rogue_one 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5655a9f8e6b835c1ae68a9f10dd449ac4558a9efc582a2e8a8292f60f33a5c78
-  data.tar.gz: f7c38f1d2eacdebf14f2aa9dfb89c99460a3c9ceaf4c707f63b38f0423933123
+  metadata.gz: a66b70adea810f6e952e08294a0323dc2be06c23d7ccbc28739045829696aae5
+  data.tar.gz: 5d41ff1fa13254071aecef1cbf70168d818a963207922be4d44f134d9bb42f0d
 SHA512:
-  metadata.gz: 04fe47430be7c6a7bf2211620516a4dff785d8bcb61ca378b9c382e2d1eb1c3f3babed665345e23ab0a023b8201d073e567a554393f7af61272179dab6e0be63
-  data.tar.gz: 698b1433133c836c10df144c65fd5e98663e48f8be07f6082960f8bc29eec74315a2e8b807dde47be5fdb8e42480d47e8ea30d21e2f01afbad7653ee6ac18895
+  metadata.gz: c08f2049c42ac79a9a0256ae2f99761748660fa3bd1981f680196540e4525db9b4e8dbba54264d35cc2b7b5773b96441886a0a7acb4900e1626cd42c34089304
+  data.tar.gz: a4cffb3b9d5c92f90ac267201417c459b334d38aa82a0631a43c7db15552bed00d11cc9f37291904f48bfad08c33f4bc7d051bf3946acf4c35fcdc9a7e927567

data/.travis.yml

@@ -4,4 +4,5 @@ language: ruby
 cache: bundler
 rvm:
   - 2.6
+  - 2.7
 before_install: gem install bundler -v 2.1

data/README.md

@@ -1,7 +1,7 @@
 # Rogue one
 
 [![Gem Version](https://badge.fury.io/rb/rogue_one.svg)](https://badge.fury.io/rb/rogue_one)
-[![Build Status](https://travis-ci.org/ninoseki/rogue_one.svg?branch=master)](https://travis-ci.org/ninoseki/rogue_one)
+[![Build Status](https://travis-ci.com/ninoseki/rogue_one.svg?branch=master)](https://travis-ci.com/ninoseki/rogue_one)
 [![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/rogue_one/badge)](https://www.codefactor.io/repository/github/ninoseki/rogue_one)
 [![Coverage Status](https://coveralls.io/repos/github/ninoseki/rogue_one/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/rogue_one?branch=master)
 
