Projet

Général

Profil

Mentiodns » Historique » Version 28

sacha, 26/06/2018 15:42

1 1 sacha
h1. Mentiodns
2
3
Validation des DNS à partir d'une liste sur un unbound et un DNS grand FAI et comparaison des résultats ;)
4
5 4 sacha
h2. Noeud actifs
6
7
|_. Nom |_. Bloc |
8 23 sacha
| dam | domain_names.com_sortedaf|
9
| dam | domain_names.com_sortedag|
10
| dam | domain_names.com_sortedah|
11
| dam | domain_names.com_sortedai|
12 24 sacha
| mezzanine | domain_names.com_sortedad |
13
| mezzanine | domain_names.com_sortedao |
14
| mezzanine | domain_names.com_sortedap |
15
| mezzanine | domain_names.com_sortedaq |
16
| 1000i100 | domain_names.com_sortedab |
17
| 1000i100 | domain_names.com_sortedaj |
18
| 1000i100 | domain_names.com_sortedak |
19
| 1000i100 | domain_names.com_sortedal |
20 26 sacha
| sacha | domain_names.org_sortedaa |
21
| sacha | domain_names.org_sortedab |
22
| sacha | domain_names.org_sortedac |
23
| sacha | domain_names.org_sortedad |
24 24 sacha
| tazi | domain_names.com_sortedac |
25
| tazi | domain_names.com_sortedae |
26
| tazi | domain_names.com_sortedam |
27
| tazi | domain_names.com_sortedan |
28 18 sacha
29 4 sacha
h2. Mentio
30
31 27 sacha
h3. mentio-check6
32
33 19 sacha
Packages: curl dig python socat tmux unbound whois 
34
35 4 sacha
<pre>
36
#-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+--+-#
37
#  MENTIODNS : Check for lying DNS (France)  #
38
#--------------------------------------------#
39 28 sacha
#  Version 1.6.1 date bug
40 16 sacha
#  Version 1.6 - conf file                   # 
41 13 sacha
#  Version 1.5 - test Dig resolving          #
42
#  Version 1.4 - Socat SSL sending results   # 
43
#  Version 1.3 - tld optioN                  #
44 1 sacha
#  Version 1.2 - Round robin on DNS_ISP_LIST #
45 28 sacha
#                For each request            #
46 4 sacha
#  Version 1.1 - Allow resume on basename    #
47
#  Version 1.0 - Parallel process with DIG   #
48
#--------------------------------------------#
49 1 sacha
# (c) Sacha at Aquilenet.fr part of FFDN.org #
50
#--------------------------------------------#
51
52
# This shity script intend to bruteforce the ISP lying DNS Servers to identify which one
53
# is going on Ministry of Interior Blocking page and compare the IP result from your favorite DNS server
54 16 sacha
# Use this script with the following parameters 
55
# $1 MODE: client server local
56
# $2 File source: list of domain names whithout tld
57
# $3 tld: com, org, ...
58
# $4 count number (if none from zero or from count file based on file name)
59
60
61 1 sacha
# If you relanch the script it will check if it has a counter for the given file to resume
62
# Blacklisted sites in $BLACKLIST_LOG file
63 13 sacha
# Diff ip from a domain name are in $DIFF_LOG 
64 1 sacha
65 13 sacha
# 1st launch creating config file
66 1 sacha
67 14 sacha
# Copy generated certificates:
68
# FILENAME=mentio_ssl-server 
69 1 sacha
# openssl genrsa -out $FILENAME.key 1024
70 13 sacha
# openssl req -new -key $FILENAME.key -x509 -days 3653 -out $FILENAME.crt
71 1 sacha
# cat $FILENAME.key $FILENAME.crt >$FILENAME.pem
72 13 sacha
# FILENAME=mentio_ssl-client
73
# ...
74
75 16 sacha
##########################################################
76 1 sacha
HOMEDIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
77 13 sacha
MENTIOCONF="$HOMEDIR/mentio.conf"
78 17 sacha
# Number of parallel requests thruw dig
79
parallel=10
80 16 sacha
##########################################################
81 1 sacha
82 16 sacha
83
##########################################################
84 13 sacha
### CHECK CONFIG
85
if [ ! -f $MENTIOCONF ]; then
86
echo "=================================================================="
87
echo "MENTIODNS"
88
echo "------------------------------------------------------------------" 
89
echo "1st time configuring"
90
echo -n "IP UNBOUND ? "
91
read DNS_MY
92 1 sacha
93 13 sacha
