def probe(config: ProbeConfig, name_list: typing.List[str], cache={}):
tm = transport.DNSQueryTransportManager()
try:
rdclass = dns.rdataclass.IN
ceiling = None
analyst_cls = None
new_resolver_function = None
explicit_delegations, odd_ports = get_explicit_delegations(
tm, config.query_authoritative_servers, config.server_list)
if not config.query_authoritative_servers:
ceiling = None
analyst_cls = PrivateRecursiveAnalyst
new_resolver_function = _init_stub_resolver
else:
ceiling = dns.name.root
analyst_cls = PrivateAnalyst
new_resolver_function = _init_full_resolver
resolver = new_resolver_function(tm, explicit_delegations, odd_ports)
query_class_mixin = CustomQueryMixin
CustomQueryMixin.edns_options.append(_get_dns_cookie_option())
cache_lock = threading.Lock()
analysis_structured = OrderedDict()
analysis_structured['_meta._dnsviz.'] = {
'names': [lb2s(n) for n in name_list]
}
for name in name_list:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
r = _probe(
analyst_cls,
name,
config,
rdclass,
ceiling,
query_class_mixin,
explicit_delegations,
odd_ports,
cache,
cache_lock,
tm,
resolver,
)
if r is not None:
r.serialize(analysis_structured, config.meta_only)
return analysis_structured
finally:
tm.close()
def main(argv):
try:
test_pygraphviz()
arghelper = build_helper(logger, sys.argv[0], argv[0])
arghelper.parse_args(argv[1:])
logger.setLevel(logging.WARNING)
try:
arghelper.check_args()
arghelper.set_buffers()
arghelper.aggregate_trusted_key_info()
arghelper.ingest_input()
arghelper.ingest_names()
except argparse.ArgumentTypeError as e:
arghelper.parser.error(str(e))
except AnalysisInputError as e:
s = str(e)
if s:
logger.error(s)
sys.exit(3)
latest_analysis_date = None
name_objs = []
cache = {}
for name in arghelper.names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in arghelper.analysis_structured or arghelper.analysis_structured[
name_str].get('stub', True):
logger.error(
'The analysis of "%s" was not found in the input.' %
lb2s(name.to_text()))
continue
name_obj = TTLAgnosticOfflineDomainNameAnalysis.deserialize(
name,
arghelper.analysis_structured,
cache,
strict_cookies=arghelper.args.enforce_cookies,
allow_private=arghelper.args.allow_private)
name_objs.append(name_obj)
if latest_analysis_date is None or latest_analysis_date > name_obj.analysis_end:
latest_analysis_date = name_obj.analysis_end
if not name_objs:
sys.exit(4)
arghelper.update_trusted_key_info(latest_analysis_date)
G = DNSAuthGraph()
for name_obj in name_objs:
name_obj.populate_status(
arghelper.trusted_keys,
supported_algs=arghelper.args.algorithms,
supported_digest_algs=arghelper.args.digest_algorithms,
validate_prohibited_algs=arghelper.args.
validate_prohibited_algs)
for qname, rdtype in name_obj.queries:
if arghelper.args.rr_types is None:
# if rdtypes was not specified, then graph all, with some
# exceptions
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY,
dns.rdatatype.DS,
dns.rdatatype.DLV):
continue
else:
# if rdtypes was specified, then only graph rdtypes that
# were specified
if qname != name_obj.name or rdtype not in arghelper.args.rr_types:
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
if arghelper.args.rr_types is not None:
for rdtype in arghelper.args.rr_types:
if (name_obj.name, rdtype) not in name_obj.queries:
logger.error(
'No query for "%s/%s" was included in the analysis.'
% (lb2s(name_obj.name.to_text()),
dns.rdatatype.to_text(rdtype)))
if arghelper.args.derive_filename:
if name_obj.name == dns.name.root:
name = 'root'
else:
name = lb2s(
name_obj.name.canonicalize().to_text()).rstrip('.')
