chore: Better reverse DNS resolving

.gitea/workflows/release-tag.yml

@@ -16,6 +16,7 @@ jobs:
         uses: https://github.com/actions/setup-go@v4
         with:
           go-version: '>=1.20.1'
+          cache: false
       - name: release-build
         run: go build -ldflags="-s -w -X 'main.Version=${{  github.ref_name }}'" -o bin/honeyspot-${{  github.ref_name }}-linux-amd64
       - name: release-build-windows
@@ -24,7 +25,7 @@ jobs:
         run: GOOS=darwin GOARCH=amd64 go build -ldflags="-s -w -X 'main.Version=${{  github.ref_name }}'" -o bin/honeyspot-${{  github.ref_name }}-darwin-amd64
       - name: Use Go Action
         id: use-go-action
-        uses: actions/release-action@main
+        uses: https://gitea.com/actions/release-action@main
         with:
           files: |-
             bin/**

geo.go

@@ -55,7 +55,7 @@ func asnLookup(ip net.IP) (*geoip2.ASN, error) {
 
 	if asn == nil {
 		var err error
-		asn, err = geoip2.Open("GeoLite2-aSN.mmdb")
+		asn, err = geoip2.Open("GeoLite2-ASN.mmdb")
 		if err != nil {
 			return nil, err
 		}

main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"github.com/go-git/go-git/v5"
@@ -22,8 +23,14 @@ import (
 	"time"
 )
 
+type QueueAddr struct {
+	IP     net.IP
+	Time   time.Time
+	Server string
+}
+
 var (
-	blacklistQueue []net.IP
+	blacklistQueue []QueueAddr
 	isUpdated      = atomic.Bool{}
 )
 
@@ -78,17 +85,81 @@ func updateRunner() {
 	}
 
 	for {
-		log.Info("Checking for updates")
 		if isUpdated.Load() {
 			isUpdated.Store(false)
 			update(repository, branch, auth, fileName)
 		}
 
 		// Sleep for 1 minute
-		time.Sleep(5 * time.Second)
+		time.Sleep(1 * time.Minute)
 	}
 }
 
+func resolver(addr string) net.Resolver {
+	var (
+		dnsResolverProto     = "udp" // Protocol to use for the DNS resolver
+		dnsResolverTimeoutMs = 5000  // Timeout (ms) for the DNS resolver (optional)
+	)
+
+	return net.Resolver{
+		Dial: func(ctx context.Context, network, address string) (net.Conn, error) {
+			d := net.Dialer{
+				Timeout: time.Duration(dnsResolverTimeoutMs) * time.Millisecond,
+			}
+			return d.DialContext(ctx, dnsResolverProto, addr)
+		},
+	}
+}
+
+func reverseDNS(ip net.IP) ([]string, error) {
+	results := make([]string, 0)
+
+	// resolve using system resolver
+	names, err := net.LookupAddr(ip.String())
+	if err == nil {
+		results = append(results, names...)
+	}
+
+	// resolve using 1.1.1.1
+	cloudflare := resolver("1.1.1.1")
+	names, err = cloudflare.LookupAddr(context.Background(), ip.String())
+	if err == nil {
+		results = append(results, names...)
+	} else {
+		log.Tracef("Failed to resolve reverse DNS using Cloduflare for %s: %s", ip.String(), err.Error())
+	}
+
+	// resolve using 8.8.8.8
+	google := resolver("8.8.8.8")
+	names, err = google.LookupAddr(context.Background(), ip.String())
+	if err == nil {
+		results = append(results, names...)
+	} else {
+		log.Tracef("Failed to resolve reverse DNS using Google for %s: %s", ip.String(), err.Error())
+	}
+
+	// resolve using 77.88.8.8
+	yandex := resolver("77.88.8.8")
+	names, err = yandex.LookupAddr(context.Background(), ip.String())
+	if err == nil {
+		results = append(results, names...)
+	} else {
+		log.Tracef("Failed to resolve reverse DNS using Yandex for %s: %s", ip.String(), err.Error())
+	}
+
+	// remove duplicates
+	unique := make(map[string]struct{})
+	for _, v := range results {
+		unique[v] = struct{}{}
+	}
+
+	results = make([]string, 0, len(unique))
+	for k := range unique {
+		results = append(results, k)
+	}
+	return results, nil
+}
+
 func update(repository *git.Repository, branch string, auth transport.AuthMethod, fileName string) {
 	type structuredBlacklist []string
 
@@ -179,7 +250,7 @@ func update(repository *git.Repository, branch string, auth transport.AuthMethod
 	}
 
 	toAdd := blacklistQueue
-	blacklistQueue = []net.IP{}
+	blacklistQueue = []QueueAddr{}
 
 	isAlreadyPresent := func(s net.IP) bool {
 		// check if the address is already present in the list
@@ -232,11 +303,21 @@ func update(repository *git.Repository, branch string, auth transport.AuthMethod
 		return false
 	}
 