echo 'HOMEDIR="'$HOMEDIR'"' > $MENTIOCONF
94
echo 'DNS_MY="'$DNS_MY'"' >> $MENTIOCONF
95 1 sacha
IP_PUB=`curl ifconfig.io`
96 13 sacha
ASN=`whois -h whois.cymru.com $IP_PUB |cut -d' ' -f1|sed -n "2p"`
97 1 sacha
DNS_LIST="$HOMEDIR/mentio-DNS_ISP_LIST"
98
DNS_ISP_LIST=`grep $ASN $DNS_LIST|cut -d' ' -f3-`
99
echo 'DNS_ISP_LIST="'$DNS_ISP_LIST'"' >> $MENTIOCONF
100
echo "------------------------------------------------------------------"
101
echo " CONFIGURATION FILE:"
102
echo " please check and relaunch"
103
echo "------------------------------------------------------------------"
104
cat $MENTIOCONF
105
echo "------------------------------------------------------------------"
106
exit 1
107
fi
108 16 sacha
##########################################################
109 1 sacha
110 16 sacha
111
##########################################################
112
### PARAMETERS to execute the script
113
# Mode Log export with socat "client" "server" "local"
114
115
MODE=$1
116
117
if [ $MODE == "server" ]; then
118
socat -v -u openssl-listen:65522,fork,reuseaddr,cert=mentio_ssl-server.pem,cafile=mentio_ssl-client.crt OPEN:$HOMEDIR/MENTIO-DNS_DIFF,creat,append
119
exit 1
120
fi
121
##########################################################
122
123
124
##########################################################
125
### Check if commandline parameters are less than 3
126
127 1 sacha
if [ $# -lt 3 ]; then
128
echo "=================================================================="
129
echo "MENTIODNS"
130
echo "------------------------------------------------------------------"
131 14 sacha
echo "Missing Parameter, please enter:"
132 13 sacha
echo
133 1 sacha
echo "mentio-check client|server|local filename tld (count number)"
134 13 sacha
echo
135
exit 1
136
fi
137 16 sacha
##########################################################
138 13 sacha
139 16 sacha
140
##########################################################
141
### Get parameters
142
143
# From config file
144 1 sacha
source $MENTIOCONF
145 13 sacha
146 16 sacha
# From command line
147 1 sacha
# $2 DNS source file name
148 13 sacha
DNS_SOURCE=$2
149 1 sacha
# $3 TLD name (com, org...)
150 13 sacha
tld=$3
151 1 sacha
# line counter from the dns source file, nothing for auto-resuming
152
COUNT=$4
153
154 16 sacha
##########################################################
155 13 sacha
### SOCAT
156 28 sacha
SERVER="taz.im:65522"
157 13 sacha
SENDSOCAT="socat stdio openssl-connect:$SERVER,verify=0,cert=$HOMEDIR/mentio_ssl-client.pem,cafile=$HOMEDIR/mentio_ssl-server.crt"
158 16 sacha
##########################################################
159 13 sacha
### COLORS 
160
RED='\e[31m'
161
GREEN='\e[32m'
162
YELLOW='\e[33m'
163 1 sacha
GRAY='\e[90m'
164
NC='\033[0m' # No Color
165 16 sacha
##########################################################
166
### Various variables
167 13 sacha
DNS_SOURCE_BASENAME=`basename $DNS_SOURCE`
168 1 sacha
DIFF_LOG="$HOMEDIR/DNS_DIFF"
169
BLACKLIST_LOG="$HOMEDIR/DNS_BLACKLISTED"
170 13 sacha
lines=`wc -l $DNS_SOURCE|awk -F " " '{print $1}'`
171 4 sacha
countfile="$HOMEDIR/DNS_Count-$DNS_SOURCE_BASENAME"
172 16 sacha
##########################################################
173
### Dig parameters
174 1 sacha
DIG_FAST="+nodnssec +short +timeout=1 +tries=2"
175
DIG_SLOW="+nodnssec +short +timeout=5 +tries=3 "
176 16 sacha
##########################################################
177 13 sacha
178 16 sacha
179
##########################################################
180
### Generate list for dig: round robin from dns list
181
### Like (@DNS-server domain) x parallel 
182 1 sacha
_check(){
183
i=0
184 13 sacha
url=""
185
while [ $i -lt $parallel ]
186 1 sacha
do
187
n=`expr $count + $i`
188
ISP_DNS=`echo $DNS_ISP_LIST | xargs -n 1| sort -R | head -n 1`
189
url="$url @$ISP_DNS `awk -v n="${n}" 'NR==n {print;exit}' $DNS_SOURCE`.$tld"
190
i=`expr $i + 1`
191
done
192
}
193 16 sacha