name = name.replace(os.sep, '--')
finish_graph(G, [name_obj], arghelper.args.rr_types,
arghelper.trusted_keys, arghelper.args.algorithms,
'%s.txt' % name)
G = DNSAuthGraph()
if not arghelper.args.derive_filename:
finish_graph(G, name_objs, arghelper.args.rr_types,
arghelper.trusted_keys, arghelper.args.algorithms,
arghelper.args.output_file.fileno())
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
def main(argv):
try:
test_pygraphviz()
try:
opts, args = getopt.getopt(argv[1:], 'f:r:R:et:a:d:CPOo:T:h')
except getopt.GetoptError as e:
sys.stderr.write('%s\n' % str(e))
sys.exit(1)
# collect trusted keys
trusted_keys = []
for opt, arg in opts:
if opt == '-t':
try:
with io.open(arg, 'r', encoding='utf-8') as fh:
tk_str = fh.read()
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, arg))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
logger.error(
'There was an error parsing the trusted keys file: "%s"'
% arg)
sys.exit(3)
opts = dict(opts)
if '-h' in opts:
usage()
sys.exit(0)
if '-f' in opts and args:
sys.stderr.write(
'If -f is used, then domain names may not supplied as command line arguments.\n'
)
sys.exit(1)
if '-R' in opts:
try:
rdtypes = opts['-R'].split(',')
except ValueError:
sys.stderr.write('The list of types was invalid: "%s"\n' %
opts['-R'])
sys.exit(1)
try:
rdtypes = [dns.rdatatype.from_text(x) for x in rdtypes]
except dns.rdatatype.UnknownRdatatype:
sys.stderr.write('The list of types was invalid: "%s"\n' %
opts['-R'])
sys.exit(1)
else:
rdtypes = None
if '-a' in opts:
try:
supported_algs = opts['-a'].split(',')
except ValueError:
sys.stderr.write('The list of algorithms was invalid: "%s"\n' %
opts['-a'])
sys.exit(1)
try:
supported_algs = set([int(x) for x in supported_algs])
except ValueError:
sys.stderr.write('The list of algorithms was invalid: "%s"\n' %
opts['-a'])
sys.exit(1)
else:
supported_algs = None
if '-d' in opts:
try:
supported_digest_algs = opts['-d'].split(',')
except ValueError:
sys.stderr.write(
'The list of digest algorithms was invalid: "%s"\n' %
opts['-d'])
sys.exit(1)
try:
supported_digest_algs = set(
[int(x) for x in supported_digest_algs])
except ValueError:
sys.stderr.write(
'The list of digest algorithms was invalid: "%s"\n' %
opts['-d'])
sys.exit(1)
else:
supported_digest_algs = None
strict_cookies = '-C' in opts
allow_private = '-P' in opts
remove_edges = '-e' not in opts
if '-T' in opts:
fmt = opts['-T']
elif '-o' in opts:
fmt = opts['-o'].split('.')[-1]
else:
fmt = 'dot'
if fmt not in ('dot', 'png', 'jpg', 'svg', 'html'):
sys.stderr.write('Image format unrecognized: "%s"\n' % fmt)
sys.exit(1)
if '-o' in opts and '-O' in opts:
sys.stderr.write(
'The -o and -O options may not be used together.\n')
sys.exit(1)
if '-r' not in opts or opts['-r'] == '-':
opt_r = sys.stdin.fileno()
else:
opt_r = opts['-r']
try:
with io.open(opt_r, 'r', encoding='utf-8') as fh:
analysis_str = fh.read()
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts.get('-r', '-')))
sys.exit(3)
if not analysis_str:
if opt_r != sys.stdin.fileno():
logger.error('No input.')
sys.exit(3)
try:
analysis_structured = json.loads(analysis_str)
except ValueError:
logger.error('There was an error parsing the JSON input: "%s"' %
opts.get('-r', '-'))
sys.exit(3)
# check version
if '_meta._dnsviz.' not in analysis_structured or 'version' not in analysis_structured[
'_meta._dnsviz.']:
logger.error('No version information in JSON input.')
sys.exit(3)
try:
major_vers, minor_vers = [
int(x) for x in str(analysis_structured['_meta._dnsviz.']
['version']).split('.', 1)
]
except ValueError:
logger.error('Version of JSON input is invalid: %s' %
analysis_structured['_meta._dnsviz.']['version'])
sys.exit(3)
# ensure major version is a match and minor version is no greater
# than the current minor version
curr_major_vers, curr_minor_vers = [
int(x) for x in str(DNS_RAW_VERSION).split('.', 1)
]
if major_vers != curr_major_vers or minor_vers > curr_minor_vers:
logger.error(
'Version %d.%d of JSON input is incompatible with this software.'
