Mentiodns » Historique » Version 17
sacha, 25/06/2018 21:42
1 | 1 | sacha | h1. Mentiodns |
---|---|---|---|
2 | |||
3 | Validation des DNS à partir d'une liste sur un unbound et un DNS grand FAI et comparaison des résultats ;) |
||
4 | |||
5 | 4 | sacha | h2. Noeud actifs |
6 | |||
7 | |_. Nom |_. Bloc | |
||
8 | 17 | sacha | | Dam64 | | |
9 | 4 | sacha | | Mezzanine | domain_names.com_sortedad | |
10 | | Millicent | domain_names.com_sortedab | |
||
11 | 9 | sacha | | Sacha | domain_names.org_sortedaa | |
12 | | Sacha | domain_names.org_sortedab | |
||
13 | | Sacha | domain_names.org_sortedab | |
||
14 | 10 | sacha | | Sacha | domain_names.org_sortedac | |
15 | | Sacha | domain_names.org_sortedac | |
||
16 | 4 | sacha | | Taziden | domain_names.com_sortedac | |
17 | |||
18 | h2. Mentio |
||
19 | |||
20 | <pre> |
||
21 | #-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+-# |
||
22 | # MENTIODNS : Check for lying DNS (France) # |
||
23 | #--------------------------------------------# |
||
24 | 16 | sacha | # Version 1.6 - conf file # |
25 | 13 | sacha | # Version 1.5 - test Dig resolving # |
26 | # Version 1.4 - Socat SSL sending results # |
||
27 | # Version 1.3 - tld optioN # |
||
28 | 1 | sacha | # Version 1.2 - Round robin on DNS_ISP_LIST # |
29 | 13 | sacha | # For each request # |
30 | 4 | sacha | # Version 1.1 - Allow resume on basename # |
31 | # Version 1.0 - Parallel process with DIG # |
||
32 | #--------------------------------------------# |
||
33 | 1 | sacha | # (c) Sacha at Aquilenet.fr part of FFDN.org # |
34 | #--------------------------------------------# |
||
35 | |||
36 | # This shity script intend to bruteforce the ISP lying DNS Servers to identify which one |
||
37 | # is going on Ministry of Interior Blocking page and compare the IP result from your favorite DNS server |
||
38 | 16 | sacha | # Use this script with the following parameters |
39 | # $1 MODE: client server local |
||
40 | # $2 File source: list of domain names whithout tld |
||
41 | # $3 tld: com, org, ... |
||
42 | # $4 count number (if none from zero or from count file based on file name) |
||
43 | |||
44 | |||
45 | 1 | sacha | # If you relanch the script it will check if it has a counter for the given file to resume |
46 | # Blacklisted sites in $BLACKLIST_LOG file |
||
47 | 13 | sacha | # Diff ip from a domain name are in $DIFF_LOG |
48 | 1 | sacha | |
49 | 13 | sacha | # 1st launch creating config file |
50 | 1 | sacha | |
51 | 14 | sacha | # Copy generated certificates: |
52 | # FILENAME=mentio_ssl-server |
||
53 | 1 | sacha | # openssl genrsa -out $FILENAME.key 1024 |
54 | 13 | sacha | # openssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt |
55 | 1 | sacha | # cat $FILENAME.key $FILENAME.crt >$FILENAME.pem |
56 | 13 | sacha | # FILENAME=mentio_ssl-client |
57 | # ... |
||
58 | |||
59 | 16 | sacha | ########################################################## |
60 | 1 | sacha | HOMEDIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) |
61 | 13 | sacha | MENTIOCONF="$HOMEDIR/mentio.conf" |
62 | # Number of parallel requests thruw dig |
||
63 | parallel=10 |
||
64 | 17 | sacha | # Socat server |
65 | SERVER="taz.im:65522" |
||
66 | 16 | sacha | ########################################################## |
67 | 1 | sacha | |
68 | 16 | sacha | |
69 | ########################################################## |
||
70 | 13 | sacha | ### CHECK CONFIG |
71 | if [ ! -f $MENTIOCONF ]; then |
||
72 | echo "==================================================================" |
||
73 | echo "MENTIODNS" |
||
74 | echo "------------------------------------------------------------------" |
||
75 | echo "1st time configuring" |
||
76 | echo -n "IP UNBOUND ? " |
||
77 | read DNS_MY |
||
78 | 1 | sacha | |
