# -*- coding: utf-8 -*- # # Copyright Grégory Soutadé 2015 # This file is part of iwla # iwla is free software: you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # iwla is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with iwla. If not, see . # import socket import re from iwla import IWLA from iplugin import IPlugin """ Pre analysis hook Replace IP by reverse DNS names Plugin requirements : None Conf values needed : robot_domains* Output files : None Statistics creation : None Statistics update : valid_visitors: remote_addr dns_name_replaced dns_analyzed Statistics deletion : None """ class IWLAPostAnalysisReverseDNS(IPlugin): def load(self): self.robot_domains_re = [] robot_domains = self.iwla.getConfValue('robot_domains', []) for domain in robot_domains: self.robot_domains_re.append(re.compile(domain)) return True def hook(self): hits = self.iwla.getCurrentVisits() for (k, hit) in hits.items(): if hit.get('dns_analysed', False): continue # Do reverse for feed parser even if they're not # valid visitors if hit.get('robot', False) and not hit.get('feed_parser', False): continue res = self.iwla.reverseDNS(hit) for r in self.robot_domains_re: if r.match(hit['remote_addr']): hit['robot'] = True break