@@ -79,7 +79,7 @@ $ rogue_one report 171.244.3.111 --custom-list tmp/roaming.yml
 ```
 
 | Key           | Desc.                                                                    |
-| ------------- | ------------------------------------------------------------------------ |
+|---------------|--------------------------------------------------------------------------|
 | verdict       | A detection result (`rogue one` or `benign one`)                         |
 | landing_pages | An array of IP of landing pages                                          |
 | results       | DNS resolution results (only available if --verbose option is specified) |

data/lib/rogue_one/detector.rb

@@ -1,7 +1,13 @@
 # frozen_string_literal: true
 
+require "async"
+require "async/barrier"
+require "async/dns"
+require "async/reactor"
+require "async/semaphore"
+require "resolv"
 require "yaml"
-require "parallel"
+require "etc"
 
 module RogueOne
   class Detector
@@ -9,6 +15,7 @@ module RogueOne
     attr_reader :default_list
     attr_reader :custom_list
     attr_reader :verbose
+    attr_reader :max_concurrency
 
     GOOGLE_PUBLIC_DNS = "8.8.8.8"
 
@@ -19,6 +26,7 @@ module RogueOne
       @threshold = threshold
       @verbose = verbose
 
+      @max_concurrency = Etc.nprocessors * 2
       @memo = {}
       @verbose_memo = nil
     end
@@ -80,11 +88,16 @@ module RogueOne
     def inspect
       return unless @memo.empty?
 
-      results = Parallel.map(domains) do |domain|
-        normal_results = normal_resolver.get_resources(domain, "A")
-        target_result = target_resolver.get_resource(domain, "A")
+      # read domains outside of the async blocks
+      domains
 
-        [domain, target_result] if target_result && !normal_results.include?(target_result)
+      normal = bulk_resolve(normal_resolver, domains)
+      resolutions = bulk_resolve(target_resolver, domains)
+
+      results = resolutions.map do |domain, addresses|
+        normal_addresses = normal.dig(domain) || []
+        address = (addresses || []).first
+        [domain, address] if address && !normal_addresses.include?(address)
       end.compact.to_h
 
       @memo = results.values.group_by(&:itself).map { |k, v| [k, v.length] }.to_h
@@ -92,7 +105,7 @@ module RogueOne
     end
 
     def domains
-      @domains ||= custom_domains || top_100_domains
+      @domains ||= custom_list ? custom_domains : top_100_domains
     end
 
     def custom_domains
@@ -105,22 +118,44 @@ module RogueOne
         read_domains File.expand_path("./data/alexa_100.yml", __dir__)
       when "fortune"
         read_domains File.expand_path("./data/fortune_100.yml", __dir__)
-      else
-        raise ArgumentError, "A list for #{default_list} is not existing"
       end
     end
 
     def read_domains(path)
       list = DomainList.new(path)
-      list.valid? ? list.domains : nil
+      return list.domains if list.valid?
+
+      raise ArgumentError, "Inputted an invalid list. #{path} is not eixst." unless list.exists?
+      raise ArgumentError, "Inputted an invalid list. Please input a list as an YAML file." unless list.valid_format?
+    end
+
+    def bulk_resolve(resolver, domains)
+      results = []
+      Async do
+        barrier = Async::Barrier.new
+        semaphore = Async::Semaphore.new(max_concurrency, parent: barrier)
+
+        domains.each do |domain|
+          semaphore.async do
+            addresses = []
+            begin
+              addresses = resolver.addresses_for(domain, Resolv::DNS::Resource::IN::A, { retries: 1 }).map(&:to_s)
+            rescue Async::DNS::ResolutionFailure
+              # do nothing
+            end
+            results << [domain, addresses]
+          end
+        end
+      end
+      results.to_h
     end
 
     def normal_resolver
-      @normal_resolver ||= Resolver.new(nameserver: GOOGLE_PUBLIC_DNS)
+      Async::DNS::Resolver.new([[:udp, GOOGLE_PUBLIC_DNS, 53], [:tcp, GOOGLE_PUBLIC_DNS, 53]])
     end
 
     def target_resolver
-      @target_resolver ||= Resolver.new(nameserver: target)
+      Async::DNS::Resolver.new([[:udp, target, 53], [:tcp, target, 53]])
     end
   end
 end

data/lib/rogue_one/domain_list.rb

@@ -18,8 +18,6 @@ module RogueOne
       @domains ||= exists? ? YAML.safe_load(File.read(path)) : nil
     end
 
-    private
-
     def exists?
       File.exist?(path)
     end

data/lib/rogue_one/ping.rb

@@ -1,16 +1,27 @@
 # frozen_string_literal: true
 
+require "resolv"
+
 module RogueOne
   class Ping
     attr_reader :resolver
+    attr_reader :nameserver
 
     def initialize(nameserver)
-      @resolver = Resolver.new(nameserver: nameserver)
+      @nameserver = nameserver
+      @resolver = Resolv::DNS.new(nameserver: [nameserver])
+      @resolver.timeouts = 5
+    end
+
+    def get_a_record
+      resolver.getresource("example.com", Resolv::DNS::Resource::IN::A)
+    rescue Resolv::ResolvError => _e
+      nil
     end
 
     def pong?
-      result = resolver.get_resource("example.com", "A")
-      raise Error, "DNS resolve error: there is no resopnse from #{resolver.nameserver}" unless result
+      result = get_a_record
+      raise Error, "DNS resolve error: there is no resopnse from #{nameserver}" unless result
 
       true
     end

data/lib/rogue_one/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RogueOne
-  VERSION = "0.4.0"
+  VERSION = "0.4.1"
 end

data/rogue_one.gemspec

@@ -29,6 +29,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.9"
 
-  spec.add_dependency "parallel", "~> 1.19"
+  spec.add_dependency "async-dns", "~> 1.2"
   spec.add_dependency "thor", "~> 1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rogue_one
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Manabu Niseki
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-12-19 00:00:00.000000000 Z
+date: 2020-07-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -67,19 +67,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3.9'
 - !ruby/object:Gem::Dependency
-  name: parallel
+  name: async-dns
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.19'
+        version: '1.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.19'
+        version: '1.2'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -127,7 +127,7 @@ homepage: https://github.com/ninoseki/rogue_one
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -142,8 +142,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: A rogue DNS detector
 test_files: []