# -*- coding: utf-8 -*- # # Copyright Grégory Soutadé 2015 # This file is part of iwla # iwla is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # iwla is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with iwla. If not, see . # import socket from iwla import IWLA from iplugin import IPlugin """ Post analysis hook Replace IP by reverse DNS names Plugin requirements : None Conf values needed : reverse_dns_timeout* Output files : None Statistics creation : None Statistics update : valid_visitors: remote_addr dns_name_replaced dns_analyzed Statistics deletion : None """ class IWLAPostAnalysisReverseDNS(IPlugin): DEFAULT_DNS_TIMEOUT = 0.5 def load(self): timeout = self.iwla.getConfValue('reverse_dns_timeout', IWLAPostAnalysisReverseDNS.DEFAULT_DNS_TIMEOUT) socket.setdefaulttimeout(timeout) return True def hook(self): hits = self.iwla.getCurrentVisits() for (k, hit) in hits.items(): if hit.get('dns_analysed', False): continue # Do reverse for feed parser even if they're not # valid visitors if not hit.get('feed_parser', False) and\ not self.iwla.isValidVisitor(hit): continue try: name, _, _ = socket.gethostbyaddr(k) hit['remote_addr'] = name.lower() hit['dns_name_replaced'] = True except: pass finally: hit['dns_analysed'] = True