search

jschauma / jswhois

whois lookup results in json format
Other
75 stars 4 forks source link

Add support for ReferralServer: whois://whois.ripe.net #5

Closed martinvonwittich closed 1 month ago

martinvonwittich commented 5 months ago

Given an IP from the 104.151.0.0/17 range (1&1 Versatel Deutschland GmbH), jswhois will only follow the referral chain up to whois.arin.net.

I've added some debug code to see the referral chain: ``` diff host ~/jswhois # git diff diff --git a/src/jswhois.go b/src/jswhois.go index a998caf..8990ab9 100644 --- a/src/jswhois.go +++ b/src/jswhois.go @@ -939,6 +939,7 @@ func askWhois(server, query string) (data map[string]interface{}) { case "refer": fallthrough case "registrar whois server": + verbose(2, "parsed \"%s\" referral to %s", thisKey, currentValue) t := currentValue /* Sometimes a WHOIS server is listed as a URL. */ re := regexp.MustCompile(`^(https?://)([^/]+)/?$`) @@ -946,6 +947,7 @@ func askWhois(server, query string) (data map[string]interface{}) { t = m[2] } if t != server { + verbose(1, "nextWhois = %s", t) nextWhois = t } } ```
It ends at whois.arin.net: ``` host ~/jswhois # ./jswhois -R -v -v 104.151.0.0 2024-07-01 18:48:46 => Looking up 1 names... 2024-07-01 18:48:46 ==> Looking up 104.151.0.0... 2024-07-01 18:48:46 ==> Looking up '104.151.0.0' at 'whois.iana.org'... 2024-07-01 18:48:47 ==> parsed "refer" referral to whois.arin.net 2024-07-01 18:48:47 => nextWhois = whois.arin.net 2024-07-01 18:48:47 ==> parsed "whois" referral to whois.arin.net 2024-07-01 18:48:47 => nextWhois = whois.arin.net 2024-07-01 18:48:47 ==> Looking up '104.151.0.0' at 'whois.arin.net'... [{"chain":["whois.iana.org","whois.arin.net"],"query":"104.151.0.0","whois.arin.net":{"Address":"P.O. Box 10096","CIDR":"104.151.0.0/17","City":"Amsterdam","Country":"NL","NetHandle":"NET-104-151-0-0-1","NetName":"RIPE","NetRange":"104.151.0.0 - 104.151.127.255","NetType":"Early Registrations, Transferred to RIPE NCC","OrgAbuseEmail":"abuse@ripe.net","OrgAbuseHandle":"ABUSE3850-ARIN","OrgAbuseName":"Abuse Contact","OrgAbusePhone":"+31205354444","OrgAbuseRef":"https://rdap.arin.net/registry/entity/ABUSE3850-ARIN","OrgId":"RIPE","OrgName":"RIPE Network Coordination Centre","OrgTechEmail":"hostmaster@ripe.net","OrgTechHandle":"RNO29-ARIN","OrgTechName":"RIPE NCC Operations","OrgTechPhone":"+31 20 535 4444","OrgTechRef":"https://rdap.arin.net/registry/entity/RNO29-ARIN","Organization":"RIPE Network Coordination Centre (RIPE)","OriginAS":"","Parent":"NET104 (NET-104-0-0-0-0)","PostalCode":"1001EB","Ref":["https://rdap.arin.net/registry/ip/104.151.0.0","https://rdap.arin.net/registry/entity/RIPE"],"ReferralServer":"whois://whois.ripe.net","RegDate":"2021-02-01","ResourceLink":["https://apps.db.ripe.net/search/query.html","whois://whois.ripe.net","https://apps.db.ripe.net/search/query.html"],"StateProv":"","Updated":["2021-02-01","2013-07-29"]},"whois.iana.org":{"changed":{"changed":"2011-02","source":"IANA"},"inetnum":{"inetnum":"104.0.0.0 - 104.255.255.255","organisation":"ARIN","status":"ALLOCATED"},"refer":"whois.arin.net","whois":"whois.arin.net"}}] ```

