Python validators.ipv4方法代码示例

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def _create_payload(self, name: str, zone: str, address: str, address_type: str) -> dict:
        payload = {
            "name": name,
            "zone": zone
        }
        if address_type == "fqdn":
            payload["domain"] = address
            payload["dns_ttl"] = 0
        elif address_type == "cidr":
            payload["network"] = self._generate_subnet_netmask(address)
        else:
            payload["host"] = {
                "ip": address
            }

        object_type = address_type
        if address_type == "cidr":
            object_type = "ipv4"

        return {
            "address_objects": [{
                object_type: payload
            }]
        } 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def filter_ip_list(ip_list):
    """Filter out identical addresses in an IP address list.

    Params:
    - ip_list: (type: string list) IP address list.

    Returns:
    - return_list: (type: string list) filtered IP address list.
    """
    LOGGING.info('Filtering IP list...')
    LOGGING.info('Before: {0}'.format(len(ip_list)))

    unique_list = list(set(ip_list))
    return_list = []

    for ip_addr in unique_list:
        if validators.ipv4(ip_addr):
            return_list.append(ip_addr)

    LOGGING.info('After: {0}'.format(len(return_list)))
    LOGGING.info('Filtering complete!')

    return return_list 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def resolve_country(host_name):
    """Resolve an IP address or domain to it's hosting country.

    Params:
    - host_name: (type: string) FQDN or IP address.

    Returns:
    - result: (type: string) two-letter country code.
    """
    isCidr = re.match(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\d{1,2}', host_name)

    if isCidr:
        host_name = str(random.choice(netaddr.IPNetwork(host_name)))

    if validators.ipv4(host_name):
        return geo_lookup(host_name)

    ip_addr = resolve_dns(host_name)

    if ip_addr:
        return geo_lookup(ip_addr)

    return 'ZZ' 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def resolve_asn(ip_addr):
    """Resolve the ASN of an IP address or FQDN.

    Params:
    - ip_addr: (type: string) FQDN or IP address.

    Returns:
    - result: (type: string) ASN number and organisation.
    """
    isCidr = re.match(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/\d{1,2}', ip_addr)

    if isCidr:
        ip_addr = str(random.choice(netaddr.IPNetwork(ip_addr)))

    if validators.ipv4(ip_addr):
        return asn_lookup(ip_addr)

    host_addr = resolve_dns(ip_addr)

    if host_addr:
        return asn_lookup(host_addr)

    return 'AS0000 Unknown' 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def resolve_dns(host_name):
    """Perform a DNS lookup of a FQDN.

    Params:
    - host_name: (type: string) FQDN to perform lookup of.

    Returns:
    - result: (type: string) resulting IP address.
    """
    if validators.ipv4(host_name):
        return host_name

    ip_addr = forward_dns_lookup(host_name)

    if ip_addr is not None:
        return ip_addr

    return False 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def process_iocs(results):
    """Return data formatted for Splunk from CyberCrime Tracker."""
    if results != None:
        provided_iocs = [y for x in results for y in x.values()]
    else:
        provided_iocs = sys.argv[1:]

    session      = commons.create_session()
    splunk_table = []

    for provided_ioc in set(provided_iocs):
        provided_ioc = commons.deobfuscate_string(provided_ioc)

        if validators.domain(provided_ioc) or validators.ipv4(provided_ioc):
            cct_dicts = query_cct(provided_ioc, session)
        else:
            splunk_table.append({"invalid": provided_ioc})
            continue

        for cct_dict in cct_dicts:
            splunk_table.append(cct_dict)

    session.close()
    return splunk_table 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def _determine_address_type(address: str) -> str:
        if validators.ipv4(address):
            return "ipv4"
        if validators.ipv6(address):
            return "ipv6"
        if validators.domain(address):
            return "fqdn"
        if re.search('/', address):
            return "cidr"
        raise PluginException(cause="Unknown address type provided.",
                              assistance=f"{address} is not one of the following: IPv4, IPv6, CIDR or domain name.") 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def get_data_type(indicator):
        if validators.ipv4(indicator) or validators.ipv6(indicator):
            return "IP"
        elif validators.url(indicator):
            return "URL"
        elif validators.domain(indicator):
            return "DOMAIN"
        elif validators.sha1(indicator):
            return "FILE_SHA1"

        raise PluginException(
            cause="Invalid indicator input provided.",
            assistance="Supported indicators are IP, URL, domain and SHA1 hash."
        ) 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def _get_payload(self, params):
        agent = params.get(Input.AGENT)
        if params.get(Input.QUARANTINE_STATE, True):
            action = "cmd_isolate_agent"
        else:
            action = "cmd_restore_isolated_agent"

        if "cmd_isolate_agent" == action and agent in params.get(Input.WHITELIST, []):
            raise PluginException(cause="Unable to block whitelisted entry.",
                                  assistance=f"Please remove the host from the action's whitelist or quarantine a different host.")


        payload = {
            "act": action,
            "allow_multiple_match": True
        }

        validate_dict = {
            "entity_id": validators.uuid,
            "ip_address": lambda address: (validators.ipv4(address) or validators.ipv6(address)),
            "host_name": self.validate_host_name,
        }

        if validators.mac_address(agent.replace("-", ":")):
            payload["mac_address"] = agent
        else:
            for name, validate_fn in validate_dict.items():
                if validate_fn(agent):
                    payload[name] = agent
                    break

        return payload 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def geo_lookup(ip_addr):
    """Resolve an IP address to it's hosting country.

    Params:
    - ip_addr: (type: string) IP address.

