gossan-intel 0.3.3

Global Passive and Active Intel pillar for Gossan, part of the security research ecosystem
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

//! Passive DNS source: CIRCL/PassiveTotal/DNSDB style.
//!
//! This implementation uses a generic pdns endpoint shape common to many
//! providers. In production it can be wired to a specific backend via config.

use async_trait::async_trait;
use serde::Deserialize;

use crate::enrichment::{DnsRecord, IntelEnrichment};
use crate::sources::IntelSource;

/// Passive DNS API client.
pub struct PassiveDnsSource {
    client: reqwest::Client,
    api_key: Option<String>,
    endpoint: String,
}

impl PassiveDnsSource {
    /// Create a new Passive DNS source.
    pub fn new(client: reqwest::Client, api_key: Option<String>, endpoint: String) -> Self {
        Self {
            client,
            api_key,
            endpoint,
        }
    }
}

#[async_trait]
impl IntelSource for PassiveDnsSource {
    fn name(&self) -> &'static str {
        "passive_dns"
    }

    async fn query_ip(&self, ip: &str) -> anyhow::Result<IntelEnrichment> {
        let api_key = self
            .api_key
            .as_ref()
            .ok_or_else(|| anyhow::anyhow!("Passive DNS requires an API key"))?;
        let mut url = url::Url::parse(&self.endpoint)?;
        {
            let mut segs = url.path_segments_mut().map_err(|_| anyhow::anyhow!("invalid endpoint URL"))?;
            segs.push("lookup");
            segs.push("rdata");
            segs.push(ip);
        }
        let resp = self
            .client
            .get(url)
            .bearer_auth(api_key)
            .send()
            .await?
            .error_for_status()?;
        // Passive-DNS history for a busy hostname can run into many
        // thousand records; cap at 8 MiB to bound the worst case.
        let body: PdnsResp = gossan_core::net::bounded_json(resp, super::MAX_INTEL_JSON_BYTES).await?;

        let mut enrichment = IntelEnrichment::new("passive_dns", "ip", ip);
        for rec in body.records {
            enrichment.passive_dns.push(DnsRecord {
                record_type: rec.rrtype,
                value: rec.rdata,
                first_seen: rec.time_first.map(|t| t.to_string()),
                last_seen: rec.time_last.map(|t| t.to_string()),
            });
        }

        Ok(enrichment)
    }

    async fn query_domain(&self, domain: &str) -> anyhow::Result<IntelEnrichment> {
        let api_key = self
            .api_key
            .as_ref()
            .ok_or_else(|| anyhow::anyhow!("Passive DNS requires an API key"))?;
        let mut url = url::Url::parse(&self.endpoint)?;
        {
            let mut segs = url.path_segments_mut().map_err(|_| anyhow::anyhow!("invalid endpoint URL"))?;
            segs.push("lookup");
            segs.push("rrset");
            segs.push("name");
            segs.push(domain);
        }
        let resp = self
            .client
            .get(url)
            .bearer_auth(api_key)
            .send()
            .await?
            .error_for_status()?;
        // Passive-DNS history for a busy hostname can run into many
        // thousand records; cap at 8 MiB to bound the worst case.
        let body: PdnsResp = gossan_core::net::bounded_json(resp, super::MAX_INTEL_JSON_BYTES).await?;

        let mut enrichment = IntelEnrichment::new("passive_dns", "domain", domain);
        for rec in body.records {
            enrichment.passive_dns.push(DnsRecord {
                record_type: rec.rrtype,
                value: rec.rdata,
                first_seen: rec.time_first.map(|t| t.to_string()),
                last_seen: rec.time_last.map(|t| t.to_string()),
            });
        }

        Ok(enrichment)
    }
}

#[derive(Debug, Deserialize)]
struct PdnsResp {
    #[serde(default)]
    records: Vec<PdnsRecord>,
}

#[derive(Debug, Deserialize)]
struct PdnsRecord {
    rrtype: String,
    rdata: String,
    #[serde(default)]
    time_first: Option<u64>,
    #[serde(default)]
    time_last: Option<u64>,
}