Whois Protocol Support (using rdap)

[parrasajad]

Proposed changes

Checklist

• Pull request is created against the dev branch
• All checks passed (lint, unit/integration/regression tests etc.) with my changes
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if appropriate)

[parrasajad]

basic example template:

id: basic-whois-example

info:
  name: test template for WHOIS
  author: pdteam
  severity: info

whois:
  - query: "{{Host}}"
    extractors:
      - type: kval
        kval:
          - "expiration date"
          - "registrar"

[Ice3man543]

lgtm!

[Ice3man543]

Also, we should consider adding support for Debug mode whois response since currently no additional info is printed when running rdap protocol templates with -debug flag.

[ehsandeep]

As @Ice3man543 suggested, we can add support for debug/debug-req/debug-resp flag.

[geeknik]

Will there be support for querying whois/rdap servers directly? For example:

[WRN] [basic-whois-example] Could not execute request for aeda.net.ae: could not make whois request: No RDAP servers found for 'aeda.net.ae'

However, if I use the posix whois tool like so: whois -I aeda.net.ae, we see that whois.aeda.net.ae is queried successfully and returns useful data:

whois -I aeda.net.ae
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

refer:        whois.aeda.net.ae

domain:       AE

organisation: Telecommunications and Digital Government Regulatory Authority (TDRA)
address:      P.O. Box 116688
address:      Dubai
address:      United Arab Emirates

contact:      administrative
**SNIP**

[parrasajad]

We can specify a custom rdap domain (server) to query in the template

Example template:

id: basic-whois-example

info:
  name: test template for WHOIS
  author: pdteam
  severity: info

whois:
  - query: "{{Host}}"
    server: https://rdap.namecheap.com
    extractors:
      - type: kval
        kval:
          - "expiration date"
          - "registrar"

[geeknik]

That's great. Is there a chance we can define the custom rdap server as an environmental variable so we don't have to maintain 200+ templates?

[ehsandeep]

That's great. Is there a chance we can define the custom rdap server as an environmental variable so we don't have to maintain 200+ templates?

that's a great idea, ENV variable, and CLI flag to feed custom whois server to use will ease the process. cc @parrasajad