def _get(self, request, name_obj, timestamp, url_subdir, date_form):
options_form, values = get_dnssec_options_form_data(request.GET)
use_js = 'no_js' not in request.GET
if use_js:
notices = {}
else:
rdtypes = set(values['rr'])
denial_of_existence = values['doe']
dnssec_algorithms = set(values['a'])
ds_algorithms = set(values['ds'])
trusted_keys_explicit = values['tk']
trusted_zones = values['ta']
redundant_edges = values['red']
# disable IANA root keys, if there is an explicit delegation of the root
# (i.e., ignore root KSK ta setting)
if name_obj.group is not None and name_obj.group.name == dns.name.root and \
name_obj.group.analysis_type == ANALYSIS_TYPE_AUTHORITATIVE and name_obj.group.explicit_delegation:
trusted_zones = filter(lambda x: x[0] != dns.name.root,
trusted_zones)
if '.' in options_form.fields['ta'].initial:
options_form.fields['ta'].initial.remove('.')
trusted_keys = trusted_keys_explicit + trusted_zones
G = DNSAuthGraph()
name_obj.retrieve_all()
name_obj.populate_status(trusted_keys,
supported_algs=dnssec_algorithms,
supported_digest_algs=ds_algorithms)
G = self._graph_name(name_obj, trusted_keys, rdtypes,
denial_of_existence)
G.add_trust(trusted_keys, supported_algs=dnssec_algorithms)
#G.remove_extra_edges(redundant_edges)
notices = get_notices(G.node_info)
analyzed_name_obj = name_obj
template = 'dnssec.html'
return render_to_response(template, {
'name_obj': name_obj,
'analyzed_name_obj': analyzed_name_obj,
'timestamp': timestamp,
'url_subdir': url_subdir,
'title': name_obj,
'options_form': options_form,
'date_form': date_form,
'notices': notices,
'use_js': use_js,
'query_string': request.META['QUERY_STRING']
},
context_instance=RequestContext(request))
def main(argv):
try:
test_m2crypto()
#TODO remove -p option (it is now the default, and -c is used to change it)
try:
opts, args = getopt.getopt(argv[1:], 'f:r:t:o:cpl:h')
except getopt.GetoptError as e:
usage(str(e))
sys.exit(1)
# collect trusted keys
trusted_keys = []
for opt, arg in opts:
if opt == '-t':
try:
tk_str = io.open(arg, 'r', encoding='utf-8').read()
except IOError as e:
sys.stderr.write('%s: "%s"\n' % (e.strerror, arg))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
sys.stderr.write('There was an error parsing the trusted keys file: "%s"\n' % arg)
sys.exit(3)
opts = dict(opts)
if '-h' in opts:
usage()
sys.exit(0)
if '-f' in opts and args:
usage('If -f is used, then domain names may not supplied as command line arguments.')
sys.exit(1)
if '-l' in opts:
if opts['-l'] == 'error':
loglevel = logging.ERROR
elif opts['-l'] == 'warning':
loglevel = logging.WARNING
elif opts['-l'] == 'info':
loglevel = logging.INFO
elif opts['-l'] == 'debug':
loglevel = logging.DEBUG
else:
usage('Invalid log level: "%s"' % opts['-l'])
sys.exit(1)
else:
loglevel = logging.DEBUG
handler = logging.StreamHandler()
handler.setLevel(logging.WARNING)
logger.addHandler(handler)
logger.setLevel(logging.WARNING)
if '-r' not in opts or opts['-r'] == '-':
opt_r = sys.stdin.fileno()
else:
opt_r = opts['-r']
try:
analysis_str = io.open(opt_r, 'r', encoding='utf-8').read()
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts.get('-r', '-')))
sys.exit(3)
try:
analysis_structured = json.loads(analysis_str)
except ValueError:
logger.error('There was an error parsing the json input: "%s"' % opts.get('-r', '-'))
sys.exit(3)
# check version
if '_meta._dnsviz.' not in analysis_structured or 'version' not in analysis_structured['_meta._dnsviz.']:
logger.error('No version information in JSON input.')
sys.exit(3)
try:
major_vers, minor_vers = [int(x) for x in str(analysis_structured['_meta._dnsviz.']['version']).split('.', 1)]
except ValueError:
logger.error('Version of JSON input is invalid: %s' % analysis_structured['_meta._dnsviz.']['version'])
sys.exit(3)
# ensure major version is a match and minor version is no greater
# than the current minor version
curr_major_vers, curr_minor_vers = [int(x) for x in str(DNS_RAW_VERSION).split('.', 1)]
if major_vers != curr_major_vers or minor_vers > curr_minor_vers:
logger.error('Version %d.%d of JSON input is incompatible with this software.' % (major_vers, minor_vers))
sys.exit(3)
names = []
if '-f' in opts:
if opts['-f'] == '-':
opts['-f'] = sys.stdin.fileno()
try:
f = io.open(opts['-f'], 'r', encoding='utf-8')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-f']))
sys.exit(3)
for line in f:
name = line.strip()
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
f.close()
else:
if args:
# python3/python2 dual compatibility
if isinstance(args[0], bytes):
args = [codecs.decode(x, sys.getfilesystemencoding()) for x in args]
else:
try:
args = analysis_structured['_meta._dnsviz.']['names']
except KeyError:
logger.error('No names found in json input!')