##########################################################
194 1 sacha
195
196 16 sacha
##########################################################
197
### Counter: create one if not existing, use existing instead
198 1 sacha
if [ -z $COUNT ]; then
199 28 sacha
        if [ -f $countfile ]; then
200
        count=`cat $countfile`
201
        else
202
        count=0
203
        echo $count > $countfile
204
        fi
205 13 sacha
else count=$COUNT
206
echo $count > $countfile
207 1 sacha
fi
208 4 sacha
##########################################################
209 16 sacha
210 4 sacha
211 16 sacha
##########################################################
212
### MAIN LOOP
213
214
while [ "$count" != "$lines" ]; do
215 4 sacha
echo $count > $countfile
216
_check
217 28 sacha
dateus=`date +%Y%m%d-%H%M%S`
218 13 sacha
site="$url"
219
echo "-------------------------------------------------------------------------------"
220
echo "#$count $dateus SITE:$site"
221
if nomentio=`dig @$DNS_MY $DIG_SLOW $site|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$nomentio" ]; then
222 28 sacha
        echo -e "$GRAY Unknown zone $site $NC" 
223 13 sacha
fi
224
if mentio=`dig $DIG_SLOW $site|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$mentio" ]; then
225 28 sacha
        echo -e "$GRAY Unknown zone $site $NC"
226 4 sacha
fi
227 1 sacha
228 4 sacha
if [ -n "$nomentio" ] && [ -n "$mentio" ]; then
229 13 sacha
    if [ "$nomentio" != "$mentio" ]; then
230 28 sacha
        for i in $site; do
231
                if nomentio1=`dig $DIG_FAST @$DNS_MY $i|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$nomentio1" ]; then
232
                        echo -e "$GRAY Unknown zone $i $NC"
233
                fi
234
                ISP_DNS=`echo $DNS_ISP_LIST | xargs -n 1| sort -R | head -n 1`
235
                if mentio1=`dig $DIG_FAST @$ISP_DNS $i|sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4| tr '\r\n' ' '` && [ -z "$mentio1" ]; then
236
                        echo -e "$GRAY Unknown zone $i $NC"
237
                fi
238
                        if [ "$nomentio1" != "$mentio1" ]; then
239
                                if [[ $mentio1 == 90.85.* ]]; then
240
                                        if [ $MODE == "client" ]; then
241
                                                echo "!!! $dateus `hostname` SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC" | $SENDSOCAT
242
                                        fi
243
                                        echo -e "$RED !!! $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC"
244
                                        echo "!!! $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" >> $BLACKLIST_LOG
245
                                else
246
                                                if [ $MODE == "client" ]; then
247
                                                        echo ">>> $dateus `hostname` SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" | $SENDSOCAT
248
                                                fi                   
249
                                        echo -e "$YELLOW >>> SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1 $NC"
250
                                        echo ">>> $dateus SITE:$i ISPDNS:$ISP_DNS REAL:$nomentio1 MENTIO:$mentio1" >> $DIFF_LOG
251
                                fi
252
                        fi
253
        done
254 1 sacha
    else
255 13 sacha
    echo -e "$GREEN#$count  SITE:$site  $NC"
256 3 sacha
    fi
257 1 sacha
fi
258
259
count=`expr $count + $parallel`
260
261
done
262 14 sacha
##########################################################
263 28 sacha
264 17 sacha
265 14 sacha
266 7 sacha
267 2 sacha
</pre>
268 1 sacha
269 27 sacha
h3. mentio-DNS_ISP_LIST
270 1 sacha
271 27 sacha
<pre>
272
Bouygues 5410 194.158.122.10 194.158.122.15
273
Free 12322 212.27.40.240 212.27.40.241 212.27.40.244 212.27.40.245
274
