jswhois
jswhois copied to clipboard
Published
20 hours ago •
jschauma
jschauma
Add support for ReferralServer: whois://whois.ripe.net
Given an IP from the 104.151.0.0/17 range (1&1 Versatel Deutschland GmbH), jswhois will only follow the referral chain up to whois.arin.net.
I've added some debug code to see the referral chain:
host ~/jswhois # git diff
diff --git a/src/jswhois.go b/src/jswhois.go
index a998caf..8990ab9 100644
--- a/src/jswhois.go
+++ b/src/jswhois.go
@@ -939,6 +939,7 @@ func askWhois(server, query string) (data map[string]interface{}) {
case "refer":
fallthrough
case "registrar whois server":
+ verbose(2, "parsed \"%s\" referral to %s", thisKey, currentValue)
t := currentValue
/* Sometimes a WHOIS server is listed as a URL. */
re := regexp.MustCompile(`^(https?://)([^/]+)/?$`)
@@ -946,6 +947,7 @@ func askWhois(server, query string) (data map[string]interface{}) {
t = m[2]
}
if t != server {
+ verbose(1, "nextWhois = %s", t)
nextWhois = t
}
}
It ends at whois.arin.net:
host ~/jswhois # ./jswhois -R -v -v 104.151.0.0
2024-07-01 18:48:46 => Looking up 1 names...
2024-07-01 18:48:46 ==> Looking up 104.151.0.0...
2024-07-01 18:48:46 ==> Looking up '104.151.0.0' at 'whois.iana.org'...
2024-07-01 18:48:47 ==> parsed "refer" referral to whois.arin.net
2024-07-01 18:48:47 => nextWhois = whois.arin.net
2024-07-01 18:48:47 ==> parsed "whois" referral to whois.arin.net
2024-07-01 18:48:47 => nextWhois = whois.arin.net
2024-07-01 18:48:47 ==> Looking up '104.151.0.0' at 'whois.arin.net'...
[{"chain":["whois.iana.org","whois.arin.net"],"query":"104.151.0.0","whois.arin.net":{"Address":"P.O. Box 10096","CIDR":"104.151.0.0/17","City":"Amsterdam","Country":"NL","NetHandle":"NET-104-151-0-0-1","NetName":"RIPE","NetRange":"104.151.0.0 - 104.151.127.255","NetType":"Early Registrations, Transferred to RIPE NCC","OrgAbuseEmail":"[email protected]","OrgAbuseHandle":"ABUSE3850-ARIN","OrgAbuseName":"Abuse Contact","OrgAbusePhone":"+31205354444","OrgAbuseRef":"https://rdap.arin.net/registry/entity/ABUSE3850-ARIN","OrgId":"RIPE","OrgName":"RIPE Network Coordination Centre","OrgTechEmail":"[email protected]","OrgTechHandle":"RNO29-ARIN","OrgTechName":"RIPE NCC Operations","OrgTechPhone":"+31 20 535 4444","OrgTechRef":"https://rdap.arin.net/registry/entity/RNO29-ARIN","Organization":"RIPE Network Coordination Centre (RIPE)","OriginAS":"","Parent":"NET104 (NET-104-0-0-0-0)","PostalCode":"1001EB","Ref":["https://rdap.arin.net/registry/ip/104.151.0.0","https://rdap.arin.net/registry/entity/RIPE"],"ReferralServer":"whois://whois.ripe.net","RegDate":"2021-02-01","ResourceLink":["https://apps.db.ripe.net/search/query.html","whois://whois.ripe.net","https://apps.db.ripe.net/search/query.html"],"StateProv":"","Updated":["2021-02-01","2013-07-29"]},"whois.iana.org":{"changed":{"changed":"2011-02","source":"IANA"},"inetnum":{"inetnum":"104.0.0.0 - 104.255.255.255","organisation":"ARIN","status":"ALLOCATED"},"refer":"whois.arin.net","whois":"whois.arin.net"}}]
This unfortunately won't give me the information about 1&1 Versatel Deutschland GmbH as I would have expected.
whois sees an additional referral to whois.ripe.net that jswhois doesn't see:
host ~ # LC_ALL=C whois 104.151.42.5 | grep -i whois.ripe.net
ResourceLink: whois://whois.ripe.net
ReferralServer: whois://whois.ripe.net
Found a referral to whois.ripe.net.
I wrote a quick'n'dirty proof-of-concept to parse this, by adding support for the key `ReferralServer` and `whois://` URLs:
host ~/jswhois # git diff
diff --git a/src/jswhois.go b/src/jswhois.go
index a998caf..b1eb908 100644
--- a/src/jswhois.go
+++ b/src/jswhois.go
@@ -938,14 +938,18 @@ func askWhois(server, query string) (data map[string]interface{}) {
fallthrough
case "refer":
fallthrough
+ case "referralserver":
+ fallthrough
case "registrar whois server":
+ verbose(2, "parsed \"%s\" referral to %s", thisKey, currentValue)
t := currentValue
/* Sometimes a WHOIS server is listed as a URL. */
- re := regexp.MustCompile(`^(https?://)([^/]+)/?$`)
+ re := regexp.MustCompile(`^(?:(https?|whois)://)([^/]+)/?$`)
if m := re.FindStringSubmatch(currentValue); m != nil {
t = m[2]
}
if t != server {
+ verbose(1, "nextWhois = %s", t)
nextWhois = t
}
}
The result:
host ~/jswhois # ./jswhois -R -v -v 104.151.0.0
2024-07-01 18:52:40 => Looking up 1 names...
2024-07-01 18:52:40 ==> Looking up 104.151.0.0...
2024-07-01 18:52:40 ==> Looking up '104.151.0.0' at 'whois.iana.org'...
