Re: [PATCH] display rDNS and GeoIP information for used nameservers

7 Nov 2017

Hello Michael,
...
Hi,
this quite a nice idea, but I have one small problem here which I think could
potentially confuse the users more than it helps.
And that is anycast DNS servers.
Oh, yes. *sigh*
...
So for example for the famous Google DNS 8.8.8.8 the GeoIP location would be US
which technically is correct, but I know for a fact that I am using an instance
that is located in the Telehouse which just a few miles away from me and not on
the other side of the big pond.
So can we do anything to make this better and should we?
The answer is simple and gives absolutely no satisfaction: No, we can't.
The (free) GeoIP database IPFire uses is somewhat ugly when it comes to anycast
networks, or even the networks of big DSL companies (see below): By looking at
the output of "geoiplookup [anycast IP]", there is no chance to see that something
is wrong.
Further, there are two problems with these networks:
(a) Only the company operating an anycast system knows where a certain IP is
actually located - as far as I am concerned, there is no (reliable) way to guess
this from outside. Some companies set informative PTR records such as "muc-x.y.z.anycast.company.com"
[muc = Munich], but even that does not mean anything in technical terms.
(b) There is a huge difference between the accuracy of multinational company's
networks in the free and non-free edition of the GeoIP database. For example, AOL
also owns subnets for their customers in Brazil and other countries outside US,
but the free database returns "US" for any AOL network queried.
Same goes for special categories such as "A1" (anonymous proxies): Even big Tor
nodes with static IPs or some huge VPN providers are mostly not listed there. :-|
To sum it up: I am aware of these - let's say - inaccuracies. However, I think we
need to stay consistent here: If we use GeoIP for firewall rules, which I consider
a great feature, we should work with the same information that iptables processes
if a user queries an IP address.
This is especially true for the connection tracking table (will send a working patch
for this later on), but otherwise, debugging of GeoIP firewall rules becomes very
hard.
Just as a remark: It is interesting that the Cloudflare networks are not listed in
the GeoIP database anymore (perhaps because they are anycast, too). But according
to bug #11482, this is not a good idea.
Best regards,
Peter Müller
...
-Michael
On Mon, 2017-11-06 at 19:09 +0100, Peter Müller wrote:
...
Display rDNS/PTR record and GeoIP information for used nameservers
on the netexternal.cgi WebUI page. These information might be useful
for debugging.
Thanks to Matthias Fischer for style improvements.
Signed-off-by: Peter Müller peter.mueller@link38.eu
html/cgi-bin/netexternal.cgi | 25 +++++++++++++++++++++++++
 langs/de/cgi-bin/de.pl       |  1 +
 langs/en/cgi-bin/en.pl       |  1 +
 3 files changed, 27 insertions(+)

diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi
index 299612d4c..cd2223ac6 100644
--- a/html/cgi-bin/netexternal.cgi
+++ b/html/cgi-bin/netexternal.cgi
@@ -25,9 +25,13 @@ use strict;
 #use warnings;
 #use CGI::Carp 'fatalsToBrowser';
+use IO::Socket;
+use Geo::IP::PurePerl;



require '/var/ipfire/general-functions.pl';
 require "${General::swroot}/lang.pl";
 require "${General::swroot}/header.pl";
+require "${General::swroot}/geoip-functions.pl";
 require "${General::swroot}/graphs.pl";
my %color = ();
@@ -99,6 +103,12 @@ if ( $querry[0] ne~ ""){
   					<strong>$Lang::tr{'nameserver
'}</strong>
   				</th>
   				<th align="center">

				<strong>$Lang::tr{'flag'}</st  



rong>

			</th>


			<th align="center">


				<strong>$Lang::tr{'rdns'}</st  



rong>

			</th>


			<th align="center">
			<strong>$Lang::tr{'status'}</  



strong>  
   				</th>
   			</tr>
@@ -138,10 +148,25 @@ END
   	}
my $table_colour = ($id++ % 2) ? $color{'color22'} :

$color{'color20'};


my $iaddr = inet_aton($nameserver);


my $rdns = gethostbyaddr($iaddr, AF_INET);


if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; }



my $gi = Geo::IP::PurePerl->new();


my $ccode = $gi->country_code_by_name($nameserver);


my $fcode = lc($ccode);


my $flag_icon = &GeoIP::get_flag_icon($fcode);


print <<END;
	<tr bgcolor="$table_colour">
		<td>$nameserver</td>

		<td align="center">


			<a href="country.cgi#$fcode"><img



src="$flag_icon" border="0" align="absmiddle" alt="$ccode" title="$ccode"></a>

		</td>


		<td align="center">


			$rdns


		</td>
	<td bgcolor="$bgcolour" align="center">
		<font  



color="$colour"><strong>$message</strong></font>  
   			</td>
diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl
index af96a6445..4cf866a3a 100644
--- a/langs/de/cgi-bin/de.pl
+++ b/langs/de/cgi-bin/de.pl
@@ -1951,6 +1951,7 @@
 'quick playlist' => 'Quick Playlist',
 'ram' => 'RAM-Speicher',
 'random number generator daemon' => 'Random Number Generator Daemon',
+'rdns' => 'rDNS',
 'read bytes' => 'Gelesene Bytes',
 'read list' => 'Liste der Leseberechtigten',
 'real address' => 'Reale Addresse',
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 7e4f95ccf..946aba873 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -1989,6 +1989,7 @@
 'quick playlist' => 'Quick Playlist',
 'ram' => 'RAM',
 'random number generator daemon' => 'Random Number Generator Daemon',
+'rdns' => 'rDNS',
 'read bytes' => 'Read Bytes',
 'read list' => 'list with readonly hosts',
 'real address' => 'Real Address',

    

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Re: [PATCH] display rDNS and GeoIP information for used nameservers

Signed-off-by: Peter Müller peter.mueller@link38.eu