|
62 | 62 | for v in rtype: |
63 | 63 | dnstype[(v['type'])] = v['value'] |
64 | 64 |
|
65 | | -while (True): |
66 | | - expiration = None |
67 | | - if not (args.filetoimport): |
68 | | - parser.print_help() |
69 | | - sys.exit(0) |
70 | | - with open(args.filetoimport) as dnsimport: |
71 | | - records = json.load(dnsimport) |
72 | | - |
73 | | - print (records) |
74 | | - if records is False: |
75 | | - logger.debug('Parsing of passive DNS line failed: {}'.format(l.strip())) |
| 65 | +expiration = None |
| 66 | +if not (args.filetoimport): |
| 67 | + parser.print_help() |
| 68 | + sys.exit(0) |
| 69 | +with open(args.filetoimport) as dnsimport: |
| 70 | + records = json.load(dnsimport) |
| 71 | + |
| 72 | +print (records) |
| 73 | +for rdns in records: |
| 74 | + logger.debug("parsed record: {}".format(r)) |
| 75 | + if 'rrname' not in rdns: |
| 76 | + logger.debug('Parsing of passive DNS line is incomplete: {}'.format(l.strip())) |
76 | 77 | continue |
77 | | - for rdns in records: |
78 | | - logger.debug("parsed record: {}".format(r)) |
79 | | - if 'rrname' not in rdns: |
80 | | - logger.debug('Parsing of passive DNS line is incomplete: {}'.format(l.strip())) |
81 | | - continue |
82 | | - if rdns['rrname'] and rdns['rrtype']: |
83 | | - rdns['type'] = dnstype[rdns['rrtype']] |
84 | | - rdns['v'] = rdns['rdata'] |
85 | | - excludeflag = False |
86 | | - for exclude in excludesubstrings: |
87 | | - if exclude in rdns['rrname']: |
88 | | - excludeflag = True |
89 | | - if excludeflag: |
90 | | - logger.debug('Excluded {}'.format(rdns['rrname'])) |
91 | | - continue |
92 | | - if rdns['type'] == '16': |
93 | | - rdns['v'] = rdns['v'].replace("\"", "", 1) |
94 | | - query = "r:{}:{}".format(rdns['rrname'],rdns['type']) |
95 | | - logger.debug('redis sadd: {} -> {}'.format(query,rdns['v'])) |
96 | | - r.sadd(query, rdns['v']) |
97 | | - res = "v:{}:{}".format(rdns['v'], rdns['type']) |
98 | | - logger.debug('redis sadd: {} -> {}'.format(res,rdns['rrname'])) |
99 | | - r.sadd(res, rdns['q']) |
100 | | - |
101 | | - firstseen = "s:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
102 | | - if not r.exists(firstseen): |
103 | | - r.set(firstseen, rdns['time_first']) |
104 | | - logger.debug('redis set: {} -> {}'.format(firstseen, rdns['time_first'])) |
105 | | - |
106 | | - |
107 | | - lastseen = "l:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
108 | | - last = r.get(lastseen) |
109 | | - if last is None or int(last) < int(rdns['timestamp']): |
110 | | - r.set(lastseen, rdns['time_last']) |
111 | | - logger.debug('redis set: {} -> {}'.format(lastseen, rdns['time_last'])) |
112 | | - |
113 | | - occ = "o:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
114 | | - r.set(occ, rdns['count']) |
115 | | - |
116 | | - |
117 | | - if stats: |
118 | | - r.incrby('stats:processed', amount=1) |
119 | | - if not r: |
120 | | - logger.info('empty passive dns record') |
| 78 | + if rdns['rrname'] and rdns['rrtype']: |
| 79 | + rdns['type'] = dnstype[rdns['rrtype']] |
| 80 | + rdns['v'] = rdns['rdata'] |
| 81 | + excludeflag = False |
| 82 | + for exclude in excludesubstrings: |
| 83 | + if exclude in rdns['rrname']: |
| 84 | + excludeflag = True |
| 85 | + if excludeflag: |
| 86 | + logger.debug('Excluded {}'.format(rdns['rrname'])) |
121 | 87 | continue |
| 88 | + if rdns['type'] == '16': |
| 89 | + rdns['v'] = rdns['v'].replace("\"", "", 1) |
| 90 | + query = "r:{}:{}".format(rdns['rrname'],rdns['type']) |
| 91 | + logger.debug('redis sadd: {} -> {}'.format(query,rdns['v'])) |
| 92 | + r.sadd(query, rdns['v']) |
| 93 | + res = "v:{}:{}".format(rdns['v'], rdns['type']) |
| 94 | + logger.debug('redis sadd: {} -> {}'.format(res,rdns['rrname'])) |
| 95 | + r.sadd(res, rdns['rrname']) |
| 96 | + |
| 97 | + firstseen = "s:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
| 98 | + if not r.exists(firstseen): |
| 99 | + r.set(firstseen, rdns['time_first']) |
| 100 | + logger.debug('redis set: {} -> {}'.format(firstseen, rdns['time_first'])) |
| 101 | + |
| 102 | + |
| 103 | + lastseen = "l:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
| 104 | + last = r.get(lastseen) |
| 105 | + if last is None or int(last) < int(rdns['time_last']): |
| 106 | + r.set(lastseen, rdns['time_last']) |
| 107 | + logger.debug('redis set: {} -> {}'.format(lastseen, rdns['time_last'])) |
| 108 | + |
| 109 | + occ = "o:{}:{}:{}".format(rdns['rrname'], rdns['v'], rdns['type']) |
| 110 | + r.set(occ, rdns['count']) |
| 111 | + |
| 112 | + |
| 113 | + if stats: |
| 114 | + r.incrby('stats:processed', amount=1) |
| 115 | + if not r: |
| 116 | + logger.info('empty passive dns record') |
| 117 | + continue |
0 commit comments