3
@6^0                 @   s8   d dl Z d dlZd dlmZmZmZ G dd deZdS )    N)
SpiderFootSpiderFootPluginSpiderFootEventc               @   s   e Zd ZdZi ZdZdZdZdZdZ	dZ
e fddZdd Zdd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd ZdS )sfp_ripezRIPE:Footprint,Investigate,Passive:Public Registries::Queries the RIPE registry (includes ARIN data) to identify netblocks and other info.Nc             C   sX   || _ | j | _| j | _d | _| j | _d | _x"t|j D ]}|| | j	|< q>W d S )N)
sftempStorageresultsmemCachecurrentEventSrc
nbreportedlastContentlistkeysopts)selfsfcuserOptsopt r   3/var/www/spiderfoot.crq.systems/modules/sfp_ripe.pysetup"   s    


zsfp_ripe.setupc             C   s   dddddgS )N
IP_ADDRESSNETBLOCK_MEMBERNETBLOCK_OWNERBGP_AS_OWNERBGP_AS_MEMBERr   )r   r   r   r   watchedEvents.   s    zsfp_ripe.watchedEventsc             C   s   ddddddgS )Nr   r   r   RAW_RIR_DATAr   BGP_AS_PEERr   )r   r   r   r   producedEvents5   s    zsfp_ripe.producedEventsc             C   sX   || j kr| j | }n>| jj|| jd | jd d}|d d k	rT|| j |< |d | _|S )N_fetchtimeout
_useragent)timeout	useragentcontent)r	   r   fetchUrlr   r   )r   urlresr   r   r   fetchRir:   s    


zsfp_ripe.fetchRirc             C   s   d }| j d| }|d d kr6| jjd| d  d S ytj|d }W n, tk
rt } z| jjd d S d }~X nX |d jd}|d kr| jjd d S |S )	Nz;https://stat.ripe.net/data/network-info/data.json?resource=r$   z%No Netblock info found/available for z	 at RIPE.zError processing JSON response.dataprefixz"Could not identify network prefix.)r(   r   debugjsonloads	Exceptionget)r   ipaddrr*   r'   jer   r   r   
ipNetblockF   s    zsfp_ripe.ipNetblockc             C   s   d }| j d| }|d d kr6| jjd| d  d S yHtj|d }t|d d dkrl|d d d }n|d d d }W n, tk
r } z| jjd	 d S d }~X nX x"|D ]}|d
 dkr|d }P qW |d krd S t|S )Nz4https://stat.ripe.net/data/whois/data.json?resource=r$   z'No AS info found/available for prefix: z	 at RIPE.r)   Zirr_recordsr   recordszError processing JSON response.keyoriginvalue)r(   r   r+   r,   r-   lenr.   str)r   r*   asnr'   r1   r)   r2   recr   r   r   
netblockAs\   s(    
zsfp_ripe.netblockAsc             C   s4  t  }ddddddddg}| jd	| }|d
 d krL| jjd| d  d S ytj|d
 }|d d }W n, tk
r } z| jjd d S d }~X nX x|D ]z}xt|D ]l}	xf|D ]^}
|	d j j|
r|	d j dkr|	d |k r||	d  j	|	d  q|	d g||	d < qW qW qW | jjdt
|  |S )Nasr7   authdescorgZmntadmintechz4https://stat.ripe.net/data/whois/data.json?resource=r$   z!No info found/available for ASN: z	 at RIPE.r)   r4   zError processing JSON response.r5   nullnonenone specifiedzReturning ownerinfo: )rC   rD   rE   )dictr(   r   r+   r,   r-   r.   lower
startswithappendr9   )r   r:   	ownerinfoZ	ownerkeysr'   r1   r)   r2   r;   dkr   r   r   asOwnerInfoy   s,    