2024-07-01 18:52:40 ==> parsed "refer" referral to whois.arin.net
2024-07-01 18:52:40 => nextWhois = whois.arin.net
2024-07-01 18:52:40 ==> parsed "whois" referral to whois.arin.net
2024-07-01 18:52:40 => nextWhois = whois.arin.net
2024-07-01 18:52:40 ==> Looking up '104.151.0.0' at 'whois.arin.net'...
2024-07-01 18:52:40 ==> parsed "ReferralServer" referral to whois://whois.ripe.net
2024-07-01 18:52:40 => nextWhois = whois.ripe.net
2024-07-01 18:52:40 ==> Looking up '104.151.0.0' at 'whois.ripe.net'...
[{"chain":["whois.iana.org","whois.arin.net","whois.ripe.net"],"query":"104.151.0.0","whois.arin.net":{"Address":"P.O. Box 10096","CIDR":"104.151.0.0/17","City":"Amsterdam","Country":"NL","NetHandle":"NET-104-151-0-0-1","NetName":"RIPE","NetRange":"104.151.0.0 - 104.151.127.255","NetType":"Early Registrations, Transferred to RIPE NCC","OrgAbuseEmail":"[email protected]","OrgAbuseHandle":"ABUSE3850-ARIN","OrgAbuseName":"Abuse Contact","OrgAbusePhone":"+31205354444","OrgAbuseRef":"https://rdap.arin.net/registry/entity/ABUSE3850-ARIN","OrgId":"RIPE","OrgName":"RIPE Network Coordination Centre","OrgTechEmail":"[email protected]","OrgTechHandle":"RNO29-ARIN","OrgTechName":"RIPE NCC Operations","OrgTechPhone":"+31 20 535 4444","OrgTechRef":"https://rdap.arin.net/registry/entity/RNO29-ARIN","Organization":"RIPE Network Coordination Centre (RIPE)","OriginAS":"","Parent":"NET104 (NET-104-0-0-0-0)","PostalCode":"1001EB","Ref":["https://rdap.arin.net/registry/ip/104.151.0.0","https://rdap.arin.net/registry/entity/RIPE"],"ReferralServer":"whois://whois.ripe.net","RegDate":"2021-02-01","ResourceLink":["https://apps.db.ripe.net/search/query.html","whois://whois.ripe.net","https://apps.db.ripe.net/search/query.html"],"StateProv":"","Updated":["2021-02-01","2013-07-29"]},"whois.iana.org":{"changed":{"changed":"2011-02","source":"IANA"},"inetnum":{"inetnum":"104.0.0.0 - 104.255.255.255","organisation":"ARIN","status":"ALLOCATED"},"refer":"whois.arin.net","whois":"whois.arin.net"},"whois.ripe.net":{"inetnum":{"admin-c":"VTH-RIPE","country":"DE","created":"2021-02-01T14:33:07Z","inetnum":"104.151.0.0 - 104.151.127.255","last-modified":"2022-09-14T06:07:21Z","mnt-by":["RIPE-NCC-HM-MNT","VT-ENGI-MNT"],"netname":"DE-VERSATEL-20140707","org":"ORG-KG4-RIPE","source":"RIPE","status":"ALLOCATED PA","tech-c":"TK1586-RIPE"},"organisation":{"abuse-c":"VTH-RIPE","address":["Wanheimer Stra\ufffde 90","40468","Duesseldorf","GERMANY"],"admin-c":["SP15435-RIPE","OS1997-RIPE","VTH-RIPE","HS7606-RIPE","TK1586-RIPE","BS4675-RIPE","FF9999-RIPE","MD26813-RIPE"],"country":"DE","created":"2004-04-17T11:09:29Z","last-modified":"2023-12-13T14:17:32Z","mnt-by":["RIPE-NCC-HM-MNT","VT-ENGI-MNT"],"mnt-ref":["RIPE-NCC-HM-MNT","VT-ENGI-MNT"],"org-name":"1\u00261 Versatel Deutschland GmbH","org-type":"LIR","organisation":"ORG-KG4-RIPE","phone":"+49201 8633 145","source":"RIPE # Filtered"},"person":{"address":["1\u00261 Versatel GmbH","Wanheimer Strasse 90","40468 Duesseldorf","Germany"],"created":"2003-11-21T11:57:52Z","last-modified":"2024-06-04T09:51:59Z","mnt-by":"VT-ENGI-MNT","nic-hdl":"TK1586-RIPE","person":"Thomas Kaftan","phone":"+49 (0) 201 8377 0","remarks":"Engineer Data Network","source":"RIPE # Filtered"},"role":{"abuse-mailbox":"[email protected]","address":["Versatel West GmbH","Unterste-Wilms-Strasse 29","44143 Dortmund","Germany"],"admin-c":["OS1997-RIPE","TK1586-RIPE","BS4675-RIPE","FF9999-RIPE","SP15435-RIPE","MD26813-RIPE"],"created":"2004-05-19T12:48:36Z","last-modified":"2022-09-19T07:15:33Z","mnt-by":"VT-ENGI-MNT","nic-hdl":"VTH-RIPE","phone":"+49 (0) 231 399 0","remarks":"Internet Engineering","role":"Versatel Hostmaster","source":"RIPE # Filtered","tech-c":["TK1586-RIPE","BS4675-RIPE","FF9999-RIPE","SP15435-RIPE","MD26813-RIPE"]},"route":{"created":"2021-05-28T11:00:23Z","descr":"VT-Customer","last-modified":"2021-05-28T11:00:23Z","mnt-by":"VT-MNT","origin":"AS8881","route":"104.151.0.0/17","source":"RIPE"}}}]