% (major_vers, minor_vers))
sys.exit(3)
names = OrderedDict()
if '-f' in opts:
if opts['-f'] == '-':
opts['-f'] = sys.stdin.fileno()
try:
f = io.open(opts['-f'], 'r', encoding='utf-8')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-f']))
sys.exit(3)
for line in f:
name = line.strip()
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
if name not in names:
names[name] = None
f.close()
else:
if args:
# python3/python2 dual compatibility
if isinstance(args[0], bytes):
args = [
codecs.decode(x, sys.getfilesystemencoding())
for x in args
]
else:
try:
args = analysis_structured['_meta._dnsviz.']['names']
except KeyError:
logger.error('No names found in JSON input!')
sys.exit(3)
for name in args:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
if name not in names:
names[name] = None
latest_analysis_date = None
name_objs = []
cache = {}
for name in names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in analysis_structured or analysis_structured[
name_str].get('stub', True):
logger.error(
'The analysis of "%s" was not found in the input.' %
lb2s(name.to_text()))
continue
name_obj = OfflineDomainNameAnalysis.deserialize(
name,
analysis_structured,
cache,
strict_cookies=strict_cookies,
allow_private=allow_private)
name_objs.append(name_obj)
if latest_analysis_date is None or latest_analysis_date > name_obj.analysis_end:
latest_analysis_date = name_obj.analysis_end
if not name_objs:
sys.exit(4)
if '-t' not in opts:
trusted_keys = get_default_trusted_keys(latest_analysis_date)
G = DNSAuthGraph()
for name_obj in name_objs:
name_obj.populate_status(
trusted_keys,
supported_algs=supported_algs,
supported_digest_algs=supported_digest_algs)
for qname, rdtype in name_obj.queries:
if rdtypes is None:
# if rdtypes was not specified, then graph all, with some
# exceptions
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY,
dns.rdatatype.DS,
dns.rdatatype.DLV):
continue
else:
# if rdtypes was specified, then only graph rdtypes that
# were specified
if qname != name_obj.name or rdtype not in rdtypes:
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
if rdtypes is not None:
for rdtype in rdtypes:
if (name_obj.name, rdtype) not in name_obj.queries:
logger.error(
'No query for "%s/%s" was included in the analysis.'
% (lb2s(name_obj.name.to_text()),
dns.rdatatype.to_text(rdtype)))
if '-O' in opts:
if name_obj.name == dns.name.root:
name = 'root'
else:
name = lb2s(
name_obj.name.canonicalize().to_text()).rstrip('.')
finish_graph(G, [name_obj], rdtypes, trusted_keys,
supported_algs, fmt, '%s.%s' % (name, fmt),
remove_edges)
G = DNSAuthGraph()
if '-O' not in opts:
if '-o' not in opts or opts['-o'] == '-':
finish_graph(G, name_objs, rdtypes, trusted_keys,
supported_algs, fmt, None, remove_edges)
else:
finish_graph(G, name_objs, rdtypes, trusted_keys,
supported_algs, fmt, opts['-o'], remove_edges)
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
def main(argv):
try:
test_m2crypto()
#TODO remove -p option (it is now the default, and -c is used to change it)
try:
opts, args = getopt.getopt(argv[1:], 'f:r:t:o:cpl:h')
except getopt.GetoptError as e:
usage(str(e))
sys.exit(1)
# collect trusted keys
trusted_keys = []
for opt, arg in opts:
if opt == '-t':
try:
tk_str = io.open(arg, 'r', encoding='utf-8').read()
except IOError as e:
sys.stderr.write('%s: "%s"\n' % (e.strerror, arg))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
sys.stderr.write('There was an error parsing the trusted keys file: "%s"\n' % arg)
sys.exit(3)
opts = dict(opts)
if '-h' in opts:
usage()
sys.exit(0)
if '-f' in opts and args:
usage('If -f is used, then domain names may not supplied as command line arguments.')
sys.exit(1)
if '-l' in opts:
if opts['-l'] == 'error':
loglevel = logging.ERROR
elif opts['-l'] == 'warning':
loglevel = logging.WARNING
elif opts['-l'] == 'info':
loglevel = logging.INFO
elif opts['-l'] == 'debug':
loglevel = logging.DEBUG
else:
usage('Invalid log level: "%s"' % opts['-l'])
sys.exit(1)
else:
loglevel = logging.DEBUG
handler = logging.StreamHandler()
handler.setLevel(logging.WARNING)
logger.addHandler(handler)
logger.setLevel(logging.WARNING)
if '-r' not in opts or opts['-r'] == '-':
opt_r = sys.stdin.fileno()
else:
opt_r = opts['-r']
try:
analysis_str = io.open(opt_r, 'r', encoding='utf-8').read()
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts.get('-r', '-')))
sys.exit(3)
try:
analysis_structured = json.loads(analysis_str)
except ValueError:
logger.error('There was an error parsing the json input: "%s"' % opts.get('-r', '-'))
sys.exit(3)
# check version
if '_meta._dnsviz.' not in analysis_structured or 'version' not in analysis_structured['_meta._dnsviz.']:
logger.error('No version information in JSON input.')