    Returns:
    - result: (type: string) two-letter country code.
    """
    if validators.ipv4(ip_addr):
        try:
            if ip_addr == '255.255.255.255':
                return 'ZZ'

            with geoip2.database.Reader(BASECONFIG.geolite_db) as reader:
                response = reader.city(ip_addr)

                if response is not None:
                    if response.country.iso_code is not None:
                        return response.country.iso_code

                    if response.continent.code is not None:
                        return response.continent.code

        except Exception as e:
            LOGGING.warning(
                'Failed to perform GeoLookup for address {0}: {1}'.format(
                    ip_addr, str(e)))

    else:
        LOGGING.warning('Invalid IP address: {0}'.format(ip_addr))

    return 'ZZ' 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def asn_lookup(ip_addr):
    """Resolve the ASN of an IP address.

    Params:
    - ip_addr: (type: string) IP address.

    Returns:
    - result: (type: string) ASN number and organisation.
    """
    if validators.ipv4(ip_addr):
        try:
            if ip_addr == '255.255.255.255':
                return 'AS0000 Unknown'

            with geoip2.database.Reader(BASECONFIG.asn_db) as reader:
                response = reader.asn(ip_addr)

                if response is not None:
                    asn_number = response.autonomous_system_number
                    asn_org = response.autonomous_system_organization
                    return 'AS{0} {1}'.format(asn_number, asn_org)

        except Exception as e:
            LOGGING.warning(
                'Failed to perform ASN lookup for address {0}: {1}'.format(
                    ip_addr, str(e)))

    else:
        LOGGING.warning('Invalid IP address: {0}'.format(ip_addr))

    return 'AS0000 Unknown' 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def checkType(self, argument):
        """
            Identify observable type
        """
        if not argument or len(argument.strip()) == 0:
            return None
        elif argument[0] is '#':
            return None
        elif validators.url(argument):
            return "URL"
        elif validators.md5(argument):
            return "MD5"
        elif validators.sha1(argument):
            return "SHA1"
        elif validators.sha256(argument):
            return "SHA256"
        elif validators.sha512(argument):
            return "SHA512"
        elif validators.ipv4(argument):
            return "IPv4"
        elif validators.ipv6(argument):
            return "IPv6"
        elif validators.domain(argument):
            return "domain"
        else:
            return None 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def process_iocs(results):
    """Return data formatted for Splunk from crt.sh."""
    if results != None:
        provided_iocs = [y for x in results for y in x.values()]
    elif sys.argv[1] != "subdomain" and sys.argv[1] != "wildcard":
        if len(sys.argv) > 1:
            provided_iocs = sys.argv[1:]
    elif sys.argv[1] == "subdomain" or sys.argv[1] == "wildcard":
        if len(sys.argv) > 2:
            provided_iocs = sys.argv[2:]

    session      = commons.create_session()
    splunk_table = []

    for provided_ioc in set(provided_iocs):
        provided_ioc = commons.deobfuscate_string(provided_ioc)

        if validators.domain(provided_ioc) or validators.ipv4(provided_ioc):
            crt_dicts = query_crtsh(provided_ioc, session)
        else:
            splunk_table.append({"invalid": provided_ioc})
            continue

        for crt_dict in crt_dicts:
            splunk_table.append(crt_dict)

    session.close()
    return splunk_table 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def process_iocs(results):
    """Return data formatted for Splunk from Malshare."""
    if results != None:
        provided_iocs = [y for x in results for y in x.values()]
    else:
        provided_iocs = sys.argv[1:]

    session = commons.create_session()
    api_key = commons.get_apikey("malshare")
    splunk_table = []

    for provided_ioc in set(provided_iocs):
        provided_ioc = commons.deobfuscate_string(provided_ioc)
        provided_ioc = provided_ioc.lower()

        if validators.ipv4(provided_ioc) or validators.domain(provided_ioc) or \
            re.match("^[a-f\d]{32}$", provided_ioc) or re.match("^[a-f\d]{64}$", provided_ioc):
            pass
        else:
            splunk_table.append({"invalid": provided_ioc})
            continue

        ioc_dicts = query_malshare(provided_ioc, api_key, session)

        for ioc_dict in ioc_dicts:
            splunk_table.append(ioc_dict)

    session.close()
    return splunk_table 

# 需要导入模块: import validators [as 别名]
# 或者: from validators import ipv4 [as 别名]
def process_iocs(results):
    """Return data formatted for Splunk from ThreatCrowd."""
    if results != None:
        provided_iocs = [y for x in results for y in x.values()]
    else:
        provided_iocs = sys.argv[1:]

    session = commons.create_session()
    splunk_table = []

    for provided_ioc in set(provided_iocs):
        provided_ioc = commons.deobfuscate_string(provided_ioc)
        provided_ioc = provided_ioc.lower()

        if validators.ipv4(provided_ioc):
            ioc_type = "ip"
        elif validators.domain(provided_ioc):
            ioc_type = "domain"
        elif validators.email(provided_ioc):
            ioc_type = "email"
        elif re.match("^[a-f\d]{32}$", provided_ioc) or re.match("^[a-f\d]{64}$", provided_ioc):
            ioc_type = "resource"
        else:
            splunk_table.append({"invalid": provided_ioc})
            continue

        ioc_dicts = query_threatcrowd(provided_ioc, ioc_type, session)

        for ioc_dict in ioc_dicts:
            splunk_table.append(ioc_dict)

        if len(provided_iocs) > 1:
            sleep(10)

    session.close()
    return splunk_table