This unfortunately won't give me the information about 1&1 Versatel Deutschland GmbH as I would have expected.

whois sees an additional referral to whois.ripe.net that jswhois doesn't see:

host ~ # LC_ALL=C whois 104.151.42.5 | grep -i whois.ripe.net    
ResourceLink:  whois://whois.ripe.net
ReferralServer:  whois://whois.ripe.net
Found a referral to whois.ripe.net.
I wrote a quick'n'dirty proof-of-concept to parse this, by adding support for the key `ReferralServer` and `whois://` URLs: ``` host ~/jswhois # git diff diff --git a/src/jswhois.go b/src/jswhois.go index a998caf..b1eb908 100644 --- a/src/jswhois.go +++ b/src/jswhois.go @@ -938,14 +938,18 @@ func askWhois(server, query string) (data map[string]interface{}) { fallthrough case "refer": fallthrough + case "referralserver": + fallthrough case "registrar whois server": + verbose(2, "parsed \"%s\" referral to %s", thisKey, currentValue) t := currentValue /* Sometimes a WHOIS server is listed as a URL. */ - re := regexp.MustCompile(`^(https?://)([^/]+)/?$`) + re := regexp.MustCompile(`^(?:(https?|whois)://)([^/]+)/?$`) if m := re.FindStringSubmatch(currentValue); m != nil { t = m[2] } if t != server { + verbose(1, "nextWhois = %s", t) nextWhois = t } } ```
The result: ``` diff host ~/jswhois # ./jswhois -R -v -v 104.151.0.0 2024-07-01 18:52:40 => Looking up 1 names... 2024-07-01 18:52:40 ==> Looking up 104.151.0.0... 2024-07-01 18:52:40 ==> Looking up '104.151.0.0' at 'whois.iana.org'... 2024-07-01 18:52:40 ==> parsed "refer" referral to whois.arin.net 2024-07-01 18:52:40 => nextWhois = whois.arin.net 2024-07-01 18:52:40 ==> parsed "whois" referral to whois.arin.net 2024-07-01 18:52:40 => nextWhois = whois.arin.net 2024-07-01 18:52:40 ==> Looking up '104.151.0.0' at 'whois.arin.net'... 2024-07-01 18:52:40 ==> parsed "ReferralServer" referral to whois://whois.ripe.net 2024-07-01 18:52:40 => nextWhois = whois.ripe.net 2024-07-01 18:52:40 ==> Looking up '104.151.0.0' at 'whois.ripe.net'... [{"chain":["whois.iana.org","whois.arin.net","whois.ripe.net"],"query":"104.151.0.0","whois.arin.net":{"Address":"P.O. Box 10096","CIDR":"104.151.0.0/17","City":"Amsterdam","Country":"NL","NetHandle":"NET-104-151-0-0-1","NetName":"RIPE","NetRange":"104.151.0.0 - 104.151.127.255","NetType":"Early Registrations, Transferred to RIPE NCC","OrgAbuseEmail":"abuse@ripe.net","OrgAbuseHandle":"ABUSE3850-ARIN","OrgAbuseName":"Abuse Contact","OrgAbusePhone":"+31205354444","OrgAbuseRef":"https://rdap.arin.net/registry/entity/ABUSE3850-ARIN","OrgId":"RIPE","OrgName":"RIPE Network Coordination Centre","OrgTechEmail":"hostmaster@ripe.net","OrgTechHandle":"RNO29-ARIN","OrgTechName":"RIPE NCC Operations","OrgTechPhone":"+31 20 535 4444","OrgTechRef":"https://rdap.arin.net/registry/entity/RNO29-ARIN","Organization":"RIPE Network