tnodir / fort

Fort Firewall for Windows
GNU General Public License v3.0
1.1k stars 96 forks source link

[Feature] Custom Lookup Services #212

Open tnodir opened 4 months ago

tnodir commented 4 months ago

Problem you are trying to solve

In most cases:

1. We block the complete traffic

2. Set up some rules

And then every time an unknown file/domain-name, ip-address or port appears, we start to research (look up for more details).

We want to know:

* Is internet access for the application necessary for our operation?

* Is this original and in the right position?

* (Relatively) trustworthy enough?

* What does it actually do or is need for?

And in the end, we look up these details on search-engines and services about these details. How would be a shortcut via clickable links which open the relative service-type with custom-service-URL queries in the web-browser?

Suggested solution

The integration of custom lookup services for:

* Websites (domains)

* IP addresses (IPv4/IPv6)

* Applications (filename, full path, possibly SHA1 hash)

* Ports

By lookup services, I mean websites which return information about a specific topic (domains, IP-addresses, files, ports) by search or query-URLs.

However, to avoid dictating which service the user has to use, we could allow them to define their own provider/service via custom-query with variable/placeholder in the/a settings page. Like this, a user could choose which provider they trust for their inquiries and use them then to look everything up.

Via SHIFT+LEFT-CLICK (via mouse or context-menu) on a Domain, IP-Address, Filename or Port in the SimpleWall application, the application would open the respective service-information via web-browser.

Example lookup patterns:

- https://www.file.net/prozess/{filename_raw}.html 
- http://www.datei.info/was_ist/{filename_underscore_seperator}.html

- https://iplocation.io/ip-whois-lookup/{IPv4}
- https://iplocation.io/ip-whois-lookup/{IPv6}

- https://whois.domaintools.com/{domain.tld}
- https://lookup.icann.org/whois/en?q={domain.tld}&t=a
- https://mxtoolbox.com/SuperTool.aspx?action=whois%3a{domain.tld}&run=toolpage

- https://www.speedguide.net/port.php?port={port}
- https://isc.sans.edu/data/port/{port}

(Copied from https://github.com/henrypp/simplewall/issues/1720)