Orange 3215 80.10.246.1 80.10.246.2 80.10.246.3 80.10.246.5 80.10.246.7 80.10.246.129 80.10.246.130 80.10.246.132 80.10.246.134 80.10.246.136 81.253.149.1 81.253.149.2 81.253.149.6 81.253.149.9 81.253.149.10
275
SFR 15557 109.0.66.10 109.0.66.20
276
</pre>
277 1 sacha
278 27 sacha
h3. mentio-monitor
279 1 sacha
280 27 sacha
<pre>
281
hosts="mentio-HOSTS"
282
hosts_tmp="/tmp/mentio-HOSTS.tmp"
283
rm -rf $hosts
284 1 sacha
285
286 27 sacha
GREEN='\e[32m'
287
RED='\e[31m'
288
NC='\033[0m' # No Color  
289 1 sacha
290 27 sacha
while true; do
291
        timeout 300 tail -n 0 -f MENTIO-DNS_DIFF | cut -d ' ' -f3|sort|uniq> $hosts_tmp
292
        mentiohosts=`cat $hosts_tmp`
293
        updates=`echo $mentiohosts|xargs -n 1`
294
        for i in $updates; do
295
                exists=`grep "$i" $hosts`
296
                if [ -z "$exists" ]; then
297
                        echo "ADD $i"
298
                        echo "$i"  >> $hosts 
299
                        sort -o $hosts $hosts
300
                        name=`echo $i|cut -d "." -f1`
301
                fi
302
        done
303 8 sacha
304 27 sacha
dateus=`date +%Y%m%d-%H%M%S`
305
diffs=`diff --side-by-side --suppress-common-lines $hosts $hosts_tmp`
306
echo "======================================================================"
307
if [ -z "$diffs" ]; then
308
 echo -e "$GREEN $dateus - ALL HOSTS UP: $NC"
309
 echo -e "$GREEN `cat $hosts |xargs |sort` $NC"  
310
else
311
 echo -e "$RED $dateus - MISSING HOST: $NC"
312
 echo -e "$RED $diffs $NC"
313
fi
314
done
315
</pre>
316 1 sacha
317 27 sacha
h2. Test (valide au 14/06/18)
318 1 sacha
319 27 sacha
 dig +short shahamat1.com
320
 90.85.16.52
321 1 sacha
322
h2. Vigies de la neutralité
323
324 18 sacha
https://ooni.torproject.org
325
https://respectmynet.eu
326
327
h2. Cadre légal
328
329
https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000801164&fastPos;=2&fastReqId;=606073666&categorieLien;=cid&oldAction;=rechTexte#LEGIARTI000029756525        
330
le décret https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=FE6BFDED672BF1E2EFC5CA70705CF26E.tplgfr21s_3?cidTexte=LEGITEXT000030315036&dateTexte;=20150305&categorieLien;=cid#LEGITEXT000030315036  
331
https://www.legifrance.gouv.fr/affichTexte.do;jsessionid=FE6BFDED672BF1E2EFC5CA70705CF26E.tplgfr21s_3?cidTexte=JORFTEXT000030195477&dateTexte;=20180619
332
333
h2. Unbound
334
335
<pre>
336
server:
337
 verbosity: 1
338
 interface: 127.0.0.1
339
 do-ip4: yes
340
 do-ip6: no
341
 do-udp: yes
342
 do-tcp: no
343
 access-control: 127.0.0.0/8 allow 
344
 access-control: 0.0.0.0/0 refuse
345 15 sacha
 logfile: /var/log/unbound
346
 hide-identity: yes
347
 hide-version: yes
348
 harden-glue: yes
349
 use-caps-for-id: yes
350
 do-not-query-localhost: yes
351
</pre>
352
353
354
h2. Ansible divers
355
356
Copy file:
357
358
 ansible mentio -m copy -a "src=mentio-check6 dest=~/MENTIODNS/"
359
360
361
Copy file single host:
362
363
 ansible mentio --limit dam -m copy -a "src=mentio-check6 dest=~/MENTIODNS/"
364
365
ansible-playbook /etc/ansible/playbooks/mentio.yml 
366
367
368
<pre>
369
---
370
371
- hosts: mentio 
372
  sudo: no
373
  tasks:
374
    - name: copyfiles 
375
      copy:
376
        src: "{{ item.src }}"
377
        dest: "{{ item.dest }}"
378
      with_items:
379 1 sacha
        - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio-check6',dest: '~/MENTIODNS/' }
380
        - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio-DNS_ISP_LIST',dest: '~/MENTIODNS/' }
381
        - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-client.crt',dest: '~/MENTIODNS/' }
382
        - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-client.key',dest: '~/MENTIODNS/' }
383
        - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-client.pem',dest: '~/MENTIODNS/' }
384
        - { src: '/home/sacha/0nmyway/00_Aquilenet/FFDN/mentiodns.fr/mentio_ssl-server.crt',dest: '~/MENTIODNS/' }
385
386
387
</pre>