Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add proxies support to torproject analyzer #888

Merged
merged 1 commit into from
Feb 3, 2021
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 26 additions & 17 deletions analyzers/TorProject/tor_project.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,35 +19,45 @@ class TorProjectClient:
Ignored if `cache_duration` is 0.
:param cache_root: Path where to store the cached file
downloaded from torproject.org
:param proxies: Proxies to be using during requests session
:type ttl: int
:type cache_duration: int
:type cache_root: str
"""
def __init__(self, ttl=86400, cache_duration=3600,
cache_root='/tmp/cortex/tor_project'):

def __init__(
self,
ttl=86400,
cache_duration=3600,
cache_root="/tmp/cortex/tor_project",
proxies=None,
):
self.session = requests.Session()
if proxies:
self.session.proxies.update(proxies)
self.delta = None
self.cache = None
if ttl > 0:
self.delta = timedelta(seconds=ttl)
if cache_duration > 0:
self.cache = Cache(cache_root)
self.cache_duration = cache_duration
self.url = 'https://check.torproject.org/exit-addresses'
self.url = "https://check.torproject.org/exit-addresses"

__cache_key = __name__ + ':raw_data'
__cache_key = __name__ + ":raw_data"

def _get_raw_data(self):
try:
return self.cache['raw_data']
except(AttributeError, TypeError):
return self.cache["raw_data"]
except (AttributeError, TypeError):
return self.session.get(self.url).text
except KeyError:
self.cache.set(
'raw_data',
"raw_data",
self.session.get(self.url).text,
expire=self.cache_duration)
return self.cache['raw_data']
expire=self.cache_duration,
)
return self.cache["raw_data"]

def search_tor_node(self, ip):
"""Lookup an IP address to check if it is a known tor exit node.
Expand All @@ -65,14 +75,13 @@ def search_tor_node(self, ip):
tmp = {}
present = datetime.utcnow().replace(tzinfo=pytz.utc)
for line in self._get_raw_data().splitlines():
params = line.split(' ')
if params[0] == 'ExitNode':
tmp['node'] = params[1]
elif params[0] == 'ExitAddress':
tmp['last_status'] = params[2] + 'T' + params[3] + '+0000'
last_status = parse(tmp['last_status'])
if (self.delta is None or
(present - last_status) < self.delta):
params = line.split(" ")
if params[0] == "ExitNode":
tmp["node"] = params[1]
elif params[0] == "ExitAddress":
tmp["last_status"] = params[2] + "T" + params[3] + "+0000"
last_status = parse(tmp["last_status"])
if self.delta is None or (present - last_status) < self.delta:
data[params[1]] = tmp
tmp = {}
else:
Expand Down
32 changes: 17 additions & 15 deletions analyzers/TorProject/tor_project_analyzer.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,37 +5,39 @@

class TorProjectAnalyzer(Analyzer):
"""Cortex analyzer to query TorProject for exit nodes IP addresses"""

def __init__(self):
Analyzer.__init__(self)
self.ttl = self.get_param('config.ttl', 86400)
self.cache_duration = self.get_param('config.cache.duration', 3600)
self.cache_root = self.get_param(
'config.cache.root', '/tmp/cortex/tor_project'
)

self.ttl = self.get_param("config.ttl", 86400)
self.cache_duration = self.get_param("config.cache.duration", 3600)
self.cache_root = self.get_param("config.cache.root", "/tmp/cortex/tor_project")
self.proxies = {
"https": self.get_param("config.proxy_https"),
"http": self.get_param("config.proxy_http"),
}
self.client = tor_project.TorProjectClient(
ttl=self.ttl,
cache_duration=self.cache_duration,
cache_root=self.cache_root
cache_root=self.cache_root,
proxies=self.proxies,
)

def summary(self, raw):
taxonomies = []
level = 'info'
level = "info"
value = False
if ("node" in raw):
level = 'suspicious'
if "node" in raw:
level = "suspicious"
value = True
taxonomies.append(
self.build_taxonomy(level, 'TorProject', 'Node', value))
taxonomies.append(self.build_taxonomy(level, "TorProject", "Node", value))
return {"taxonomies": taxonomies}

def run(self):
if self.data_type != 'ip':
return self.error('Not an IP address')
if self.data_type != "ip":
return self.error("Not an IP address")
report = self.client.search_tor_node(self.get_data())
self.report(report)


if __name__ == '__main__':
if __name__ == "__main__":
TorProjectAnalyzer().run()