diff options
Diffstat (limited to 'monitor/josef_reader.py')
| -rwxr-xr-x | monitor/josef_reader.py | 170 |
1 files changed, 75 insertions, 95 deletions
diff --git a/monitor/josef_reader.py b/monitor/josef_reader.py index a100b0a..92bd510 100755 --- a/monitor/josef_reader.py +++ b/monitor/josef_reader.py @@ -31,111 +31,91 @@ monitored_domains = [ "symantec.com", ] - -def check_domain(raw_entry, log=None): - orig_entry = extract_original_entry(raw_entry) - try: - cert_info = my_get_all_cert_info(orig_entry[0][0]) - if log: - cert_info["log"] = log[8:-1] # strip generic URL stuff - return cert_info - except IndexError: - return None - - -def get_full_cert(entry): - try: - log = "https://" + entry["log"] + "/" - leaf_hash = entry["leaf_hash"] - except: - print "Could not get stats from entry." - return - # print log, leaf_hash - tree_size = 5000000 - proof = get_proof_by_hash(log, base64.b64decode(leaf_hash), tree_size) - leaf_index = proof["leaf_index"] - raw_entry = get_entries(log, leaf_index, leaf_index)["entries"][0] - cert = check_domain(raw_entry) - for line in cert: - print line - - -# db = "./tmpdb/" db = DB_PATH -if args.domain: - raw = db_lookup_domain(db, args.domain) -else: - print "No domain selected!" - sys.exit() -cur_time = dt.now() -count_valid = 0 -count_expired = 0 -count_not_yet_valid = 0 -count_all = 0 -for item in raw: - try: - entry = ast.literal_eval(item) - except: - print (item + '}').replace("'", '"') - success = True - not_after_time = dt.strptime(entry["not_after"], "%b %d %H:%M:%S %Y GMT") - not_before_time = dt.strptime(entry["not_before"], "%b %d %H:%M:%S %Y GMT") - - - if args.log: - if args.log in entry["log"]: - pass - else: - success = False - if cur_time > not_after_time: - valid = False - expired = True - elif cur_time < not_before_time: - valid = False - expired = False - else: - expired = False - valid = True - - # Exclude expired - if args.exclude_invalid and not valid: - success = False - - - # Set count matches - if success: - count_all += 1 - if valid: - count_valid += 1 - elif expired: - count_expired += 1 - else: - count_not_yet_valid += 1 - - # Print matching - if success: - s = entry["subject"].split("CN=")[1] + \ - " certified by " + entry["issuer"].split("CN=")[1] + \ - " (" + entry["log"] + ") " - if valid: - print "(VALID) " + s - else: - print "(NOT VALID) " + s +def db_monitor_domain(domain, log=None, exclude_invalid=None, get_cert=None): + print domain + raw = db_lookup_domain(db, domain) - if args.get_cert: - get_full_cert(entry) + cur_time = dt.now() + count_valid = 0 + count_expired = 0 + count_not_yet_valid = 0 + count_all = 0 + for item in raw: + try: + entry = ast.literal_eval(item) + except: + print (item + '}').replace("'", '"') + success = True + not_after_time = dt.strptime(entry["not_after"], "%b %d %H:%M:%S %Y GMT") + not_before_time = dt.strptime(entry["not_before"], "%b %d %H:%M:%S %Y GMT") -print str(count_all) + " matches found. " \ -+ str(count_valid) + " valid, " \ -+ str(count_expired) + " expired and " \ -+ str(count_not_yet_valid) + " not yet valid." + if log: + if log in entry["log"]: + pass + else: + success = False + + if cur_time > not_after_time: + valid = False + expired = True + elif cur_time < not_before_time: + valid = False + expired = False + else: + expired = False + valid = True + # Exclude expired + if exclude_invalid and not valid: + success = False + + + # Set count matches + if success: + count_all += 1 + if valid: + count_valid += 1 + elif expired: + count_expired += 1 + else: + count_not_yet_valid += 1 + + # Print matching + if success: + s = entry["subject"].split("CN=")[1] + \ + " certified by " + entry["issuer"].split("CN=")[1] + \ + " (" + entry["log"] + ") " + if valid: + print "(VALID) " + s + else: + print "(NOT VALID) " + s + + if get_cert: + print get_full_cert(entry) + + + print str(count_all) + " matches found. " \ + + str(count_valid) + " valid, " \ + + str(count_expired) + " expired and " \ + + str(count_not_yet_valid) + " not yet valid." +if args.domain: + # if args.log: + # log = args.log + # else: + # log = None + # d = args.domain + db_monitor_domain(args.domain) + # db_monitor_domain(args.domain, args.log, args.exclude_invalid, args.get_cert) +else: + print "No domain selected!" + sys.exit() |