Skip to content

Commit 0bd751b

Browse files
wesyoungwesyoung
committed
re-factoring for readability
1 parent a765eb0 commit 0bd751b

File tree

7 files changed

+222
-225
lines changed

7 files changed

+222
-225
lines changed

‎csirtg_indicator/constants.py

+44-2
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,49 @@
44
if sys.version_info > (3,):
55
PYVERSION = 3
66

7-
COLUMNS = ['tlp', 'lasttime', 'reporttime', 'itype', 'indicator', 'count', 'cc', 'asn', 'asn_desc', 'confidence',
8-
'description', 'tags', 'rdata', 'provider']
7+
LOG_FORMAT = '%(asctime)s - %(levelname)s - %(name)s[%(lineno)s] - %(message)s'
8+
PROTOCOL_VERSION = '0.00a0'
9+
10+
FORMAT_COLUMNS = ['tlp', 'group', 'lasttime', 'indicator', 'count', 'confidence', 'tags', 'description', 'rdata',
11+
'provider']
12+
13+
COLUMNS = FORMAT_COLUMNS
914

1015
MAX_FIELD_SIZE = 30
16+
17+
IPV4_PRIVATE_NETS = [
18+
"0.0.0.0/8",
19+
"10.0.0.0/8",
20+
"127.0.0.0/8",
21+
"192.168.0.0/16",
22+
"169.254.0.0/16",
23+
"172.16.0.0/12",
24+
"192.0.2.0/24",
25+
"224.0.0.0/4",
26+
"240.0.0.0/5",
27+
"248.0.0.0/5"
28+
]
29+
30+
31+
FIELDS_CORE = [
32+
'indicator', 'itype', 'tlp', 'provider', 'group', 'tlp', 'provider', 'count', 'message', 'tags', 'confidence',
33+
'description', 'version'
34+
]
35+
36+
FIELDS_TIME = [
37+
'firsttime', 'lasttime', 'reporttime'
38+
]
39+
40+
FIELDS_META = [
41+
'application', 'reference', 'reference_tlp', 'altid', 'altid_tlp', 'additional_data'
42+
]
43+
44+
FIELDS_GEO = [
45+
'cc', 'latitude', 'timezone', 'longitude', 'city'
46+
]
47+
48+
FIELDS_IP = [
49+
'portlist', 'protocol', 'asn', 'asn_desc', 'dest', 'dest_portlist', 'mask', 'rdata', 'peers'
50+
]
51+
52+
FIELDS = FIELDS_CORE + FIELDS_GEO + FIELDS_META + FIELDS_IP + FIELDS_TIME

‎csirtg_indicator/indicator.py

+50-155
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,27 @@
11
# -*- coding: utf-8 -*-
2+
import sys
3+
if sys.version_info > (3,):
4+
from urllib.parse import urlparse
5+
basestring = (str, bytes)
6+
else:
7+
from urlparse import urlparse
8+
29
import json
3-
import logging
410
import textwrap
511
from argparse import ArgumentParser, RawDescriptionHelpFormatter
612
from datetime import datetime
713
import codecs
8-
9-
import arrow
1014
import pytricia
1115
from .utils import parse_timestamp, resolve_itype, is_subdomain
1216
from . import VERSION
13-
import sys
1417
from .exceptions import InvalidIndicator
15-
from base64 import b64encode, b64decode
16-
from zlib import compress,decompress
17-
from .constants import PYVERSION
18+
from base64 import b64encode
19+
from .constants import PYVERSION, IPV4_PRIVATE_NETS, PROTOCOL_VERSION, FIELDS, FIELDS_TIME, LOG_FORMAT
1820
import logging
1921

20-
if sys.version_info > (3,):
21-
from urllib.parse import urlparse
22-
else:
23-
from urlparse import urlparse
24-
2522
from pprint import pprint
2623