sys.exit(3)
try:
major_vers, minor_vers = [int(x) for x in str(analysis_structured['_meta._dnsviz.']['version']).split('.', 1)]
except ValueError:
logger.error('Version of JSON input is invalid: %s' % analysis_structured['_meta._dnsviz.']['version'])
sys.exit(3)
# ensure major version is a match and minor version is no greater
# than the current minor version
curr_major_vers, curr_minor_vers = [int(x) for x in str(DNS_RAW_VERSION).split('.', 1)]
if major_vers != curr_major_vers or minor_vers > curr_minor_vers:
logger.error('Version %d.%d of JSON input is incompatible with this software.' % (major_vers, minor_vers))
sys.exit(3)
names = []
if '-f' in opts:
if opts['-f'] == '-':
opts['-f'] = sys.stdin.fileno()
try:
f = io.open(opts['-f'], 'r', encoding='utf-8')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-f']))
sys.exit(3)
for line in f:
name = line.strip()
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
f.close()
else:
if args:
# python3/python2 dual compatibility
if isinstance(args[0], bytes):
args = [codecs.decode(x, sys.getfilesystemencoding()) for x in args]
else:
try:
args = analysis_structured['_meta._dnsviz.']['names']
except KeyError:
logger.error('No names found in json input!')
sys.exit(3)
for name in args:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
if '-o' not in opts or opts['-o'] == '-':
opts['-o'] = sys.stdout.fileno()
try:
fh = io.open(opts['-o'], 'wb')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-o']))
sys.exit(3)
if '-c' not in opts:
kwargs = { 'indent': 4, 'separators': (',', ': ') }
else:
kwargs = {}
# if trusted keys were supplied, check that pygraphviz is installed
if trusted_keys:
test_pygraphviz()
name_objs = []
cache = {}
for name in names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True):
logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text()))
continue
name_objs.append(OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache))
if not name_objs:
sys.exit(4)
d = OrderedDict()
for name_obj in name_objs:
name_obj.populate_status(trusted_keys)
if trusted_keys:
G = DNSAuthGraph()
for qname, rdtype in name_obj.queries:
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY, dns.rdatatype.DS, dns.rdatatype.DLV):
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
for target, mx_obj in name_obj.mx_targets.items():
if mx_obj is not None:
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.AAAA)
for target, ns_obj in name_obj.ns_dependencies.items():
if ns_obj is not None:
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.AAAA)
G.add_trust(trusted_keys)
name_obj.populate_response_component_status(G)
name_obj.serialize_status(d, loglevel=loglevel)
if d:
s = json.dumps(d, ensure_ascii=False, **kwargs)
if '-c' not in opts and fh.isatty() and os.environ.get('TERM', 'dumb') != 'dumb':
s = color_json(s)
fh.write(s.encode('utf-8'))
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
def main(argv):
try:
test_m2crypto()
test_pygraphviz()
try:
opts, args = getopt.getopt(argv[1:], 'f:r:R:t:Oo:T:h')
except getopt.GetoptError as e:
usage(str(e))
sys.exit(1)
# collect trusted keys
trusted_keys = []
for opt, arg in opts:
if opt == '-t':
try:
tk_str = io.open(arg, 'r', encoding='utf-8').read()
except IOError as e:
sys.stderr.write('%s: "%s"\n' % (e.strerror, arg))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
sys.stderr.write('There was an error parsing the trusted keys file: "%s"\n' % arg)
sys.exit(3)
opts = dict(opts)
if '-h' in opts:
usage()
sys.exit(0)
if '-f' in opts and args:
usage('If -f is used, then domain names may not supplied as command line arguments.')
sys.exit(1)
if '-R' in opts:
try:
rdtypes = opts['-R'].split(',')
except ValueError:
usage('The list of types was invalid: "%s"' % opts['-R'])
sys.exit(1)
try:
rdtypes = [dns.rdatatype.from_text(x) for x in rdtypes]
except dns.rdatatype.UnknownRdatatype:
usage('The list of types was invalid: "%s"' % opts['-R'])
sys.exit(1)
else:
rdtypes = None
if '-T' in opts:
fmt = opts['-T']
elif '-o' in opts:
fmt = opts['-o'].split('.')[-1]
else:
fmt = 'dot'
if fmt not in ('dot','png','jpg','svg','html'):
usage('Image format unrecognized: "%s"' % fmt)
sys.exit(1)
if '-o' in opts and '-O' in opts:
usage('The -o and -O options may not be used together.')