79 | 13 | sacha | echo 'HOMEDIR="'$HOMEDIR'"' > $MENTIOCONF |
80 | echo 'DNS_MY="'$DNS_MY'"' >> $MENTIOCONF |
||
81 | 1 | sacha | IP_PUB=`curl ifconfig.io` |
82 | 13 | sacha | ASN=`whois -h whois.cymru.com $IP_PUB |cut -d' ' -f1|sed -n "2p"` |
83 | 1 | sacha | DNS_LIST="$HOMEDIR/mentio-DNS_ISP_LIST" |
84 | DNS_ISP_LIST=`grep $ASN $DNS_LIST|cut -d' ' -f3-` |
||
85 | echo 'DNS_ISP_LIST="'$DNS_ISP_LIST'"' >> $MENTIOCONF |
||
86 | echo "------------------------------------------------------------------" |
||
87 | echo " CONFIGURATION FILE:" |
||
88 | echo " please check and relaunch" |
||
89 | echo "------------------------------------------------------------------" |
||
90 | cat $MENTIOCONF |
||
91 | echo "------------------------------------------------------------------" |
||
92 | exit 1 |
||
93 | fi |
||
94 | 16 | sacha | ########################################################## |
95 | 1 | sacha | |
96 | 16 | sacha | |
97 | ########################################################## |
||
98 | ### PARAMETERS to execute the script |
||
99 | # Mode Log export with socat "client" "server" "local" |
||
100 | |||
101 | MODE=$1 |
||
102 | |||
103 | if [ $MODE == "server" ]; then |
||
104 | socat -v -u openssl-listen:65522,fork,reuseaddr,cert=mentio_ssl-server.pem,cafile=mentio_ssl-client.crt OPEN:$HOMEDIR/MENTIO-DNS_DIFF,creat,append |
||
105 | exit 1 |
||
106 | fi |
||
107 | ########################################################## |
||
108 | |||
109 | |||
110 | ########################################################## |
||
111 | ### Check if commandline parameters are less than 3 |
||
112 | |||
113 | 1 | sacha | if [ $# -lt 3 ]; then |
114 | echo "==================================================================" |
||
115 | echo "MENTIODNS" |
||
116 | echo "------------------------------------------------------------------" |
||
117 | 14 | sacha | echo "Missing Parameter, please enter:" |
118 | 13 | sacha | echo |
119 | 1 | sacha | echo "mentio-check client|server|local filename tld (count number)" |
120 | 13 | sacha | echo |
121 | exit 1 |
||
122 | fi |
||
123 | 16 | sacha | ########################################################## |
124 | 13 | sacha | |
125 | 16 | sacha | |
126 | ########################################################## |
||
127 | ### Get parameters |
||
128 | |||
129 | # From config file |
||
130 | 1 | sacha | source $MENTIOCONF |
131 | 13 | sacha | |
132 | 16 | sacha | # From command line |
133 | 1 | sacha | # $2 DNS source file name |
134 | 13 | sacha | DNS_SOURCE=$2 |
135 | 1 | sacha | # $3 TLD name (com, org...) |
136 | 13 | sacha | tld=$3 |
137 | 1 | sacha | # line counter from the dns source file, nothing for auto-resuming |
138 | COUNT=$4 |
||
139 | 16 | sacha | |
140 | 13 | sacha | ########################################################## |
141 | ### SOCAT |
||
142 | SENDSOCAT="socat stdio openssl-connect:$SERVER,verify=0,cert=$HOMEDIR/mentio_ssl-client.pem,cafile=$HOMEDIR/mentio_ssl-server.crt" |
||
143 | 16 | sacha | ########################################################## |
144 | 13 | sacha | ### COLORS |
145 | RED='\e[31m' |
||
146 | GREEN='\e[32m' |
||
147 | YELLOW='\e[33m' |
||
148 | 1 | sacha | GRAY='\e[90m' |
149 | NC='\033[0m' # No Color |
||
150 | 16 | sacha | ########################################################## |
151 | ### Various variables |
||
152 | 13 | sacha | DNS_SOURCE_BASENAME=`basename $DNS_SOURCE` |
153 | 1 | sacha | DIFF_LOG="$HOMEDIR/DNS_DIFF" |
154 | BLACKLIST_LOG="$HOMEDIR/DNS_BLACKLISTED" |
||
155 | lines=`wc -l $DNS_SOURCE|awk -F " " '{print $1}'` |
||
156 | 13 | sacha | countfile="$HOMEDIR/DNS_Count-$DNS_SOURCE_BASENAME" |
157 | 4 | sacha | dateus=`date +%Y%m%d-%H%M%S` |
158 | 16 | sacha | ########################################################## |
