Skip to content

Add destination lookups and click-to-copy - #6

Merged
Former-Stranger merged 2 commits into
mainfrom
domain-lookup
Oct 27, 2026
Merged

Former-Stranger merged 2 commits into
mainfrom
domain-lookup

Conversation

@Former-Stranger

Copy link
Copy Markdown
Owner

What does this change?

About this destination, in each expanded row:

  • Seen from: the clients that reached the destination in the current window, with host name, user, zone and event count. This comes from local data, so no lookup is needed.
  • Look up, on demand (POST /api/lookup, same-origin protected):
    • Hostnames: RDAP registration through rdap.org (registered domain, registrant, registrar, dates, name servers), DNS (the canonical name shows the CDN, plus addresses), and the server's certificate (organization, issuer, other names it covers, whether it covers this name).
    • IP addresses: the network's RDAP owner and range, reverse DNS, and the certificate.
    • Research links: VirusTotal, urlscan.io, crt.sh and a web search.
  • How lookups behave:
    • The registered domain is found by trying the longest name first: registries answer 404 for names that aren't registered, which keeps the registry's own co.uk record from matching.
    • Private, loopback and other non-public addresses are never contacted.
    • Each source fails on its own: an error in one doesn't hide the others.
    • Results are cached for 24 hours.
    • DOMAIN_LOOKUP=false turns it off.
    • Demo mode returns made-up results without using the network.

Click to copy: any value in the details and the events table copies when clicked, or when focused and Enter is pressed, and shows "Copied". A destination copies just the IP, without the port. The page tries the Clipboard API first and falls back to execCommand when that's blocked (plain HTTP, permissions policy, embedded browsers). Values are labelled "Copy …" for screen readers.

How was it tested?

  • uv run python -m unittest discover tests: 81 tests, 11 of them new for lookups (fake network). They also pass inside the image on Python 3.14.
  • terraform test (not affected)
  • Tried in demo mode in a browser: the lookup panel renders, links open, and click-to-copy puts the IP on the clipboard (the fallback path is covered too). Real lookups from the image returned correct results for a .com behind a CDN, a .co.uk, a deep subdomain, a public IP, and a private IP (not contacted).

Checklist

  • Docs and CHANGELOG.md (Unreleased) updated where users would notice
  • No real hostnames, IPs, tenant IDs, keys or logs in code, tests or this PR

🤖 Generated with Claude Code

Expanded rows now show which clients reached a destination and offer an
on-demand Look up: the domain's RDAP registration (longest name first, so
a registry's own co.uk record never wins), DNS with the canonical name
that reveals the CDN, and the certificate the server presents, plus
research links. IP destinations get the network's RDAP owner and reverse
DNS. Private and other non-public addresses are never contacted, results
are cached for a day, and DOMAIN_LOOKUP=false turns it off.

Any value in the details and events table can be clicked (or focused and
Enter) to copy it; a destination copies just the IP. The Clipboard API is
tried first, with the execCommand fallback when it's blocked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Comment thread src/panos_decrypt_bypass/web/lookup.py Fixed
CodeQL flagged ssl.create_default_context() as allowing TLS 1.0/1.1. Python
3.12+ with OpenSSL 3 refuses them anyway, but say so explicitly, in the
new certificate lookup and in the existing firewall XML API client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@Former-Stranger
Former-Stranger merged commit 52e9049 into main Oct 27, 2026
9 checks passed
@Former-Stranger
Former-Stranger deleted the domain-lookup branch October 27, 2026 15:17
@Former-Stranger Former-Stranger mentioned this pull request Oct 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants