[rdns['rrtype']] |
| 80 | + rdns['v'] = rdns['rdata'] |
| 81 | + excludeflag = False |
| 82 | + for exclude in excludesubstrings: |
| 83 | + if exclude in rdns['rrname']: |
| 84 | + excludeflag = True |
| 85 | + if excludeflag: |
| 86 | + logger.debug('Excluded {}'.format(rdns['rrname'])) |
121 | 87 | continue
|
| 88 | + if rdns['type'] == '16': |
| 89 | + rdns['v'] = rdns['v'].replace("\"", "", 1) |
| 90 | + query = "r:{}:{}".format(rdns['rrname'],rdns['type']) |
| 91 | + logger.debug('redis sadd: {} -> {}'.format(query,rdns['v'])) |
| 92 | + r.sadd(query, rdns['v']) |
| 93 | + res = "v:{}:{}".format(rdns['v'], rdns['type']) |
| 94 | + logger.debug('redis sadd: {} -> {}'.format(res,rdns['rrname'])) |
| 95 | + r.sadd(res, rdns['rrname']) |
| 96 | + |
| 97 | + firstseen = "s:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
| 98 | + if not r.exists(firstseen): |
| 99 | + r.set(firstseen, rdns['time_first']) |
| 100 | + logger.debug('redis set: {} -> {}'.format(firstseen, rdns['time_first'])) |
| 101 | + |
| 102 | + |
| 103 | + lastseen = "l:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
| 104 | + last = r.get(lastseen) |
| 105 | + if last is None or int(last) < int(rdns['time_last']): |
| 106 | + r.set(lastseen, rdns['time_last']) |
| 107 | + logger.debug('redis set: {} -> {}'.format(lastseen, rdns['time_last'])) |
| 108 | + |
| 109 | + occ = "o:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
| 110 | + r.set(occ, rdns['count']) |
| 111 | + |
| 112 | + |
| 113 | + if stats: |
| 114 | + r.incrby('stats:processed', amount=1) |
| 115 | + if not r: |
| 116 | + logger.info('empty passive dns record') |
| 117 | + continue |
0 commit comments