influxdata / influxdata/telegraf
[inputs.whois] Support RDAP lookup
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 17.8k
- Forks
- 5.8k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 161
Description
### Use Case
I just started using the new [whois plugin](https://github.com/influxdata/telegraf/tree/master/plugins/inputs/whois) in Telegraf 1.35.0. I store the output from Telegraf in InfluxDB and display the domain expiration dates in a table using Grafana.
However, my domain `loganmarchione.dev` is showing `0` for the `expiration_timestamp`. Below is the raw data from InfluxDB.
```
> SELECT * FROM whois WHERE "domain" = 'loganmarchione.dev'
name: whois
time creation_timestamp dnssec_enabled domain expiration_timestamp expiry host name_servers registrant registrar status updated_timestamp
---- ------------------ -------------- ------ -------------------- ------ ---- ------------ ---------- --------- ------ -----------------
1750867201000000000 1416441600 false loganmarchione.dev 0 0 b91c005f274d ns-tld1.charlestonroadregistry.com,ns-tld2.charlestonroadregistry.com,ns-tld3.charlestonroadregistry.com,ns-tld4.charlestonroadregistry.com,ns-tld5.charlestonroadregistry.com not set ACTIVE 1744329600
```
My other domain, `loganmarchione.com` is displaying the `expiration_timestamp`.
```
> SELECT * FROM whois WHERE "domain" = 'loganmarchione.com'
name: whois
time creation_timestamp dnssec_enabled domain expiration_timestamp expiry host name_servers registrant registrar status updated_timestamp
---- ------------------ -------------- ------ -------------------- ------ ---- ------------ ---------- --------- ------ -----------------
1750867201000000000 1393788711 false loganmarchione.com 2024940711 274073510 b91c005f274d ns-1336.awsdns-39.org,ns-1795.awsdns-32.co.uk,ns-383.awsdns-47.com,ns-629.awsdns-14.net not set Tucows Domains Inc. clientTransferProhibited,clientUpdateProhibited 1738442467
```
Both domains are registered through [Hover.com](https://www.hover.com/). In Hover's control panel, the correct expiration is showing for both domains. This led me to believe that the public whois data avaiilable for `.dev` and `.com` domains are different (since the whois plugin defaults to using [this whois lookup](https://github.com/influxdata/telegraf/blob/df6d44e43dda93f8a22a7e0d40f899541e14ef46/plugins/inputs/whois/whois.go#L55)). Using `whois` locally, I can see this seems to be the case.
```
~
logan@LoganDesktop
> whois -I loganmarchione.dev | grep -i exp
~
logan@LoganDesktop
> whois -I loganmarchione.com | grep -i exp
Registry Expiry Date: 2034-03-02T19:31:51Z
```
Google is the owner of the `.dev` TLD.
- https://en.wikipedia.org/wiki/.dev
- https://get.dev/
There is a newer protocol called Registration Data Access Protocol (RDAP) that is meant to eventually replace whois. Apparently this is what Google is using for their domains (whois still works, but returns less data than rdap).
- https://en.wikipedia.org/wiki/Registration_Data_Access_Protocol
- https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol
- https://www.arin.net/resources/registry/whois/rdap/
- https://about.rdap.org/
If you use a web tool, you can see the RDAP results.
- https://client.rdap.org/?type=domain&object=loganmarchione.dev
- https://www.openrdap.org/demo?cmd=rdap+loganmarchione.dev
Is it possible to incorporate RDAP into Telegraf's whois plugin? It looks like there is already an RDAP Go client.
- https://github.com/openrdap/rdap
- https://pkg.go.dev/github.com/openrdap/rdap
### Expected behavior
Be able to ingest RDAP data.
### Actual behavior
Currently, trying to get whois info from a `.dev` domain (or I suspect any domain using RDAP), results in [this code](https://github.com/influxdata/telegraf/blob/df6d44e43dda93f8a22a7e0d40f899541e14ef46/plugins/inputs/whois/whois.go#L141-L142) setting the value of `expiration_timestamp` to `0`.
### Additional info
_No response_
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in plugins/inputs/whois/whois.go, especially the default lookup configuration near line 55 and the expiration handling near lines 141-142. Review the openrdap Go client and existing whois behavior; done means the plugin can ingest RDAP data and no longer reports a valid .dev expiration_timestamp as 0.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100