sys.exit(1)
handler = logging.StreamHandler()
handler.setLevel(logging.WARNING)
logger.addHandler(handler)
logger.setLevel(logging.WARNING)
if '-r' not in opts or opts['-r'] == '-':
opt_r = sys.stdin.fileno()
else:
opt_r = opts['-r']
try:
analysis_str = io.open(opt_r, 'r', encoding='utf-8').read()
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts.get('-r', '-')))
sys.exit(3)
try:
analysis_structured = json.loads(analysis_str)
except ValueError:
logger.error('There was an error parsing the json input: "%s"' % opts.get('-r', '-'))
sys.exit(3)
# check version
if '_meta._dnsviz.' not in analysis_structured or 'version' not in analysis_structured['_meta._dnsviz.']:
logger.error('No version information in JSON input.')
sys.exit(3)
try:
major_vers, minor_vers = [int(x) for x in str(analysis_structured['_meta._dnsviz.']['version']).split('.', 1)]
except ValueError:
logger.error('Version of JSON input is invalid: %s' % analysis_structured['_meta._dnsviz.']['version'])
sys.exit(3)
# ensure major version is a match and minor version is no greater
# than the current minor version
curr_major_vers, curr_minor_vers = [int(x) for x in str(DNS_RAW_VERSION).split('.', 1)]
if major_vers != curr_major_vers or minor_vers > curr_minor_vers:
logger.error('Version %d.%d of JSON input is incompatible with this software.' % (major_vers, minor_vers))
sys.exit(3)
names = []
if '-f' in opts:
if opts['-f'] == '-':
opts['-f'] = sys.stdin.fileno()
try:
f = io.open(opts['-f'], 'r', encoding='utf-8')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-f']))
sys.exit(3)
for line in f:
name = line.strip()
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
f.close()
else:
if args:
# python3/python2 dual compatibility
if isinstance(args[0], bytes):
args = [codecs.decode(x, sys.getfilesystemencoding()) for x in args]
else:
try:
args = analysis_structured['_meta._dnsviz.']['names']
except KeyError:
logger.error('No names found in json input!')
sys.exit(3)
for name in args:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
if '-t' not in opts:
try:
tk_str = io.open(TRUSTED_KEYS_ROOT, 'r', encoding='utf-8').read()
except IOError as e:
logger.error('Error reading trusted keys file "%s": %s' % (TRUSTED_KEYS_ROOT, e.strerror))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
logger.error('There was an error parsing the trusted keys file: "%s"' % arg)
sys.exit(3)
name_objs = []
cache = {}
for name in names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True):
logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text()))
continue
name_objs.append(OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache))
if not name_objs:
sys.exit(4)
G = DNSAuthGraph()
for name_obj in name_objs:
name_obj.populate_status(trusted_keys)
for qname, rdtype in name_obj.queries:
if rdtypes is None:
# if rdtypes was not specified, then graph all, with some
# exceptions
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY, dns.rdatatype.DS, dns.rdatatype.DLV):
continue
else:
# if rdtypes was specified, then only graph rdtypes that
# were specified
if qname != name_obj.name or rdtype not in rdtypes:
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
if rdtypes is not None:
for rdtype in rdtypes:
if (name_obj.name, rdtype) not in name_obj.queries:
logger.error('No query for "%s/%s" was included in the analysis.' % (lb2s(name_obj.name.to_text()), dns.rdatatype.to_text(rdtype)))
if '-O' in opts:
if name_obj.name == dns.name.root:
name = 'root'
else:
name = lb2s(name_obj.name.canonicalize().to_text()).rstrip('.')