zsfp_ripe.asOwnerInfoc             C   s   t  }| jd| }|d d kr8| jjd| d  d S ytj|d }|d d }W n, tk
r } z| jjd d S d }~X nX x.|D ]&}|j|d  | jjd	|d   qW |S )
NzChttps://stat.ripe.net/data/announced-prefixes/data.json?resource=ASr$   z(No netblocks info found/available for ASz	 at RIPE.r)   prefixeszError processing JSON response.r*   z(Additional netblock found from same AS: )	r   r(   r   r+   r,   r-   r.   rI   info)r   r:   	netblocksr'   r1   r)   r2   r;   r   r   r   asNetblocks   s    
zsfp_ripe.asNetblocksc             C   s   t  }| jd| }|d d kr8| jjd| d  d S ytj|d }|d d }W n, tk
r } z| jjd d S d }~X nX x|D ]}|jt|d  qW |S )	Nz?https://stat.ripe.net/data/asn-neighbours/data.json?resource=ASr$   z(No neighbour info found/available for ASz	 at RIPE.r)   
neighbourszError processing JSON response.r:   )	r   r(   r   r+   r,   r-   r.   rI   r9   )r   r:   rR   r'   r1   r)   r2   r;   r   r   r   asNeighbours   s    
zsfp_ripe.asNeighboursc             C   s   x | j  j D ]}||krdS qW | jd krJ| jj| j  j | jd | _dddg}t }xN| jD ]D}|j| |j|jdd |j|jdd |j|jdd	 qbW x8|D ]0}x*|D ]"}t	j
|j||t	jd k	rdS qW qW d
S )NT_internettldsz^{0}[-_/'"\\.,\?\!\s\d]z[-_/'"\\.,\?\!\s]{0}$z'[-_/'"\\.,\?\!\s]{0}[-_/'"\\.,\?\!\s\d]- _ F)	getTargetgetNameskeywordsr   domainKeywordsr   setaddreplacerematchformat
IGNORECASE)r   stringnrxZkeywordListkwrr   r   r   findName   s(    



zsfp_ripe.findNamec             C   sX   | j |}d}|d k	rTx<t|j D ],}|| }x|D ]}| j|j r6d}q6W q$W |S )NFT)rM   r   r   ri   rG   )r   r:   rJ   ZownedrL   itemsitemr   r   r   ownsAs   s    

zsfp_ripe.ownsAsc             C   s  |j }|j}|j}|| _| jjd| d |  || jkrR| jjd| d  d S d| j|< |jdr| j|}|d kr| jjd|  d S x|D ]|}| j	 rd S | j
|}d}|d k	rx.|j D ]"\}	}
||	 d	 d
j|
 d }qW t|dkrtd|| j|}| j| qW |dkr|| jkrd| j|< | j|}|d k	rxF|D ]>}|| jkrbqNd|krpqNtd|| j|}| j| qNW td| j| j|}| j| d S |jdrP| j|}|d kr| jjd|  d S |dkr2| j|r2td|| j|}| j| td| j| j|}| j| ntd|| j|}| j| d S |dkr| j|}|d kr| jjd|  d S | j|}|d kr| jjd|  d S | jj|r| jjd| d | d  td|| j|}| j| d S )NzReceived event, z, from z	Skipping z as already mapped.TZBGP_AS_zNo neighbors found to AS rX   z: z, 
r   r   r   :r   r   	NETBLOCK_zCould not identify BGP AS for r   r   z&Could not identify network prefix for zNetblock found: ()r   )	eventTypemoduler)   r
   r   r+   r   rH   rS   checkForStoprM   rj   joinr8   r   __name__notifyListenersr   rQ   r   r<   rl   r3   validIpNetworkrO   )r   event	eventNamesrcModuleName	eventDataneighsZnasnrJ   Z	ownertextrL   vevtrP   netblockr:   Zasevtr*   r   r   r   handleEvent   s    























zsfp_ripe.handleEvent)rv   
__module____qualname____doc__r   r   r
   r	   r   r[   r   rF   r   r   r   r(   r3   r<   rM   rQ   rS   ri   rl   r   r   r   r   r   r      s(   "r   )r`   r,   sflibr   r   r   r   r   r   r   r   <module>   s   