import socket from iwla import IWLA from iplugin import IPlugin # # Post analysis hook # # Replace IP by reverse DNS names # # Plugin requirements : # None # # Conf values needed : # reverse_dns_timeout* # # Output files : # None # # Statistics creation : # None # # Statistics update : # valid_visitors: # remote_addr # dns_name_replaced # dns_analyzed # # Statistics deletion : # None # class IWLAPostAnalysisReverseDNS(IPlugin): DEFAULT_DNS_TIMEOUT = 0.5 def __init__(self, iwla): super(IWLAPostAnalysisReverseDNS, self).__init__(iwla) self.API_VERSION = 1 def load(self): timeout = self.iwla.getConfValue('reverse_dns_timeout', IWLAPostAnalysisReverseDNS.DEFAULT_DNS_TIMEOUT) socket.setdefaulttimeout(timeout) return True def hook(self): hits = self.iwla.getValidVisitors() for (k, hit) in hits.items(): if hit.get('dns_analysed', False): continue try: name, _, _ = socket.gethostbyaddr(k) hit['remote_addr'] = name hit['dns_name_replaced'] = True except: pass finally: hit['dns_analysed'] = True