diff --git a/modules/dnsbl/__init__.py b/modules/dnsbl/__init__.py index 2b3daf35..dd64a98d 100644 --- a/modules/dnsbl/__init__.py +++ b/modules/dnsbl/__init__.py @@ -43,14 +43,22 @@ class Module(ModuleManager.BaseModule): failed = [] for list in lists: record = self._check_list(list.hostname, address) - if not record == None: - reason = list.process(record) or "unknown" + if record is not None: + a_record, txt_record = record + reason = list.process(a_record, txt_record) or "unknown" failed.append((list.hostname, reason)) return failed def _check_list(self, list, address): list_address = "%s.%s" % (address, list) try: - return dns.resolver.query(list_address, "A")[0].to_text() + a_record = dns.resolver.query(list_address, "A")[0].to_text() except dns.resolver.NXDOMAIN: return None + + try: + txt_record = dns.resolver.query(list_address, "TXT")[0].to_text() + except: + txt_record = None + + return (a_record, txt_record) diff --git a/modules/dnsbl/lists.py b/modules/dnsbl/lists.py index 1e4e1ac9..44975467 100644 --- a/modules/dnsbl/lists.py +++ b/modules/dnsbl/lists.py @@ -5,13 +5,16 @@ class DNSBL(object): if not hostname == None: self.hostname = hostname - def process(self, result: str): - return result + def process(self, a_record, txt_record): + out = a_record + if txt_record is not None: + out += f" - {txt_record}" + return out class ZenSpamhaus(DNSBL): hostname = "zen.spamhaus.org" - def process(self, result): - result = result.rsplit(".", 1)[1] + def process(self, a_record, txt_record): + result = a_record.rsplit(".", 1)[1] if result in ["2", "3", "9"]: desc = "spam" elif result in ["4", "5", "6", "7"]: @@ -20,8 +23,8 @@ class ZenSpamhaus(DNSBL): class EFNetRBL(DNSBL): hostname = "rbl.efnetrbl.org" - def process(self, result): - result = result.rsplit(".", 1)[1] + def process(self, a_record, txt_record): + result = a_record.rsplit(".", 1)[1] if result == "1": desc = "proxy" elif result in ["2", "3"]: @@ -32,35 +35,13 @@ class EFNetRBL(DNSBL): desc = "flooding" return f"{result} - {desc}" -DRONEBL_CATEGORIES = { - 3: "IRC drone", - 5: "bottler", - 6: "unknown spambot or drone", - 7: "DDoS drone", - 8: "open SOCKS proxy", - 9: "open HTTP proxy", - 10: "proxychain", - 11: "web page proxy", - 12: "open DNS resolver", - 13: "brute force attacker", - 14: "open WINGATE proxy", - 15: "compromised router/gateway", - 16: "autorooting malware", - 17: "detected botnet IP", - 18: "DNS/MX on IRC", - 19: "abused VPN service" -} class DroneBL(DNSBL): hostname = "dnsbl.dronebl.org" - def process(self, result): - result = int(result.rsplit(".", 1)[1]) - desc = DRONEBL_CATEGORIES.get(result, "unknown") - return f"{result} - {desc}" class AbuseAtCBL(DNSBL): hostname = "cbl.abuseat.org" - def process(self, result): - result = result.rsplit(".", 1)[1] + def process(self, a_record, txt_record): + result = a_record.rsplit(".", 1)[1] if result == "2": desc = "abuse" else: