rogue_one 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a66b70adea810f6e952e08294a0323dc2be06c23d7ccbc28739045829696aae5
-  data.tar.gz: 5d41ff1fa13254071aecef1cbf70168d818a963207922be4d44f134d9bb42f0d
+  metadata.gz: 36b1d9ea6171500c42fd1930ba0807e74d8df4908fdec5eb47f1b88b0262caf6
+  data.tar.gz: 3836ad7bc6a13b68e1fa07d5d584ccbe0da64c8a4c1ee31e16d8f6e5037ada7f
 SHA512:
-  metadata.gz: c08f2049c42ac79a9a0256ae2f99761748660fa3bd1981f680196540e4525db9b4e8dbba54264d35cc2b7b5773b96441886a0a7acb4900e1626cd42c34089304
-  data.tar.gz: a4cffb3b9d5c92f90ac267201417c459b334d38aa82a0631a43c7db15552bed00d11cc9f37291904f48bfad08c33f4bc7d051bf3946acf4c35fcdc9a7e927567
+  metadata.gz: 8659b118ceaf22a6ec4756d4f883f8bda633ddf1230aab126c2666ad967df887dd7b1fed576b2f3608ed0adefea695067030ed079b3a915af8c06b1398bd2bd0
+  data.tar.gz: 3c6debab123e645b9765627dda48bc5c2674ee9101f53da0c8bb967a72d54cea411213cc6b6d2354263f1034b73d75282058872779f75a1ac07ec3e5bb77a63d

data/README.md

@@ -39,16 +39,16 @@ Usage:
   rogue_one report [DNS_SERVER]
 
 Options:
+  [--custom-list=CUSTOM_LIST]    # A path to a custom list of domains
   [--default-list=DEFAULT_LIST]  # A default list of top 100 domains (Alexa or Fortune)
                                  # Default: alexa
-  [--custom-list=CUSTOM_LIST]    # A path to a custom list of domains
+  [--record-type=RECORD_TYPE]    # A type of the DNS resource to check
+                                 # Default: A
   [--threshold=N]                # Threshold value for determining malicious or not
   [--verbose], [--no-verbose]
 
 Show a report of a given DNS server
 
-Show a report of a given DNS server
-
 $ rogue_one report 1.1.1.1
 {
   "verdict": "benign one",

data/lib/rogue_one.rb

@@ -4,7 +4,6 @@ require "rogue_one/version"
 
 require "rogue_one/domain_list"
 
-require "rogue_one/resolver"
 require "rogue_one/detector"
 require "rogue_one/ping"
 require "rogue_one/cli"

data/lib/rogue_one/cli.rb

@@ -5,20 +5,36 @@ require "json"
 
 module RogueOne
   class CLI < Thor
+    class << self
+      def exit_on_failure?
+        true
+      end
+    end
+
     desc "report [DNS_SERVER]", "Show a report of a given DNS server"
-    method_option :default_list, type: :string, default: "alexa", desc: "A default list of top 100 domains (Alexa or Fortune)"
     method_option :custom_list, type: :string, desc: "A path to a custom list of domains"
+    method_option :default_list, type: :string, default: "alexa", desc: "A default list of top 100 domains (Alexa or Fortune)"
+    method_option :record_type, type: :string, default: "A", desc: "A type of the DNS resource to check"
     method_option :threshold, type: :numeric, desc: "Threshold value for determining malicious or not"
     method_option :verbose, type: :boolean
     def report(dns_server)
       with_error_handling do
         Ping.pong? dns_server
 
-        default_list = options["default_list"].downcase
         custom_list = options["custom_list"]
+        default_list = options["default_list"].downcase
+        record_type = options["record_type"].upcase
         threshold = options["threshold"]
         verbose = options["verbose"]
-        detector = Detector.new(target: dns_server, default_list: default_list, custom_list: custom_list, threshold: threshold, verbose: verbose)
+
+        detector = Detector.new(
+          custom_list: custom_list,
+          default_list: default_list,
+          record_type: record_type,
+          target: dns_server,
+          threshold: threshold,
+          verbose: verbose,
+        )
         puts JSON.pretty_generate(detector.report)
       end
     end

data/lib/rogue_one/detector.rb

@@ -11,18 +11,26 @@ require "etc"
 
 module RogueOne
   class Detector
-    attr_reader :target
-    attr_reader :default_list
     attr_reader :custom_list
-    attr_reader :verbose
+    attr_reader :default_list
     attr_reader :max_concurrency
+    attr_reader :record_type
+    attr_reader :target
+    attr_reader :verbose
 
     GOOGLE_PUBLIC_DNS = "8.8.8.8"
 
-    def initialize(target:, default_list: "alexa", custom_list: nil, threshold: nil, verbose: false)
+    def initialize(target:,
+                   custom_list: nil,
+                   default_list: "alexa",
+                   record_type: "A",
+                   threshold: nil,
+                   verbose: false)
       @target = target
-      @default_list = default_list
+
       @custom_list = custom_list
+      @default_list = default_list
+      @record_type = record_type.upcase.to_sym
       @threshold = threshold
       @verbose = verbose
 
@@ -59,7 +67,10 @@ module RogueOne
     def meta
       return nil unless verbose
 
-      { threshold: threshold }
+      {
+        record_type: record_type,
+        threshold: threshold,
+      }
     end
 
     def landing_pages
@@ -89,13 +100,13 @@ module RogueOne
       return unless @memo.empty?
 
