Sindbad~EG File Manager
3
�f�( � @ s( d dl Z d dlmZ G dd� de�ZdS )� N)�SoSMapc
s� e Zd ZdZdddgZddgZd%ZdZdZdZ dZ
i Z i Z dd� Z
dd� Zdd� Zdd� Z� fdd �Zd d � Zd d � Zd!d"� Zd#d$� Z� ZS )&�SoSHostnameMapaL Mapping store for hostnames and domain names
Hostnames are obfuscated using an incrementing counter based on the total
number of hosts matched regardless of domain name.
Domain names are obfuscated based on the host's hostname, plus any user
defined domains passed in by the `--domains` options.
Domains are obfuscated as whole units, meaning the domains 'example.com'
and 'host.foo.example.com' will be separately obfuscated with no relation
for example as 'obfuscatedomdain1.com' and 'obfuscatedomain2.com'.
Top-level domains are left untouched.
Z localhostz.*localdomain.*z^com..*ZwwwZapi�.yaml�.yml�.crt�.key�.pem�.log�.repo�.rules�.conf�.cfgTr c C s� x�| j j� D ]�\}}t|jd��dkrB| j | | j|jd�d < q |jd�rb|jd�d | j|< q dj|jd�dd� �}|s�q xZ| j j� D ]L}dj|jd�dd� �}||kr�dj| j | jd�dd� �}|| j|< q�W q W | j � dS ) z�Because we use 'intermediary' dicts for host names and domain names
in this parser, we need to re-inject entries from the map_file into
these dicts and not just the underlying 'dataset' dict
�.� r ZobfuscateddomainN���r r )
�dataset�items�len�split�hosts�
startswith�_domains�join�keys�set_initial_counts)�self�domainZob_pairZ_domain_to_injectZexisting_domain� _existingZ
_ob_domain� r �"/usr/lib/python3.6/hostname_map.py�load_domains_from_map5 s
z$SoSHostnameMap.load_domains_from_mapc C s" d|kr|j dd�}tj|tj�S )z�Override the base get_regex_result() to provide a regex that, if
this is an FQDN or a straight domain, will include an underscore
formatted regex as well.
r z(\.|_))�replace�re�compile�I)r �itemr r r �get_regex_resultU s z SoSHostnameMap.get_regex_resultc C s� y2t | jj� dd�d jd�d }t|�d | _W n tk
rF Y nX y<t | jj� dd�d jd�}t|d jd�d �d | _W n tk
r� Y nX dS ) z�Set the initial counter for host and domain obfuscation numbers
based on what is already present in the mapping.
T)�reverser �hostr r r N) �sortedr �valuesr �int�
host_count�
IndexErrorr � domain_count)r �h�dr r r r ^ s z!SoSHostnameMap.set_initial_countsc sj || j krdS |jd�}dj|jd�dd� �� t|�dkrJ|d | jkS t� fdd�| j D ��rfdS dS ) zkCheck if a potential domain is in one of the domains we've loaded
and should be obfuscated
Tr r r c s g | ]}� j |��qS r )�endswith)�.0Z_d)�no_tldr r �
<listcomp>} s z@SoSHostnameMap.domain_name_in_loaded_domains.<locals>.<listcomp>Fr )r r r r r �any)r r r( r )r3 r � domain_name_in_loaded_domainsr s
z,SoSHostnameMap.domain_name_in_loaded_domainsc s� d}d}d }x&|j d �r2||d 7 }|dd � }qW x&|jd �rZ||d
7 }|dd� }q6W || jkrp| j| S | j|j� �s�dj|||g�S |j| j�r�d|jd�d }|j|d�}||7 }|| jj � k�rؐxt
| jj � ddd� d �D ]�}d
}|j|�}|jd�} | d �r*| d | j j � k�r*d}t |�dks�|d �rFq�q�| �r~|d jd��sj|j|��r~t
t| �j|�}P q�|j|d �r�y0|j|d �d }
|d t
t| �j|
� }P W q� tk
�r� Y q�X q�W |�s�t
t| �j|�}|| | S )N� r �_r r Tc S s t | �S )N)r )�xr r r �<lambda>� s z$SoSHostnameMap.get.<locals>.<lambda>)r' �keyF)r r8 )r r8 r r r )r r1 r r6 �lowerr �
strip_extsr r! r r) r r �superr �get� Exception) r r% �prefix�suffix�finalZextr Z _host_substrZ_testZ_hZitm)� __class__r r r? � sR
zSoSHostnameMap.getc C s� |j d�}t|�dkr(| j|d j� �S t|�dkr\| j|�}tdd� |D ��rX|j� }|S t|�dkr�|d }|dd � }t|�dkr�| j|j� �}nd}| j|�}|| j|< dj||g�}tdd� |D ��r�|j� }|S d S ) Nr r r � c S s g | ] }|j � �qS r )�isupper)r2 r/ r r r r4 � s z0SoSHostnameMap.sanitize_item.<locals>.<listcomp>�unknownc S s g | ] }|j � �qS r )rF )r2 r/ r r r r4 � s ) r r �sanitize_short_namer< �sanitize_domain�all�upperr r ) r r% r( �dname�hostnamer Z ob_hostname� ob_domainZ_fqdnr r r �
sanitize_item� s*
z SoSHostnameMap.sanitize_itemc C s^ | s|| j kr|S || jkrTd| j }|| j|< | jd7 _|| j|< | j|� | j| S )z�Obfuscate the short name of the host with an incremented counter
based on the total number of obfuscated host names
zhost%sr )� skip_keysr r, r Zadd_regex_item)r rM Zob_hostr r r rH � s
z"SoSHostnameMap.sanitize_short_namec C sz x*| j D ] }tj|dj|��rdj|�S qW |d j� }dj|dd� �j� }| j|�}dj||g�}|| jdj|�< |S )zeObfuscate the domainname, broken out into subdomains. Top-level
domains are ignored.
r r r r r )�ignore_matchesr" �matchr r< �_new_obfuscated_domainr )r r Z_skipZ
top_domainrL rN r r r rI � s
z SoSHostnameMap.sanitize_domainc C s2 || j kr(d| j | j |< | jd7 _| j | S )zDGenerate an obfuscated domain for each subdomain name given
zobfuscateddomain%sr )r r. )r rL r r r rS � s
z%SoSHostnameMap._new_obfuscated_domain)
r r r r r r r
r r r
)�__name__�
__module__� __qualname__�__doc__rQ rP r= Zignore_short_itemsZmatch_full_words_onlyr, r. r r r r& r r6 r? rO rH rI rS �
__classcell__r r )rD r r s. < r )r" Zsos.cleaner.mappingsr r r r r r �<module> s
Sindbad File Manager Version 1.0, Coded By Sindbad EG ~ The Terrorists