27-
TLP = "green"
28-
GROUP = "everyone"
29-
LOG_FORMAT = '%(asctime)s - %(levelname)s - %(name)s[%(lineno)s] - %(message)s'
30-
PROTOCOL_VERSION = '0.00a0'
31-
FIELDS = ['version', 'indicator', 'itype', 'tlp', 'provider', 'portlist', 'protocol', 'asn', 'asn_desc', 'cc', 'group',
32-
'reference', 'reference_tlp', 'application', 'confidence', 'peers', 'city', 'longitude', 'latitude',
33-
'description', 'additional_data', 'rdata', 'altid', 'altid_tlp', 'firsttime', 'lasttime', 'reporttime',
34-
'message', 'count']
35-
36-
3724
IPV4_PRIVATE = pytricia.PyTricia()
38-
IPV4_PRIVATE_NETS = [
39-
"0.0.0.0/8",
40-
"10.0.0.0/8",
41-
"127.0.0.0/8",
42-
"192.168.0.0/16",
43-
"169.254.0.0/16",
44-
"172.16.0.0/12",
45-
"192.0.2.0/24",
46-
"224.0.0.0/4",
47-
"240.0.0.0/5",
48-
"248.0.0.0/5"
49-
]
5025

5126
for x in IPV4_PRIVATE_NETS:
5227
IPV4_PRIVATE[x] = True
@@ -57,70 +32,35 @@ class Indicator(object):
5732
def __init__(self, indicator=None, version=PROTOCOL_VERSION, **kwargs):
5833
self.version = version
5934

60-
self.tlp = kwargs.get('tlp')
61-
self.provider = kwargs.get('provider')
62-
self.reporttime = kwargs.get('reporttime')
63-
self.group = kwargs.get('group')
64-
self.itype = kwargs.get('itype')
65-
self.protocol = kwargs.get('protocol')
66-
self.portlist = kwargs.get('portlist')
67-
self.dest = kwargs.get('dest')
68-
self.dest_portlist = kwargs.get('dest_portlist')
69-
self.tags = kwargs.get('tags')
70-
self.application = kwargs.get('application')
71-
self.reference = kwargs.get('reference')
72-
self.reference_tlp = kwargs.get('reference_tlp')
73-
self.confidence = kwargs.get('confidence')
74-
self.firsttime = kwargs.get('firsttime')
75-
self.lasttime = kwargs.get('lasttime')
76-
self.peers = kwargs.get('peers')
77-
self.longitude = kwargs.get('longitude')
78-
self.latitude = kwargs.get('latitude')
79-
self.city = kwargs.get('city')
80-
self.cc = kwargs.get('cc')
81-
self.timezone = kwargs.get('timezone')
82-
self.description = kwargs.get('description')
83-
self.altid = kwargs.get('altid')
84-
self.altid_tlp = kwargs.get('altid_tlp')
85-
self.additional_data = kwargs.get('additional_data')
86-
self.mask = kwargs.get('mask')
87-
self.rdata = kwargs.get('rdata')
88-
self.asn_desc = kwargs.get('asn_desc')
89-
self.asn = kwargs.get('asn')
90-
self.count = kwargs.get('count')
91-
92-
self.message = kwargs.get('message')
93-
94-
if self.tags and isinstance(self.tags, str):
95-
self.tags = self.tags.split(',')
96-
97-
if self.description:
98-
self.description = self.description.replace('\"', '').lower()
99-
100-
if self.timezone:
101-
self.timezone = self.timezone.lower()
102-
103-
if self.reporttime and isinstance(self.reporttime, str):
104-
self.reporttime = parse_timestamp(self.reporttime).datetime
105-
106-
if self.firsttime:
107-
self.firsttime = parse_timestamp(self.firsttime).datetime
108-
109-
if self.lasttime:
110-
self.lasttime = parse_timestamp(self.lasttime).datetime
111-
112-
if self.asn and self.asn.lower() == 'na':
113-
self.asn = None
114-
115-
self.asn = self.asn
116-
117-
if self.asn_desc and self.asn_desc.lower() == 'na':
118-
self.asn_desc = None
35+
for k in FIELDS:
36+
if k == 'indicator': # handle this at the end
37+
continue
38+
39+
if kwargs.get(k) is None:
40+
v = None
41+
if k is 'confidence':
42+
v = 0
43+
44+
setattr(self, k, v)
45+
continue
46+
47+
if k in FIELDS_TIME:
48+
kwargs[k] = parse_timestamp(kwargs[k]).datetime
49+
setattr(self, k, kwargs[k])
50+
continue
51+
52+
if isinstance(kwargs[k], basestring):
53+
kwargs[k] = kwargs[k].lower()
54+
if k in ['tags', 'peers']:
55+
kwargs[k] = kwargs[k].split(',')
56+
57+
setattr(self, k, kwargs[k])
11958

