#!/usr/bin/perl5.8.4
#  This software was derived from SATAN 1.1.1 by Dan Farmer and Wietse Venema
#  (http://www.porcupine.org/satan).
#
#
#  information gatherer for dns -- uses NSLOOKUP, so you're hosed
# unless you have that...
#
# XXX Must look for address->name servers too.
#
# Updated to include dig: 20 Aug 02 by todd
#
$running_under_sara = 1;

require 'config/paths.pl';
require 'perl/misc.pl';
require 'perllib/getopts.pl';
 
#
$usage="Usage: $0 target\n";
&Getopts("v");

if ($#ARGV < 0) {
	print STDERR $usage;
	exit 1;
	}
$target = $ARGV[0];
$service = &basename($0, ".sara");

$status = "a";
if ( -x $DIG ) {
  $args = "$target any";
  open (NS, "$DIG $args|");
} elsif ( -x $NSLOOKUP) {
  open(NS, "$NSLOOKUP 2>/dev/null<<EOC
set querytype=any
$target
EOC |");

} else {
  die "Can't run nslookup or dig\n";
} 

# until we change this, query away...
$done = 0;

while (<NS>) {
        $dig =  1 if /DiG/;
	next if ($_ =~ />/);
        next if ($_ =~ /;/);
	chop;
        if ($dig == 1) {
          ($domain, $dum, $dum, $ns, $nsname) = split(/\s+/);
          $domain =~ s/.$//;
          $nsname =~ s/.$//;
          $ns = "nameserver" if $ns eq "NS";
          if ($ns eq "nameserver") {
            $_ = "$domain    $ns = $nsname\n";
          } else {
            next;
          }
        }

	# pick up any tidbits along the way...
	&get_misc_dns_info();

	# ok, lets get the places we can get authoritative answers...
	if ($_ =~ /Authoritative answers/) { while (<NS>) {
		last if ($_ =~ />/);
		chop;
		&get_misc_dns_info();
		($auth, $garbage) = split;
		$all_auth{"\L$auth\E"} = "\L$auth\E";
		}
		}
	}

$trustee = "";
$trusted = "";
$severity = "";
$cve      = "";
$target_orig = $target;

for $cpu (keys %cpu) {
	$service_output = $cpu{$cpu};
	$target = $cpu;
	$text = "HINFO output";
        $cve = "";
	&sara_print();
	}
for $os (keys %os) {
	$service_output = $os{$os};
	$target = $os;
	$text = "HINFO output";
        $cve  = "";
	&sara_print();
	}
for $ma (keys %ma) {
	$ma{$ma} =~ s/^([^\.]+)\.(.+)$/$1\@$2/;
	$severity = "x";
	$target = $ma;
	$service_output = $ma{$ma};
	$trusted = $ma;	
	$text = "Mail address for DNS contact";
        $cve = "";
	&sara_print();
	}
for $me (keys %me) {
	$severity = "";
	$target = $target_orig;
	# do we want the number here?
	# $service_output = "$me $me{$me}";
	$service_output = $me;
	$trusted = $me;	
	$text = "Mail exchanger";
        $cve  = "";
	&sara_print();
	}

# pursue this?
#
# print "\nauth-answers from:\n" if (defined(%all_auth));
#	for $au (values %all_auth) {
#		print "$au\n";
#		}

# print "\nnameservers:\n" if (defined(%ns));
$trustee = "$target";
for $ns (values %ns) {
	$severity = "host";
	$target = $target_orig;
	$trusted = $ns;
	$service_output = "";
	$text = "authoritative DNS host";
        $cve  = "";
	&sara_print();
	}

#
# suck in various stuff we can get from the records -- mail exchanger, cpu, etc.
#
sub get_misc_dns_info {

if ($_ =~ /nameserver =/) { ($ns) = /nameserver = (\S+)/; $ns{$ns}="\L$ns\E"; }
if ($_ =~ /CPU\s*=/) { ($cpu{$target}) = /CPU\s*=\s*(\S+)/; }
if ($_ =~ /OS\s*=/) { ($os{$target}) = /OS\s*=\s*(\S+)/; }

if ($_ =~ /mail exchanger/) {
	($pref, $me) = /preference = (\S+).*mail exchanger = (\S+)/;
	$pref =~ s/,//;
	$me{$me} = $pref;
	}

if ($_ =~ /mail addr/) { ($ma{$target}) = /mail addr = (\S+)/; }

}