finish_graph(G, [name_obj], rdtypes, trusted_keys, fmt, '%s.%s' % (name, fmt))
G = DNSAuthGraph()
if '-O' not in opts:
if '-o' not in opts or opts['-o'] == '-':
finish_graph(G, name_objs, rdtypes, trusted_keys, fmt, None)
else:
finish_graph(G, name_objs, rdtypes, trusted_keys, fmt, opts['-o'])
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
def main(argv):
try:
arghelper = GrokArgHelper(logger)
arghelper.build_parser('%s %s' % (sys.argv[0], argv[0]), argv[1:])
logger.setLevel(logging.WARNING)
try:
arghelper.check_args()
arghelper.set_kwargs()
arghelper.set_buffers()
arghelper.aggregate_trusted_key_info()
arghelper.ingest_input()
arghelper.ingest_names()
except argparse.ArgumentTypeError as e:
arghelper.parser.error(str(e))
except AnalysisInputError as e:
s = str(e)
if s:
logger.error(s)
sys.exit(3)
if arghelper.args.minimize_output:
kwargs = {}
else:
kwargs = {'indent': 4, 'separators': (',', ': ')}
# if trusted keys were supplied, check that pygraphviz is installed
if arghelper.trusted_keys:
test_pygraphviz()
name_objs = []
cache = {}
for name in arghelper.names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in arghelper.analysis_structured or arghelper.analysis_structured[
name_str].get('stub', True):
logger.error(
'The analysis of "%s" was not found in the input.' %
lb2s(name.to_text()))
continue
name_obj = OfflineDomainNameAnalysis.deserialize(
name,
arghelper.analysis_structured,
cache,
strict_cookies=arghelper.args.enforce_cookies,
allow_private=arghelper.args.allow_private)
name_objs.append(name_obj)
if not name_objs:
sys.exit(4)
arghelper.update_trusted_key_info()
d = OrderedDict()
for name_obj in name_objs:
name_obj.populate_status(
arghelper.trusted_keys,
supported_algs=arghelper.args.algorithms,
supported_digest_algs=arghelper.args.digest_algorithms)
if arghelper.trusted_keys:
G = DNSAuthGraph()
for qname, rdtype in name_obj.queries:
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY,
dns.rdatatype.DS,
dns.rdatatype.DLV):
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
for target, mx_obj in name_obj.mx_targets.items():
if mx_obj is not None:
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(mx_obj, target, dns.rdatatype.AAAA)
for target, ns_obj in name_obj.ns_dependencies.items():
if ns_obj is not None:
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.A)
G.graph_rrset_auth(ns_obj, target, dns.rdatatype.AAAA)
G.add_trust(arghelper.trusted_keys,
supported_algs=arghelper.args.algorithms)
name_obj.populate_response_component_status(G)
name_obj.serialize_status(d, loglevel=arghelper.log_level)
if d:
s = json.dumps(d, ensure_ascii=False, **kwargs)
if not arghelper.args.minimize_output and arghelper.args.output_file.isatty(
) and os.environ.get('TERM', 'dumb') != 'dumb':
s = color_json(s)
arghelper.args.output_file.write(s.encode('utf-8'))
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
def print_result(analysis_structured):
latest_analysis_date = None
name_objs = []
cache = {}
names = OrderedDict()
strict_cookies = False
allow_private = False
supported_digest_algs = None
supported_algs = None
rdtypes = None
args = analysis_structured['_meta._dnsviz.']['names']
for name in args:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
if name not in names:
names[name] = None
for name in names:
name_str = lb2s(name.canonicalize().to_text())
print('* %s' % name_str)
if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True):
logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text()))
continue
name_obj = TTLAgnosticOfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache, strict_cookies=strict_cookies, allow_private=allow_private)
name_objs.append(name_obj)
if latest_analysis_date is None or latest_analysis_date > name_obj.analysis_end:
latest_analysis_date = name_obj.analysis_end
if latest_analysis_date is None:
logger.error('The analysis of "%s" doesn\'t include at least one analysis.' % lb2s(name.to_text()))
print(names)
return
trusted_keys = get_default_trusted_keys(latest_analysis_date)
G = DNSAuthGraph()
for name_obj in name_objs:
name_obj.populate_status(trusted_keys, supported_algs=supported_algs, supported_digest_algs=supported_digest_algs)
for qname, rdtype in name_obj.queries:
if rdtypes is None:
# if rdtypes was not specified, then graph all, with some
# exceptions
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY, dns.rdatatype.DS, dns.rdatatype.DLV):
continue
else:
# if rdtypes was specified, then only graph rdtypes that
# were specified
if qname != name_obj.name or rdtype not in rdtypes:
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
if rdtypes is not None:
for rdtype in rdtypes:
if (name_obj.name, rdtype) not in name_obj.queries:
logger.error('No query for "%s/%s" was included in the analysis.' % (lb2s(name_obj.name.to_text()), dns.rdatatype.to_text(rdtype)))
finish_graph(G, name_objs, rdtypes, trusted_keys, supported_algs, None)
def probe(self):
_log.debug('Starting probing for "{}"'.format(self.domain))
a = dnsviz.commands.probe.BulkAnalyst(self.rdclass, self.try_ipv4, self.try_ipv6, self.client_ipv4, self.client_ipv6,
self.query_class_mixin, self.ceiling, self.edns_diagnostics,
self.stop_at_explicit, self.cache_level, self.rdtypes,
self.explicit_only, self.dlv_domain)
names = [self.domain_native]
name_objs = a.analyze(names)
name_objs = [x for x in name_objs if x is not None]
if len(name_objs) > 1:
raise ValueError('More than one name specified?')