12059
self._indicator = None
12160
if indicator:
12261
self.indicator = indicator
12362

63+
12464
@property
12565
def indicator(self):
12666
return self.__indicator
@@ -185,73 +125,28 @@ def __dict__(self):
185125
return json.loads(s)
186126

187127
def __repr__(self):
188-
i = {
189-
"version": self.version,
190-
"indicator": self.indicator,
191-
'dest': self.dest,
192-
'dest_portlist': self.dest_portlist,
193-
"itype": self.itype,
194-
"tlp": self.tlp,
195-
"provider": self.provider,
196-
"portlist": self.portlist,
197-
"protocol": self.protocol,
198-
"asn": self.asn,
199-
"asn_desc": self.asn_desc,
200-
"cc": self.cc,
201-
"group": self.group,
202-
"reference": self.reference,
203-
"reference_tlp": self.reference_tlp,
204-
"application": self.application,
205-
'confidence': self.confidence,
206-
'peers': self.peers,
207-
'city': self.city,
208-
'longitude': self.longitude,
209-
'latitude': self.latitude,
210-
'description': self.description,
211-
'additional_data': self.additional_data,
212-
'rdata': self.rdata,
213-
'altid': self.altid,
214-
'altid_tlp': self.altid_tlp,
215-
'count': self.count
216-
}
217-
218-
if self.tags:
219-
if isinstance(self.tags, str):
220-
if ',' in self.tags:
221-
self.tags = self.tags.split(",")
222-
else:
223-
self.tags = [self.tags]
224-
i['tags'] = self.tags
225-
226-
if self.timezone:
227-
i['timezone'] = self.timezone.lower()
228-
229-
if self.reporttime and isinstance(self.reporttime, datetime):
230-
i['reporttime'] = self.reporttime.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
231-
else:
232-
i['reporttime'] = self.reporttime
233-
234-
if self.firsttime and isinstance(self.firsttime, datetime):
235-
i['firsttime'] = self.firsttime.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
236-
else:
237-
i['firsttime'] = self.firsttime
238-
239-
if self.lasttime and isinstance(self.lasttime, datetime):
240-
i['lasttime'] = self.lasttime.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
241-
else:
242-
i['lasttime'] = self.lasttime
128+
i = {}
129+
for k in FIELDS:
130+
v = getattr(self, k)
131+
if not v:
132+
continue
243133

244-
if self.message:
245-
if isinstance(self.message, str):
134+
if k == 'message':
246135
if PYVERSION == 2:
247-
self.messge = codecs.unicode_escape_encode(self.message.decode('utf-8'))[0]
136+
v = codecs.unicode_escape_encode(v.decode('utf-8'))[0]
248137
else:
249-
self.message = self.message.encode("utf-8")
138+
v = v.encode('utf-8')
139+
140+
v = b64encode(v).decode('utf-8')
141+
142+
if k in FIELDS_TIME and isinstance(v, datetime):
143+
v = v.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
250144

251-
self.message = b64encode(self.message)
252-
i['message'] = self.message.decode('utf-8') # make json parser happy
145+
if isinstance(v, basestring):
146+
if k is not 'message' and not k.endswith('time'):
147+
v = v.lower()
253148

254-
i = {k: v for (k, v) in i.items() if v is not None}
149+
i[k] = v
255150

256151
sort_keys = False
257152
indent = None

0 commit comments

Comments
 (0)