Projet

Général

Profil

Mentiodns » Historique » Version 14

sacha, 25/06/2018 19:17

1 1 sacha
h1. Mentiodns
2
3
Validation des DNS à partir d'une liste sur un unbound et un DNS grand FAI et comparaison des résultats ;)
4
5 4 sacha
h2. Noeud actifs
6
7
|_. Nom |_. Bloc |
8
| Mezzanine | domain_names.com_sortedad |
9
| Millicent | domain_names.com_sortedab |
10 9 sacha
| Sacha | domain_names.org_sortedaa |
11
| Sacha | domain_names.org_sortedab |
12
| Sacha | domain_names.org_sortedab |
13 10 sacha
| Sacha | domain_names.org_sortedac |
14
| Sacha | domain_names.org_sortedac |
15 4 sacha
| Taziden | domain_names.com_sortedac |
16
17
h2. Mentio
18
19
<pre>
20
#-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+-#
21
#  MENTIODNS : Check for lying DNS (France)  #
22
#--------------------------------------------#
23 14 sacha
#  Version 1.6 - conf file &some checks & doc# 
24 13 sacha
#  Version 1.5 - test Dig resolving          #
25
#  Version 1.4 - Socat SSL sending results   # 
26
#  Version 1.3 - tld optioN                  #
27 1 sacha
#  Version 1.2 - Round robin on DNS_ISP_LIST #
28 13 sacha
#		 For each request	     #
29 4 sacha
#  Version 1.1 - Allow resume on basename    #
30
#  Version 1.0 - Parallel process with DIG   #
31
#--------------------------------------------#
32 1 sacha
# (c) Sacha at Aquilenet.fr part of FFDN.org #
33
#--------------------------------------------#
34
35
# This shity script intend to bruteforce the ISP lying DNS Servers to identify which one
36 9 sacha
# is going on Ministry of Interior Blocking page and compare the IP result from your favorite DNS server
37 13 sacha
# Use this script with the following paramters 
38
# 1 - domain names file (file with list of domain names whithout the tld  
39 9 sacha
# 2 - position number if it is not given the script will start at the begining
40 1 sacha
# If you relanch the script it will check if it has a counter for the given file to resume
41
# Blacklisted sites in $BLACKLIST_LOG file
42 13 sacha
# Diff ip from a domain name are in $DIFF_LOG 
43 1 sacha
44 13 sacha
# 1st launch creating config file
45 1 sacha
46 14 sacha
# Copy generated certificates:
47
# FILENAME=mentio_ssl-server 
48
# openssl genrsa -out $FILENAME.key 1024
49
# openssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt
50
# cat $FILENAME.key $FILENAME.crt >$FILENAME.pem
51
# FILENAME=mentio_ssl-client
52
# ...
53
54 13 sacha
# Parameters:
55
# $1 MODE: client server local
56
# $2 File source: list of domain names whithout tld
57
# $3 tld: com, org, ... 
58
# $4 count number (if none from zero or from count file based on file name)
59
60 1 sacha
#############################
61 13 sacha
HOMEDIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
62
MENTIOCONF="$HOMEDIR/mentio.conf"
63
# Number of parallel requests thruw dig
64
parallel=10
65 1 sacha
#############################
66
67
#--------------------------------------
68 13 sacha
### CHECK CONFIG
69
if [ ! -f $MENTIOCONF ]; then
70
echo "=================================================================="
71
echo "MENTIODNS"
72
echo "------------------------------------------------------------------" 
73
echo "1st time configuring"
74
echo -n "IP UNBOUND ? "
75
read DNS_MY
76 1 sacha
77 13 sacha
echo 'HOMEDIR="'$HOMEDIR'"' > $MENTIOCONF
78
echo 'DNS_MY="'$DNS_MY'"' >> $MENTIOCONF
79
IP_PUB=`curl ifconfig.io`
80
ASN=`whois -h whois.cymru.com $IP_PUB |cut -d' ' -f1|sed -n "2p"`
81
DNS_LIST="$HOMEDIR/mentio-DNS_ISP_LIST"
82
DNS_ISP_LIST=`grep $ASN $DNS_LIST|cut -d' ' -f3-`
83
echo 'DNS_ISP_LIST="'$DNS_ISP_LIST'"' >> $MENTIOCONF
84
echo "------------------------------------------------------------------"
85
echo " CONFIGURATION FILE:"
86
echo " please check and relaunch"
87
echo "------------------------------------------------------------------"
88
cat $MENTIOCONF
89
echo "------------------------------------------------------------------"
90
exit 1
91
fi
92 1 sacha
93 14 sacha
if [ $# -lt 3 ]; then
94
echo "=================================================================="
95
echo "MENTIODNS"
96
echo "------------------------------------------------------------------"
97
echo "Missing Parameter, please enter:"
98
echo
99
echo "mentio-check client|server|local filename tld (count number)"
100
echo
101
exit 1
102
fi
103
104 13 sacha
### Get parameters from config file
105
source $MENTIOCONF
106
107
#-------------------------------------
108
### PARAMETERS to execute the script
109
# Mode Log export with socat "client" "server" "local"
110
MODE=$1
111
# $2 DNS source file name
112
DNS_SOURCE=$2
113
# $3 TLD name (com, org...)
114
tld=$3
115 1 sacha
# line counter from the dns source file, nothing for auto-resuming
116 13 sacha
COUNT=$4
117 4 sacha
118 13 sacha
if [ $MODE == "server" ]; then
119
socat -v -u openssl-listen:65522,fork,reuseaddr,cert=mentio_ssl-server.pem,cafile=mentio_ssl-client.crt OPEN:$HOMEDIR/DNS_DIFF,creat,append 
120
exit 1
121
fi
122
 