name_obj = name_objs[0]
serialized_obj = OrderedDict()
name_obj.serialize(serialized_obj, False)
trusted_keys = get_default_trusted_keys(name_obj.analysis_end)
serialized_obj['_meta._dnsviz.'] = {'version': DNS_RAW_VERSION, 'names': [lb2s(n.to_text()) for n in names]}
cache = {}
analysis_obj = TTLAgnosticOfflineDomainNameAnalysis.deserialize(names[0], serialized_obj, cache)
analysis_obj.populate_status(trusted_keys)
# These errors are linked to the DS record
delegation_status = analysis_obj.delegation_status[43]
delegation_warnings = [w.description for w in analysis_obj.delegation_warnings[43]]
delegation_errors = [e.description for e in analysis_obj.delegation_errors[43]]
zone_status = analysis_obj.zone_status
zone_warnings = [w.description for w in analysis_obj.zone_warnings]
zone_errors = [e.description for e in analysis_obj.zone_errors]
dnssec_status = {
'dnssec': {'status': zone_status, 'warnings': zone_warnings, 'errors': zone_errors},
'delegation': {'status': delegation_status,
'warnings': delegation_warnings,
'errors': delegation_errors},
}
yield nagiosplugin.Metric('dnssec_status', dnssec_status, context='dnssec')
rrsig_errors = set()
rrsig_warnings = set()
rrsig_expiration = None
now = int(time.time())
for _, rrsigs in analysis_obj.rrsig_status.iteritems():
for rrsig, rrsets in rrsigs.iteritems():
for keymeta, single_rrsig_status in rrsets.iteritems():
if keymeta.name != self.domain_native:
continue
for w in single_rrsig_status.warnings:
rrsig_warnings.add('{}: {}'.format(keymeta, w.description))
for e in single_rrsig_status.errors:
rrsig_errors.add('{}: {}'.format(keymeta, e.description))
expire_seconds = rrsig.expiration - now
if rrsig_expiration is None or expire_seconds < rrsig_expiration:
rrsig_expiration = expire_seconds
yield nagiosplugin.Metric('rrsig_status',
{'errors': rrsig_errors,
'warnings': rrsig_warnings},
context='rrsig')
yield nagiosplugin.Metric('rrsig_expiration',
rrsig_expiration,
context='rrsig_expiration')
def main(argv):
try:
test_m2crypto()
test_pygraphviz()
try:
opts, args = getopt.getopt(argv[1:], 'f:r:R:t:Oo:h')
except getopt.GetoptError as e:
usage(str(e))
sys.exit(1)
# collect trusted keys
trusted_keys = []
for opt, arg in opts:
if opt == '-t':
try:
tk_str = io.open(arg, 'r', encoding='utf-8').read()
except IOError as e:
sys.stderr.write('%s: "%s"\n' % (e.strerror, arg))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
sys.stderr.write(
'There was an error parsing the trusted keys file: "%s"\n'
% arg)
sys.exit(3)
opts = dict(opts)
if '-h' in opts:
usage()
sys.exit(0)
if '-f' in opts and args:
usage(
'If -f is used, then domain names may not supplied as command line arguments.'
)
sys.exit(1)
if '-R' in opts:
try:
rdtypes = opts['-R'].split(',')
except ValueError:
usage('The list of types was invalid: "%s"' % opts['-R'])
sys.exit(1)
try:
rdtypes = [dns.rdatatype.from_text(x) for x in rdtypes]
except dns.rdatatype.UnknownRdatatype:
usage('The list of types was invalid: "%s"' % opts['-R'])
sys.exit(1)
else:
rdtypes = None
if '-o' in opts and '-O' in opts:
usage('The -o and -O options may not be used together.')
sys.exit(1)
handler = logging.StreamHandler()
handler.setLevel(logging.WARNING)
logger.addHandler(handler)
logger.setLevel(logging.WARNING)
if '-r' not in opts or opts['-r'] == '-':
opt_r = sys.stdin.fileno()
else:
opt_r = opts['-r']
try:
analysis_str = io.open(opt_r, 'r', encoding='utf-8').read()
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts.get('-r', '-')))
sys.exit(3)
try:
analysis_structured = json.loads(analysis_str)
except ValueError:
logger.error('There was an error parsing the json input: "%s"' %
opts.get('-r', '-'))
sys.exit(3)
# check version
if '_meta._dnsviz.' not in analysis_structured or 'version' not in analysis_structured[
'_meta._dnsviz.']:
logger.error('No version information in JSON input.')
sys.exit(3)
try:
major_vers, minor_vers = [
int(x) for x in str(analysis_structured['_meta._dnsviz.']
