iwla/plugins/pre_analysis/reverse_dns.py

# -*- coding: utf-8 -*-
#
# Copyright Grégory Soutadé 2015

# This file is part of iwla

# iwla is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# iwla is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with iwla.  If not, see <http://www.gnu.org/licenses/>.
#

import socket
import re

from iwla import IWLA
from iplugin import IPlugin

"""
Pre analysis hook

Replace IP by reverse DNS names

Plugin requirements :
    None

Conf values needed :
    robot_domains*

Output files :
    None

Statistics creation :
    None

Statistics update :
valid_visitors:
   remote_addr
   dns_name_replaced
   dns_analyzed

Statistics deletion :
    None
"""

class IWLAPostAnalysisReverseDNS(IPlugin):

    def load(self):
        self.robot_domains_re = []
        robot_domains = self.iwla.getConfValue('robot_domains', [])
        for domain in robot_domains:
            self.robot_domains_re.append(re.compile(domain))

        return True
        
    def hook(self):
        hits = self.iwla.getCurrentVisits()
        for (k, hit) in hits.items():
            if hit.get('dns_analysed', False): continue
            # Do reverse for feed parser even if they're not
            # valid visitors
            if hit.get('robot', False) and not hit.get('feed_parser', False):
                continue

            res = self.iwla.reverseDNS(hit)
            
            for r in self.robot_domains_re:
                if r.match(hit['remote_addr']):
                    hit['robot'] = True
                    break