       # read domains outside of the async blocks
-      domains
+      load_domains
 
-      normal = bulk_resolve(normal_resolver, domains)
+      normal_resolutions = bulk_resolve(normal_resolver, domains)
       resolutions = bulk_resolve(target_resolver, domains)
 
       results = resolutions.map do |domain, addresses|
-        normal_addresses = normal.dig(domain) || []
+        normal_addresses = normal_resolutions.dig(domain) || []
         address = (addresses || []).first
         [domain, address] if address && !normal_addresses.include?(address)
       end.compact.to_h
@@ -104,6 +115,10 @@ module RogueOne
       @verbose_memo = results if verbose
     end
 
+    def load_domains
+      domains
+    end
+
     def domains
       @domains ||= custom_list ? custom_domains : top_100_domains
     end
@@ -131,6 +146,7 @@ module RogueOne
 
     def bulk_resolve(resolver, domains)
       results = []
+
       Async do
         barrier = Async::Barrier.new
         semaphore = Async::Semaphore.new(max_concurrency, parent: barrier)
@@ -139,7 +155,7 @@ module RogueOne
           semaphore.async do
             addresses = []
             begin
-              addresses = resolver.addresses_for(domain, Resolv::DNS::Resource::IN::A, { retries: 1 }).map(&:to_s)
+              addresses = resolver.addresses_for(domain, dns_resource_by_record_type, { retries: 1 }).map(&:to_s)
             rescue Async::DNS::ResolutionFailure
               # do nothing
             end
@@ -157,5 +173,16 @@ module RogueOne
     def target_resolver
       Async::DNS::Resolver.new([[:udp, target, 53], [:tcp, target, 53]])
     end
+
+    def dns_resource_by_record_type
+      @dns_resource_by_record_type ||= dns_resources.dig(record_type)
+    end
+
+    def dns_resources
+      {
+        A: Resolv::DNS::Resource::IN::A,
+        AAAA: Resolv::DNS::Resource::IN::AAAA,
+      }
+    end
   end
 end

data/lib/rogue_one/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RogueOne
-  VERSION = "0.4.1"
+  VERSION = "0.4.2"
 end

data/renovate.json

@@ -0,0 +1,5 @@
+{
+  "extends": [
+    "config:base"
+  ]
+}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rogue_one
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-07-29 00:00:00.000000000 Z
+date: 2020-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -120,8 +120,8 @@ files:
 - lib/rogue_one/detector.rb
 - lib/rogue_one/domain_list.rb
 - lib/rogue_one/ping.rb
-- lib/rogue_one/resolver.rb
 - lib/rogue_one/version.rb
+- renovate.json
 - rogue_one.gemspec
 homepage: https://github.com/ninoseki/rogue_one
 licenses:

data/lib/rogue_one/resolver.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-
-require "resolv"
-
-module RogueOne
-  class Resolver
-    attr_reader :nameserver
-
-    def initialize(nameserver:)
-      @nameserver = nameserver
-    end
-
-    def get_resource(domain, type)
-      _resolver.getresource(domain, resource_by_type(type)).address.to_s
-    rescue Resolv::ResolvError => _e
-      nil
-    end
-
-    def get_resources(domain, type)
-      _resolver.getresources(domain, resource_by_type(type)).map { |r| r.address.to_s }
-    rescue Resolv::ResolvError => _e
-      nil
-    end
-
-    private
-
-    def _resolver
-      @_resolver ||= Resolv::DNS.new(nameserver: [nameserver])
-      @_resolver.timeouts = 5
-      @_resolver
-    end
-
-    def resource_by_type(type)
-      resources.dig(type.upcase.to_sym)
-    end
-
-    def resources
-      {
-        ANY: Resolv::DNS::Resource::IN::ANY,
-        NS: Resolv::DNS::Resource::IN::NS,
-        CNAME: Resolv::DNS::Resource::IN::CNAME,
-        SOA: Resolv::DNS::Resource::IN::SOA,
-        HINFO: Resolv::DNS::Resource::IN::HINFO,
-        MINFO: Resolv::DNS::Resource::IN::MINFO,
-        MX: Resolv::DNS::Resource::IN::MX,
-        TXT: Resolv::DNS::Resource::IN::TXT,
-        A: Resolv::DNS::Resource::IN::A,
-        WKS: Resolv::DNS::Resource::IN::WKS,
-        PTR: Resolv::DNS::Resource::IN::PTR,
-        AAAA: Resolv::DNS::Resource::IN::AAAA,
-        SRV: Resolv::DNS::Resource::IN::SRV,
-      }
-    end
-  end
-end