def handler(q=False):
if q is False:
return False
request = json.loads(q)
if not request.get('config') or not request['config'].get('apikey'):
misperrors['error'] = 'Farsight DNSDB apikey is missing'
return misperrors
if not request.get('attribute') or not check_input_attribute(request['attribute']):
return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
attribute = request['attribute']
if attribute['type'] not in mispattributes['input']:
return {'error': 'Unsupported attributes type'}
config = request['config']
if not config.get('server'):
config['server'] = DEFAULT_DNSDB_SERVER
client_args = {feature: config[feature] for feature in ('apikey', 'server')}
client = dnsdb2.Client(**client_args)
flex = add_flex_queries(config.get('flex_queries'))
if not config.get('limit'):
config['limit'] = DEFAULT_LIMIT
lookup_args = {
'limit': config['limit'],
'offset': 0,
'ignore_limited': True
}
to_query = lookup_ip if attribute['type'] in ('ip-src', 'ip-dst') else lookup_name
try:
response = to_query(client, attribute['value'], lookup_args, flex)
except dnsdb2.DnsdbException as e:
return {'error': e.__str__()}
if not response:
return {'error': f"Empty results on Farsight DNSDB for the {TYPE_TO_FEATURE[attribute['type']]}: {attribute['value']}."}
parser = FarsightDnsdbParser(attribute)
parser.parse_passivedns_results(response)
return parser.get_results()
def setUp(self) -> None:
self.server = 'https://unit.test'
self.apikey = 'abcdef-ghijkl-mnopqrstuvwxyz'
self.swclient = 'abc-client'
self.version = 'v1.2.3.4'
self.client = dnsdb2.Client(server=self.server,
apikey=self.apikey,
swclient=self.swclient,
version=self.version)
def handler(q=False):
if q is False:
return False
request = json.loads(q)
if not request.get('config') or not request['config'].get('apikey'):
misperrors['error'] = 'Farsight DNSDB apikey is missing'
return misperrors
if not request.get('attribute') or not check_input_attribute(
request['attribute']):
return {
'error':
f'{standard_error_message}, which should contain at least a type, a value and an uuid.'
}
attribute = request['attribute']
if attribute['type'] not in mispattributes['input']:
return {'error': 'Unsupported attributes type'}
config = request['config']
if not config.get('server'):
config['server'] = DEFAULT_DNSDB_SERVER
client_args = {
feature: config[feature]
for feature in ('apikey', 'server')
}
client = dnsdb2.Client(**client_args)
to_query, args = parse_input(attribute, config)
try:
response = to_query(client, *args)
except dnsdb2.DnsdbException as e:
return {'error': e.__str__()}
except dnsdb2.exceptions.QueryError:
return {
'error':
'Communication error occurs while executing a query, or the server reports an error due to invalid arguments.'
}
if not response:
return {
'error':
f"Empty results on Farsight DNSDB for the {TYPE_TO_FEATURE[attribute['type']]}: {attribute['value']}."
}
parser = FarsightDnsdbParser(attribute)
parser.parse_passivedns_results(response)
return parser.get_results()
def initialize(self):
config = self.get_config()
self._api_key = config[DNSDB_JSON_API_KEY]
self._client = dnsdb2.Client(config[DNSDB_JSON_API_KEY])
self.set_validator('domain', self._validate_domain)
return phantom.APP_SUCCESS
def test_ping_empty_key(self):
c = dnsdb2.Client('', server=self.server)
try:
self.assertTrue(c.ping())
finally:
c.close()
def test_bad_key(self):
c = dnsdb2.Client('invalid-key', server=self.server)
try:
self.assertRaises(dnsdb2.AccessDenied, c.rate_limit)
finally:
c.close()
def setUp(self):
self.apikey = os.getenv('APIKEY')
self.server = os.getenv('DNSDB_SERVER', dnsdb2.DEFAULT_DNSDB_SERVER)
if not self.apikey:
self.skipTest('apikey undefined')
self.client = dnsdb2.Client(apikey=self.apikey, server=self.server)
def test_ping_bad_key(self):
c = dnsdb2.Client('invalid-key', server=self.server)
try:
self.assertTrue(c.ping())
finally:
c.close()