From b8d6141cb77dc4cd05a2218a208974ad6761c7e3 Mon Sep 17 00:00:00 2001
From: chrisr3d <chris.studer.68@gmail.com>
Date: Tue, 17 Dec 2019 11:18:21 +0100
Subject: [PATCH] chg: Made circl_passivedns module able to return MISP objects

---
 .../modules/expansion/circl_passivedns.py     | 79 ++++++++++++-------
 1 file changed, 51 insertions(+), 28 deletions(-)

diff --git a/misp_modules/modules/expansion/circl_passivedns.py b/misp_modules/modules/expansion/circl_passivedns.py
index 263b92a..9c095c5 100755
--- a/misp_modules/modules/expansion/circl_passivedns.py
+++ b/misp_modules/modules/expansion/circl_passivedns.py
@@ -1,41 +1,64 @@
 import json
 import pypdns
+from pymisp import MISPAttribute, MISPEvent, MISPObject
 
-misperrors = {'error': 'Error'}
-mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst'], 'output': ['freetext']}
-moduleinfo = {'version': '0.1', 'author': 'Alexandre Dulaunoy', 'description': 'Module to access CIRCL Passive DNS', 'module-type': ['expansion', 'hover']}
+mispattributes = {'input': ['hostname', 'domain', 'ip-src', 'ip-dst'], 'format': 'misp_standard'}
+moduleinfo = {'version': '0.2', 'author': 'Alexandre Dulaunoy',
+              'description': 'Module to access CIRCL Passive DNS',
+              'module-type': ['expansion', 'hover']}
 moduleconfig = ['username', 'password']
 
 
+class PassiveDNSParser():
+    def __init__(self, attribute, authentication):
+        self.misp_event = MISPEvent()
+        self.attribute = MISPAttribute()
+        self.attribute.from_dict(**attribute)
+        self.misp_event.add_attribute(**self.attribute)
+        self.pdns = pypdns.PyPDNS(basic_auth=authentication)
+
+    def get_results(self):
+        if hasattr(self, 'result'):
+            return self.result
+        event = json.loads(self.misp_event.to_json())
+        results = {key:event[key] for key in ('Attribute', 'Object')}
+        return {'results': results}
+
+    def parse(self, value):
+        try:
+            results = self.pdns.query(self.attribute.value)
+        except Exception:
+            self.result = {'error': 'There is an authentication error, please make sure you supply correct credentials.'}
+            return
+        mapping = {'count': 'counter', 'origin': 'text',
+                   'time_first': 'datetime', 'rrtype': 'text',
+                   'rrname': 'text', 'rdata': 'text',
+                   'time_last': 'datetime'}
+        for result in results:
+            pdns_object = MISPObject('passive-dns')
+            for relation, attribute_type in mapping.items():
+                pdns_object.add_attribute(relation, type=attribute_type, value=result[relation])
+            pdns_object.add_reference(self.attribute.uuid, 'associated-to')
+            self.misp_event.add_object(**pdns_object)
+
+
 def handler(q=False):
     if q is False:
         return False
     request = json.loads(q)
-    if request.get('hostname'):
-        toquery = request['hostname']
-    elif request.get('domain'):
-        toquery = request['domain']
-    elif request.get('ip-src'):
-        toquery = request['ip-src']
-    elif request.get('ip-dst'):
-        toquery = request['ip-dst']
-    else:
-        misperrors['error'] = "Unsupported attributes type"
-        return misperrors
-
-    if (request.get('config')):
-        if (request['config'].get('username') is None) or (request['config'].get('password') is None):
-            misperrors['error'] = 'CIRCL Passive DNS authentication is missing'
-            return misperrors
-
-    x = pypdns.PyPDNS(basic_auth=(request['config']['username'], request['config']['password']))
-    res = x.query(toquery)
-    out = ''
-    for v in res:
-        out = out + "{} ".format(v['rdata'])
-
-    r = {'results': [{'types': mispattributes['output'], 'values': out}]}
-    return r
+    if not request.get('config'):
+        return {'error': 'CIRCL Passive DNS authentication is missing.'}
+    if not request['config'].get('username') or not request['config'].get('password'):
+        return {'error': 'CIRCL Passive DNS authentication is incomplete, please provide your username and password.'}
+    authentication = (request['config']['username'], request['config']['password'])
+    if not request.get('attribute'):
+        return {'error': 'Unsupported input.'}
+    attribute = request['attribute']
+    if not any(input_type == attribute['type'] for input_type in mispattributes['input']):
+        return {'error': 'Unsupported attributes type'}
+    pdns_parser = PassiveDNSParser(attribute, authentication)
+    pdns_parser.parse(attribute['value'])
+    return pdns_parser.get_results()
 
 
 def introspection():