Coordination Centre (RIPE)","OriginAS":"","Parent":"NET104 (NET-104-0-0-0-0)","PostalCode":"1001EB","Ref":["https://rdap.arin.net/registry/ip/104.151.0.0","https://rdap.arin.net/registry/entity/RIPE"],"ReferralServer":"whois://whois.ripe.net","RegDate":"2021-02-01","ResourceLink":["https://apps.db.ripe.net/search/query.html","whois://whois.ripe.net","https://apps.db.ripe.net/search/query.html"],"StateProv":"","Updated":["2021-02-01","2013-07-29"]},"whois.iana.org":{"changed":{"changed":"2011-02","source":"IANA"},"inetnum":{"inetnum":"104.0.0.0 - 104.255.255.255","organisation":"ARIN","status":"ALLOCATED"},"refer":"whois.arin.net","whois":"whois.arin.net"},"whois.ripe.net":{"inetnum":{"admin-c":"VTH-RIPE","country":"DE","created":"2021-02-01T14:33:07Z","inetnum":"104.151.0.0 - 104.151.127.255","last-modified":"2022-09-14T06:07:21Z","mnt-by":["RIPE-NCC-HM-MNT","VT-ENGI-MNT"],"netname":"DE-VERSATEL-20140707","org":"ORG-KG4-RIPE","source":"RIPE","status":"ALLOCATED PA","tech-c":"TK1586-RIPE"},"organisation":{"abuse-c":"VTH-RIPE","address":["Wanheimer Stra\ufffde 90","40468","Duesseldorf","GERMANY"],"admin-c":["SP15435-RIPE","OS1997-RIPE","VTH-RIPE","HS7606-RIPE","TK1586-RIPE","BS4675-RIPE","FF9999-RIPE","MD26813-RIPE"],"country":"DE","created":"2004-04-17T11:09:29Z","last-modified":"2023-12-13T14:17:32Z","mnt-by":["RIPE-NCC-HM-MNT","VT-ENGI-MNT"],"mnt-ref":["RIPE-NCC-HM-MNT","VT-ENGI-MNT"],"org-name":"1\u00261 Versatel Deutschland GmbH","org-type":"LIR","organisation":"ORG-KG4-RIPE","phone":"+49201 8633 145","source":"RIPE # Filtered"},"person":{"address":["1\u00261 Versatel GmbH","Wanheimer Strasse 90","40468 Duesseldorf","Germany"],"created":"2003-11-21T11:57:52Z","last-modified":"2024-06-04T09:51:59Z","mnt-by":"VT-ENGI-MNT","nic-hdl":"TK1586-RIPE","person":"Thomas Kaftan","phone":"+49 (0) 201 8377 0","remarks":"Engineer Data Network","source":"RIPE # Filtered"},"role":{"abuse-mailbox":"abuse@1und1.net","address":["Versatel West GmbH","Unterste-Wilms-Strasse 29","44143 Dortmund","Germany"],"admin-c":["OS1997-RIPE","TK1586-RIPE","BS4675-RIPE","FF9999-RIPE","SP15435-RIPE","MD26813-RIPE"],"created":"2004-05-19T12:48:36Z","last-modified":"2022-09-19T07:15:33Z","mnt-by":"VT-ENGI-MNT","nic-hdl":"VTH-RIPE","phone":"+49 (0) 231 399 0","remarks":"Internet Engineering","role":"Versatel Hostmaster","source":"RIPE # Filtered","tech-c":["TK1586-RIPE","BS4675-RIPE","FF9999-RIPE","SP15435-RIPE","MD26813-RIPE"]},"route":{"created":"2021-05-28T11:00:23Z","descr":"VT-Customer","last-modified":"2021-05-28T11:00:23Z","mnt-by":"VT-MNT","origin":"AS8881","route":"104.151.0.0/17","source":"RIPE"}}}] ```
jschauma commented 1 month ago

Hey @martinvonwittich , thanks for your report and patch, and my apologies for having taken so long to take a look! I just committed your changes.