-	added := make([]net.IP, 0)
+	added := make([]QueueAddr, 0)
 	for _, v := range toAdd {
-		if !isAlreadyPresent(v) {
-			alreadyBlacklisted = append(alreadyBlacklisted, v.String())
-			added = append(added, v)
+		if !isAlreadyPresent(v.IP) {
+			// check if the address is already present in the list
+			isPresent := false
+			for _, candidate := range added {
+				if v.IP.String() == candidate.IP.String() {
+					isPresent = true
+					break
+				}
+			}
+			if !isPresent {
+				alreadyBlacklisted = append(alreadyBlacklisted, v.IP.String())
+				added = append(added, v)
+			}
 		}
 	}
 
@@ -250,20 +331,22 @@ func update(repository *git.Repository, branch string, auth transport.AuthMethod
 	commitMessage := strings.Builder{}
 	commitMessage.WriteString(fmt.Sprintf("Add %d new addresses\n-------------------------------\n", len(added)))
 	for _, v := range added {
-		logMessages.WriteString(fmt.Sprintf("%s ", time.Now().Format(time.RFC3339)))
-		logMessages.WriteString(fmt.Sprintf("addr='%s'", v.String()))
+		logMessages.WriteString(fmt.Sprintf("%s ", v.Time.Format(time.RFC3339)))
+		logMessages.WriteString(fmt.Sprintf("server='%s' addr='%s'", v.Server, v.IP.String()))
 
-		commitMessage.WriteString(v.String())
-		reverseDNSNames, err := net.LookupAddr(v.String())
+		commitMessage.WriteString(v.IP.String())
+		reverseDNSNames, err := reverseDNS(v.IP)
 		if err == nil {
-			line := fmt.Sprintf(" hostname='%s'", reverseDNSNames[0])
-			commitMessage.WriteString(line)
-			logMessages.WriteString(line)
+			for _, name := range reverseDNSNames {
+				line := fmt.Sprintf(" hostname='%s'", name)
+				commitMessage.WriteString(line)
+				logMessages.WriteString(line)
+			}
 		} else {
-			log.Warnf("Failed to lookup reverse DNS for %s: %s", v.String(), err.Error())
+			log.Warnf("Failed to lookup reverse DNS for %s: %s", v.IP.String(), err.Error())
 		}
 
-		geo, err := geoLookup(v)
+		geo, err := geoLookup(v.IP)
 		if err == nil {
 			line := fmt.Sprintf(
 				" country='%s' city='%s' postal='%s'",
@@ -274,10 +357,10 @@ func update(repository *git.Repository, branch string, auth transport.AuthMethod
 			commitMessage.WriteString(line)
 			logMessages.WriteString(line)
 		} else {
-			log.Warnf("Failed to lookup geo for %s: %s", v.String(), err.Error())
+			log.Warnf("Failed to lookup geo for %s: %s", v.IP.String(), err.Error())
 		}
 
-		asn, err := asnLookup(v)
+		asn, err := asnLookup(v.IP)
 		if err == nil {
 			line := fmt.Sprintf(
 				" asn.id='%d' asn.name='%s'",
@@ -287,7 +370,7 @@ func update(repository *git.Repository, branch string, auth transport.AuthMethod
 			commitMessage.WriteString(line)
 			logMessages.WriteString(line)
 		} else {
-			log.Warnf("Failed to lookup ASN for %s: %s", v.String(), err.Error())
+			log.Warnf("Failed to lookup ASN for %s: %s", v.IP.String(), err.Error())
 		}
 
 		commitMessage.WriteString("\n")
@@ -409,7 +492,13 @@ func listen(addr string) {
 		}
 
 		// check is ip
-		ip := net.ParseIP(remoteAddr.String())
+		remoteAddrStr := remoteAddr.String()
+		// remove port with IPv6 support
+		if strings.Contains(remoteAddrStr, ":") {
+			remoteAddrStr = remoteAddrStr[:strings.LastIndex(remoteAddrStr, ":")]
+		}
+
+		ip := net.ParseIP(remoteAddrStr)
 		if ip == nil {
 			log.Warnf("Got request from non-IP %s, ignoring request", remoteAddr)
 			_ = conn.Close()
@@ -417,8 +506,16 @@ func listen(addr string) {
 		}
 
 		_ = conn.Close()
-		log.Infof("Got request from %s, blacklisting", remoteAddr)
-		blacklistQueue = append(blacklistQueue, ip)
+		log.
+			WithField("ip", ip.String()).
+			WithField("remote", remoteAddr).
+			WithField("server", addr).
+			Infof("Got request from %s, blacklisting", remoteAddr)
+		blacklistQueue = append(blacklistQueue, QueueAddr{
+			IP:     ip,
+			Time:   time.Now(),
+			Server: addr,
+		})
 		isUpdated.Store(true)
 	}
 }