159 | ### Dig parameters |
||
160 | 1 | sacha | DIG_FAST="+nodnssec +short +timeout=1 +tries=2" |
161 | DIG_SLOW="+nodnssec +short +timeout=5 +tries=3 " |
||
162 | 16 | sacha | ########################################################## |
163 | 13 | sacha | |
164 | 16 | sacha | |
165 | ########################################################## |
||
166 | ### Generate list for dig: round robin from dns list |
||
167 | ### Like (@DNS-server domain) x parallel |
||
168 | 1 | sacha | _check(){ |
169 | i=0 |
||
170 | 13 | sacha | url="" |
171 | while [ $i -lt $parallel ] |
||
172 | 1 | sacha | do |
173 | n=`expr $count + $i` |
||
174 | ISP_DNS=`echo $DNS_ISP_LIST | xargs -n 1| sort -R | head -n 1` |
||
175 | url="$url @$ISP_DNS `awk -v n="${n}" 'NR==n {print;exit}' $DNS_SOURCE`.$tld" |
||
176 | i=`expr $i + 1` |
||
177 | done |
||
178 | } |
||
179 | 16 | sacha | ########################################################## |
180 | 1 | sacha | |
181 | |||
182 | 16 | sacha | ########################################################## |
183 | ### Counter: create one if not existing, use existing instead |
||
184 | 1 | sacha | if [ -z $COUNT ]; then |
185 | 13 | sacha | if [ -f $countfile ]; then |
186 | 1 | sacha | count=`cat $countfile` |
187 | else |
||
188 | 13 | sacha | count=0 |
189 | echo $count > $countfile |
||
190 | fi |
||
191 | else count=$COUNT |
||
192 | echo $count > $countfile |
||
193 | 4 | sacha | fi |
194 | 16 | sacha | ########################################################## |
195 | 4 | sacha | |
196 | 16 | sacha | |
197 | ########################################################## |
||
198 | ### MAIN LOOP |
||
199 | |||
200 | 4 | sacha | while [ "$count" != "$lines" ]; do |
201 | echo $count > $countfile |
||
202 | _check |
||
203 | 13 | sacha | site="$url" |
204 | echo "-------------------------------------------------------------------------------" |
||
205 | echo "#$count $dateus SITE:$site" |
||
206 | if nomentio=`dig @$DNS_MY $DIG_SLOW $site|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$nomentio" ]; then |
||
207 | echo -e "$GRAY Unknown zone $site $NC" |
||
208 | fi |
||
209 | if mentio=`dig $DIG_SLOW $site|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$mentio" ]; then |
||
210 | echo -e "$GRAY Unknown zone $site $NC" |
||
211 | 4 | sacha | fi |
212 | |||
213 | 13 | sacha | if [ -n "$nomentio" ] && [ -n "$mentio" ]; then |
214 | if [ "$nomentio" != "$mentio" ]; then |
||
215 | for i in $site; do |
||
216 | 1 | sacha | if nomentio1=`dig $DIG_FAST @$DNS_MY $i|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$nomentio1" ]; then |
217 | 13 | sacha | echo -e "$GRAY Unknown zone $i $NC" |
218 | fi |
||
219 | ISP_DNS=`echo $DNS_ISP_LIST | xargs -n 1| sort -R | head -n 1` |
||
220 | if mentio1=`dig $DIG_FAST @$ISP_DNS $i|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$mentio1" ]; then |
||
221 | echo -e "$GRAY Unknown zone $i $NC" |
||
222 | fi |
||
223 | if [ "$nomentio1" != "$mentio1" ]; then |
||
224 | if [[ $mentio1 == 90.85.* ]]; then |
||
225 | if [ $MODE == "client" ]; then |
||
226 | echo "!!! $dateus `hostname` SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC" | $SENDSOCAT |
||
227 | fi |
||
228 | echo -e "$RED !!! $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC" |
||
229 | echo "!!! $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" >> $BLACKLIST_LOG |
||
230 | else |
||
231 | if [ $MODE == "client" ]; then |
||
232 | echo ">>> $dateus `hostname` SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" | $SENDSOCAT |
||
233 | fi |
||
234 | echo -e "$YELLOW >>> SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC" |
||
235 | echo ">>> $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" >> $DIFF_LOG |
||
236 | fi |
||
237 | fi |