sys.exit(3)
for name in args:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
if '-o' not in opts or opts['-o'] == '-':
opts['-o'] = sys.stdout.fileno()
try:
fh = io.open(opts['-o'], 'wb')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-o']))
sys.exit(3)
if '-c' not in opts:
kwargs = { 'indent': 4, 'separators': (',', ': ') }
else:
kwargs = {}
# if trusted keys were supplied, check that pygraphviz is installed
if trusted_keys:
test_pygraphviz()
name_objs = []
cache = {}
for name in names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True):
logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text()))
continue
name_objs.append(OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache))
if not name_objs:
sys.exit(4)
d = OrderedDict()
for name_obj in name_objs:
name_obj.populate_status(trusted_keys)
if trusted_keys:
G = DNSAuthGraph()
for qname, rdtype in name_obj.queries:
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY, dns.rdatatype.DS, dns.rdatatype.DLV):
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
for target, mx_obj in name_obj.mx_targets.items():
if mx_obj is not None:
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.AAAA)
for target, ns_obj in name_obj.ns_dependencies.items():
if ns_obj is not None:
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.AAAA)
G.add_trust(trusted_keys)
name_obj.populate_response_component_status(G)
name_obj.serialize_status(d, loglevel=loglevel)
if d:
s = json.dumps(d, ensure_ascii=False, **kwargs)
if '-c' not in opts and fh.isatty() and os.environ.get('TERM', 'dumb') != 'dumb':
s = color_json(s)
fh.write(s.encode('utf-8'))
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
name_obj.populate_status(trusted_keys)
if trusted_keys:
G = DNSAuthGraph()
for qname, rdtype in name_obj.queries:
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY, dns.rdatatype.DS, dns.rdatatype.DLV):
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
for target, mx_obj in name_obj.mx_targets.items():
if mx_obj is not None:
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.AAAA)
for target, ns_obj in name_obj.ns_dependencies.items():
if ns_obj is not None:
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.AAAA)
G.add_trust(trusted_keys)
name_obj.populate_response_component_status(G)
name_obj.serialize_status(d, loglevel=loglevel)
if d:
fh.write(json.dumps(d, **kwargs))
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
if __name__ == "__main__":
main(sys.argv)
def main(argv):
try:
arghelper = GrokArgHelper(logger)
arghelper.build_parser('%s %s' % (sys.argv[0], argv[0]), argv[1:])
logger.setLevel(logging.WARNING)
try:
arghelper.check_args()
arghelper.set_kwargs()
arghelper.set_buffers()
arghelper.aggregate_trusted_key_info()
arghelper.ingest_input()
arghelper.ingest_names()
except argparse.ArgumentTypeError as e:
arghelper.parser.error(str(e))
except AnalysisInputError as e:
s = str(e)
if s:
logger.error(s)
sys.exit(3)
if arghelper.args.minimize_output:
kwargs = {}
else:
kwargs = {'indent': 4, 'separators': (',', ': ')}
# if trusted keys were supplied, check that pygraphviz is installed
if arghelper.trusted_keys:
test_pygraphviz()
name_objs = []
cache = {}
for name in arghelper.names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in arghelper.analysis_structured or arghelper.analysis_structured[
name_str].get('stub', True):
logger.error(
'The analysis of "%s" was not found in the input.' %
lb2s(name.to_text()))
continue
name_obj = OfflineDomainNameAnalysis.deserialize(
name,
arghelper.analysis_structured,
cache,
strict_cookies=arghelper.args.enforce_cookies,
allow_private=arghelper.args.allow_private)
name_objs.append(name_obj)
if not name_objs:
sys.exit(4)
arghelper.update_trusted_key_info()
d = OrderedDict()
for name_obj in name_objs:
name_obj.populate_status(
arghelper.trusted_keys,
supported_algs=arghelper.args.algorithms,
supported_digest_algs=arghelper.args.digest_algorithms)
if arghelper.trusted_keys:
G = DNSAuthGraph()
for qname, rdtype in name_obj.queries:
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY,
dns.rdatatype.DS,
dns.rdatatype.DLV):
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
for target, mx_obj in name_obj.mx_targets.items():
if mx_obj is not None:
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.AAAA)
for target, ns_obj in name_obj.ns_dependencies.items():
if ns_obj is not None:
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.AAAA)
G.add_trust(arghelper.trusted_keys,
supported_algs=arghelper.args.algorithms)
name_obj.populate_response_component_status(G)
name_obj.serialize_status(d, loglevel=arghelper.log_level)
if d:
s = json.dumps(d, ensure_ascii=False, **kwargs)
if not arghelper.args.minimize_output and arghelper.args.output_file.isatty(
) and os.environ.get('TERM', 'dumb') != 'dumb':
s = color_json(s)
arghelper.args.output_file.write(s.encode('utf-8'))
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
G = DNSAuthGraph()
for qname, rdtype in name_obj.queries:
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY,
dns.rdatatype.DS,
dns.rdatatype.DLV):
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
for target, mx_obj in name_obj.mx_targets.items():
if mx_obj is not None:
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.AAAA)
for target, ns_obj in name_obj.ns_dependencies.items():
if ns_obj is not None:
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.AAAA)
G.add_trust(trusted_keys)
name_obj.populate_response_component_status(G)
name_obj.serialize_status(d, loglevel=loglevel)
if d:
fh.write(json.dumps(d, **kwargs))
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
if __name__ == "__main__":
main(sys.argv)