['version']).split('.', 1)
]
except ValueError:
logger.error('Version of JSON input is invalid: %s' %
analysis_structured['_meta._dnsviz.']['version'])
sys.exit(3)
# ensure major version is a match and minor version is no greater
# than the current minor version
curr_major_vers, curr_minor_vers = [
int(x) for x in str(DNS_RAW_VERSION).split('.', 1)
]
if major_vers != curr_major_vers or minor_vers > curr_minor_vers:
logger.error(
'Version %d.%d of JSON input is incompatible with this software.'
% (major_vers, minor_vers))
sys.exit(3)
names = []
if '-f' in opts:
if opts['-f'] == '-':
opts['-f'] = sys.stdin.fileno()
try:
f = io.open(opts['-f'], 'r', encoding='utf-8')
except IOError as e:
logger.error('%s: "%s"' % (e.strerror, opts['-f']))
sys.exit(3)
for line in f:
name = line.strip()
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
f.close()
else:
if args:
# python3/python2 dual compatibility
if isinstance(args[0], bytes):
args = [
codecs.decode(x, sys.getfilesystemencoding())
for x in args
]
else:
try:
args = analysis_structured['_meta._dnsviz.']['names']
except KeyError:
logger.error('No names found in json input!')
sys.exit(3)
for name in args:
try:
name = dns.name.from_text(name)
except UnicodeDecodeError as e:
logger.error('%s: "%s"' % (e, name))
except dns.exception.DNSException:
logger.error('The domain name was invalid: "%s"' % name)
else:
names.append(name)
if '-t' not in opts:
try:
tk_str = io.open(TRUSTED_KEYS_ROOT, 'r',
encoding='utf-8').read()
except IOError as e:
logger.error('Error reading trusted keys file "%s": %s' %
(TRUSTED_KEYS_ROOT, e.strerror))
sys.exit(3)
try:
trusted_keys.extend(get_trusted_keys(tk_str))
except dns.exception.DNSException:
logger.error(
'There was an error parsing the trusted keys file: "%s"' %
arg)
sys.exit(3)
name_objs = []
cache = {}
for name in names:
name_str = lb2s(name.canonicalize().to_text())
if name_str not in analysis_structured or analysis_structured[
name_str].get('stub', True):
logger.error(
'The analysis of "%s" was not found in the input.' %
lb2s(name.to_text()))
continue
name_objs.append(
TTLAgnosticOfflineDomainNameAnalysis.deserialize(
name, analysis_structured, cache))
if not name_objs:
sys.exit(4)
G = DNSAuthGraph()
for name_obj in name_objs:
name_obj.populate_status(trusted_keys)
for qname, rdtype in name_obj.queries:
if rdtypes is None:
# if rdtypes was not specified, then graph all, with some
# exceptions
if name_obj.is_zone() and rdtype in (dns.rdatatype.DNSKEY,
dns.rdatatype.DS,
dns.rdatatype.DLV):
continue
else:
# if rdtypes was specified, then only graph rdtypes that
# were specified
if qname != name_obj.name or rdtype not in rdtypes:
continue
G.graph_rrset_auth(name_obj, qname, rdtype)
if rdtypes is not None:
for rdtype in rdtypes:
if (name_obj.name, rdtype) not in name_obj.queries:
logger.error(
'No query for "%s/%s" was included in the analysis.'
% (lb2s(name_obj.name.to_text()),
dns.rdatatype.to_text(rdtype)))
if '-O' in opts:
if name_obj.name == dns.name.root:
name = 'root'
else:
name = lb2s(
name_obj.name.canonicalize().to_text()).rstrip('.')
finish_graph(G, [name_obj], rdtypes, trusted_keys,
'%s.txt' % name)
G = DNSAuthGraph()
if '-O' not in opts:
if '-o' not in opts or opts['-o'] == '-':
finish_graph(G, name_objs, rdtypes, trusted_keys, None)
else:
finish_graph(G, name_objs, rdtypes, trusted_keys, opts['-o'])
except KeyboardInterrupt:
logger.error('Interrupted.')
sys.exit(4)
