add axfr support

jc/parsers/dig.py

@@ -324,7 +324,7 @@ import jc.utils
 
 
 class info():
-    version = '1.0'
+    version = '1.1'
     description = 'dig command parser'
     author = 'Kelly Brazil'
     author_email = 'kellyjonbrazil@gmail.com'
@@ -402,6 +402,14 @@ def process(proc_data):
                 except (ValueError):
                     entry[key] = None
 
+        if 'axfr' in entry:
+            for ax in entry['axfr']:
+                try:
+                    ttl_int = int(ax['ttl'])
+                    ax['ttl'] = ttl_int
+                except (ValueError):
+                    ax['ttl'] = None
+
         if 'answer' in entry:
             for ans in entry['answer']:
                 try:
@@ -507,6 +515,24 @@ def parse_answer(answer):
             'ttl': answer_ttl,
             'data': answer_data}
 
+def parse_axfr(axfr):
+    #; <<>> DiG 9.11.14-3-Debian <<>> @81.4.108.41 axfr zonetransfer.me +nocookie
+    #; (1 server found)
+    #;; global options: +cmd
+    #zonetransfer.me. 7200 IN A 5.196.105.14
+    axfr = axfr.split(maxsplit=4)
+    axfr_name = axfr[0]
+    axfr_ttl = axfr[1]
+    axfr_class = axfr[2]
+    axfr_type = axfr[3]
+    axfr_data = axfr[4]
+
+    return {'name': axfr_name,
+            'ttl': axfr_ttl,
+            'class': axfr_class,
+            'type': axfr_type,
+            'data': axfr_data}
+
 
 def parse(data, raw=False, quiet=False):
     """
@@ -534,10 +560,24 @@ def parse(data, raw=False, quiet=False):
     question = False
     authority = False
     answer = False
+    axfr = False
 
     output_entry = {}
     for line in cleandata:
 
+        if line.startswith('; <<>> ') and line.lower().find(' axfr ') != -1:
+            question = False
+            authority = False
+            answer = False
+            axfr = True
+            axfr_list = []
+            continue
+
+        if line.find(';') == -1 and axfr:
+            axfr_list.append(parse_axfr(line))
+            output_entry.update({'axfr': axfr_list})
+            continue
+
         if line.find(';; ->>HEADER<<-') == 0:
             output_entry = {}
             output_entry.update(parse_header(line))
@@ -551,6 +591,7 @@ def parse(data, raw=False, quiet=False):
             question = True
             authority = False
             answer = False
+            axfr = False
             continue
 
         if question:
@@ -558,12 +599,14 @@ def parse(data, raw=False, quiet=False):
             question = False
             authority = False
             answer = False
+            axfr = False
             continue
 
         if line.find(';; AUTHORITY SECTION:') == 0:
             question = False
             authority = True
             answer = False
+            axfr = False
             authority_list = []
             continue
 
@@ -576,6 +619,7 @@ def parse(data, raw=False, quiet=False):
             question = False
             authority = False
             answer = True
+            axfr = False
             answer_list = []
             continue
 
@@ -604,6 +648,11 @@ def parse(data, raw=False, quiet=False):
         if line.find(';; MSG SIZE  rcvd:') == 0:
             output_entry.update({'rcvd': line.split(':')[1].lstrip()})
 
+            if output_entry:
+                raw_output.append(output_entry)
+        elif line.startswith(';; XFR size:'):
+            output_entry.update({'size': line.split(':')[1].lstrip()})
+
             if output_entry:
                 raw_output.append(output_entry)