123
#--------------------------------------
124
### SOCAT
125
SERVER="10.11.12.22:65522"
126
SENDSOCAT="socat stdio openssl-connect:$SERVER,verify=0,cert=$HOMEDIR/mentio_ssl-client.pem,cafile=$HOMEDIR/mentio_ssl-server.crt"
127
#--------------------------------------
128
### COLORS 
129 1 sacha
RED='\e[31m'
130
GREEN='\e[32m'
131
YELLOW='\e[33m'
132 13 sacha
GRAY='\e[90m'
133 1 sacha
NC='\033[0m' # No Color
134 13 sacha
#--------------------------------------
135 4 sacha
DNS_SOURCE_BASENAME=`basename $DNS_SOURCE`
136
DIFF_LOG="$HOMEDIR/DNS_DIFF"
137
BLACKLIST_LOG="$HOMEDIR/DNS_BLACKLISTED"
138 1 sacha
lines=`wc -l $DNS_SOURCE|awk -F " " '{print $1}'`
139
countfile="$HOMEDIR/DNS_Count-$DNS_SOURCE_BASENAME"
140 13 sacha
dateus=`date +%Y%m%d-%H%M%S`
141
#--------------------------------------
142
DIG_FAST="+nodnssec +short +timeout=1 +tries=2"
143
DIG_SLOW="+nodnssec +short +timeout=5 +tries=3 "
144
#--------------------------------------
145 1 sacha
146
_check(){
147
i=0
148
url=""
149
while [ $i -lt $parallel ]
150
do
151
n=`expr $count + $i`
152 13 sacha
ISP_DNS=`echo $DNS_ISP_LIST | xargs -n 1| sort -R | head -n 1`
153 1 sacha
url="$url @$ISP_DNS `awk -v n="${n}" 'NR==n {print;exit}' $DNS_SOURCE`.$tld"
154
i=`expr $i + 1`
155
done
156
}
157
158 13 sacha
159 1 sacha
#--------------------------------------
160
if [ -z $COUNT ]; then
161 13 sacha
	if [ -f $countfile ]; then
162
	count=`cat $countfile`
163
	else
164
	count=0
165
	echo $count > $countfile
166
	fi
167 4 sacha
else count=$COUNT
168
echo $count > $countfile
169
fi
170
#--------------------------------------
171
172
while [ "$count" != "$lines" ]; do
173
echo $count > $countfile
174
_check
175
site="$url"
176
echo "-------------------------------------------------------------------------------"
177 13 sacha
echo "#$count $dateus SITE:$site"
178
if nomentio=`dig @$DNS_MY $DIG_SLOW $site|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$nomentio" ]; then
179
	echo -e "$GRAY Unknown zone $site $NC" 
180
fi
181
if mentio=`dig $DIG_SLOW $site|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$mentio" ]; then
182
	echo -e "$GRAY Unknown zone $site $NC"
183
fi
184
185 4 sacha
if [ -n "$nomentio" ] && [ -n "$mentio" ]; then
186
    if [ "$nomentio" != "$mentio" ]; then
187 13 sacha
	for i in $site; do
188
		if nomentio1=`dig $DIG_FAST @$DNS_MY $i|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$nomentio1" ]; then
189
			echo -e "$GRAY Unknown zone $i $NC"
190
		fi
191
		ISP_DNS=`echo $DNS_ISP_LIST | xargs -n 1| sort -R | head -n 1`
192
		if mentio1=`dig $DIG_FAST @$ISP_DNS $i|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$mentio1" ]; then
193
			echo -e "$GRAY Unknown zone $i $NC"
194
		fi
195
			if [ "$nomentio1" != "$mentio1" ]; then