||
238 | 1 | sacha | done |
239 | 13 | sacha | else |
240 | 3 | sacha | echo -e "$GREEN#$count SITE:$site $NC" |
241 | 1 | sacha | fi |
242 | fi |
||
243 | |||
244 | count=`expr $count + $parallel` |
||
245 | |||
246 | 14 | sacha | done |
247 | 1 | sacha | ########################################################## |
248 | 17 | sacha | |
249 | 14 | sacha | |
250 | 7 | sacha | |
251 | 3 | sacha | </pre> |
252 | 2 | sacha | |
253 | h2. Test (valide au 14/06/18) |
||
254 | 1 | sacha | |
255 | 7 | sacha | dig +short shahamat1.com |
256 | 3 | sacha | 90.85.16.52 |
257 | 1 | sacha | |
258 | h2. Liste de serveurs DNS FAI Français |
||
259 | |||
260 | 11 | sacha | h3. Free - ASN12322 |
261 | 12 | sacha | |
262 | 11 | sacha | 212.27.40.240 |
263 | 212.27.40.241 |
||
264 | 212.27.40.244 |
||
265 | 7 | sacha | 212.27.40.245 |
266 | 3 | sacha | |
267 | 1 | sacha | h3. Bouygues - ASN5410 |
268 | |||
269 | 194.158.122.10 |
||
270 | 194.158.122.15 |
||
271 | |||
272 | h3. SFR/Numericable - ASN5410 |
||
273 | |||
274 | 89.2.0.1 |
||
275 | 89.2.0.2 |
||
276 | |||
277 | h3. SFR - ASN15557 |
||
278 | |||
279 | 109.0.66.10 |
||
280 | 109.0.66.20 |
||
281 | |||
282 | h3. Orange - ASN3215 |
||
283 | 2 | sacha | |
284 | 3 | sacha | 80.10.246.1 |
285 | 1 | sacha | 80.10.246.2 |
286 | 80.10.246.3 |
||
287 | 6 | sacha | 80.10.246.5 |
288 | 80.10.246.7 |
||
289 | 80.10.246.129 |
||
290 | 80.10.246.130 |
||
291 | 80.10.246.132 |
||
292 | 8 | sacha | 80.10.246.134 |
293 | 80.10.246.136 |
||
294 | 81.253.149.1 |
||
295 | 81.253.149.2 |
||
296 | 1 | sacha | 81.253.149.6 |
297 | 11 | sacha | 81.253.149.9 |
298 | 1 | sacha | 81.253.149.10 |
299 | |||
300 | h3. OBS (ouverts) |
||
301 | |||
302 | 194.2.0.20 |
||
303 | 194.2.0.50 |
||
304 | |||
305 | h2. Vigies de la neutralité |
||
306 | |||
307 | https://ooni.torproject.org |
||
308 | https://respectmynet.eu |
||
309 | |||
310 | h2. Cadre légal |
||
311 | |||
312 | https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164&fastPos;=2&fastReqId;=606073666&categorieLien;=cid&oldAction;=rechTexte#LEGIARTI000029756525 |
||
313 | le décret https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=FE6BFDED672BF1E2EFC5CA70705CF26E.tplgfr21s_3?cidTexte=LEGITEXT000030315036&dateTexte;=20150305&categorieLien;=cid#LEGITEXT000030315036 |
||
314 | 15 | sacha | https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=FE6BFDED672BF1E2EFC5CA70705CF26E.tplgfr21s_3?cidTexte=JORFTEXT000030195477&dateTexte;=20180619 |
315 | |||
316 | h2. Ansible divers |
||
317 | |||
318 | Copy file: |
||
319 | |||
320 | ansible mentio -m copy -a "src=mentio-check6 dest=~/MENTIODNS/" |
||
321 | |||
322 | |||
323 | Copy file single host: |
||
324 | |||
325 | ansible mentio --limit dam -m copy -a "src=mentio-check6 dest=~/MENTIODNS/" |
||
326 | |||
327 | ansible-playbook /etc/ansible/playbooks/mentio.yml |
||
328 | |||
329 | |||
330 | <pre> |
||
331 | --- |
||
332 | |||
333 | - hosts: mentio |
||
334 | sudo: no |
||
335 | tasks: |
||
336 | - name: copyfiles |
||
337 | copy: |
||
338 | src: "{{ item.src }}" |
||
339 | dest: "{{ item.dest }}" |
||
340 | with_items: |
||
341 | - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio-check6',dest: '~/MENTIODNS/' } |
||
342 | - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio-DNS_ISP_LIST',dest: '~/MENTIODNS/' } |
||
343 | - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-client.crt',dest: '~/MENTIODNS/' } |
||
344 | - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-client.key',dest: '~/MENTIODNS/' } |
||
345 | - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-client.pem',dest: '~/MENTIODNS/' } |
||
346 | - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-server.crt',dest: '~/MENTIODNS/' } |
||
347 | |||
348 | |||
349 | 1 | sacha | </pre> |