196
        			if [[ $mentio1 == 90.85.* ]]; then
197
		                        if [ $MODE == "client" ]; then
198
                		        	echo "!!! $dateus `hostname` SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC" | $SENDSOCAT
199
                        		fi
200
					echo -e "$RED !!! $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC"
201
					echo "!!! $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" >> $BLACKLIST_LOG
202
				else
203
                        			if [ $MODE == "client" ]; then
204
                        				echo ">>> $dateus `hostname` SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" | $SENDSOCAT
205
                        			fi                   
206
					echo -e "$YELLOW >>> SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC"
207
					echo ">>> $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" >> $DIFF_LOG
208
				fi
209
			fi
210
	done
211 1 sacha
    else
212 13 sacha
    echo -e "$GREEN#$count  SITE:$site  $NC"
213 3 sacha
    fi
214 1 sacha
fi
215
216
count=`expr $count + $parallel`
217
218
done
219 14 sacha
220
221
222 7 sacha
</pre>
223 3 sacha
224 2 sacha
h2. Test (valide au 14/06/18)
225
226 1 sacha
 dig +short shahamat1.com
227 7 sacha
 90.85.16.52
228 3 sacha
229 1 sacha
h2. Liste de serveurs DNS FAI Français
230
231
h3. Free - ASN12322
232 11 sacha
233 12 sacha
212.27.40.240
234 11 sacha
212.27.40.241
235
212.27.40.244
236
212.27.40.245
237 7 sacha
238 3 sacha
h3. Bouygues - ASN5410
239 1 sacha
240
194.158.122.10
241
194.158.122.15
242
243
h3. SFR/Numericable - ASN5410
244
245
89.2.0.1
246
89.2.0.2
247
248
h3. SFR - ASN15557
249
250
109.0.66.10
251
109.0.66.20
252
253
h3. Orange - ASN3215
254
255 2 sacha
80.10.246.1
256 3 sacha
80.10.246.2
257 1 sacha
80.10.246.3
258
80.10.246.5
259 6 sacha
80.10.246.7
260
80.10.246.129
261
80.10.246.130
262
80.10.246.132
263
80.10.246.134
264 8 sacha
80.10.246.136
265
81.253.149.1
266
81.253.149.2
267
81.253.149.6
268 1 sacha
81.253.149.9
269 11 sacha
81.253.149.10
270 1 sacha
271
h3. OBS (ouverts)
272
273
194.2.0.20
274
194.2.0.50
275
276
h2. Vigies de la neutralité
277
278
https://ooni.torproject.org
279
https://respectmynet.eu
280
281
h2. Cadre légal
282
283
https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164&fastPos;=2&fastReqId;=606073666&categorieLien;=cid&oldAction;=rechTexte#LEGIARTI000029756525        
284
le décret https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=FE6BFDED672BF1E2EFC5CA70705CF26E.tplgfr21s_3?cidTexte=LEGITEXT000030315036&dateTexte;=20150305&categorieLien;=cid#LEGITEXT000030315036  
285
https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=FE6BFDED672BF1E2EFC5CA70705CF26E.tplgfr21s_3?cidTexte=JORFTEXT000030195477&dateTexte;=20180619