feat(inputs.whois): Add plugin

docs/LICENSE_OF_DEPENDENCIES.md

@@ -260,6 +260,9 @@ following works:
 - github.com/kylelemons/godebug [Apache License 2.0](https://github.com/kylelemons/godebug/blob/master/LICENSE)
 - github.com/leodido/go-syslog [MIT License](https://github.com/influxdata/go-syslog/blob/develop/LICENSE)
 - github.com/leodido/ragel-machinery [MIT License](https://github.com/leodido/ragel-machinery/blob/develop/LICENSE)
+- github.com/likexian/gokit [Apache License 2.0](https://github.com/likexian/gokit/blob/master/LICENSE)
+- github.com/likexian/whois [Apache License 2.0](https://github.com/likexian/whois/blob/master/LICENSE)
+- github.com/likexian/whois-parser [Apache License 2.0](https://github.com/likexian/whois-parser/blob/master/LICENSE)
 - github.com/linkedin/goavro [Apache License 2.0](https://github.com/linkedin/goavro/blob/master/LICENSE)
 - github.com/logzio/azure-monitor-metrics-receiver [MIT License](https://github.com/logzio/azure-monitor-metrics-receiver/blob/master/LICENSE)
 - github.com/magiconair/properties [BSD 2-Clause "Simplified" License](https://github.com/magiconair/properties/blob/main/LICENSE.md)

go.mod

@@ -134,6 +134,8 @@ require (
 	github.com/klauspost/pgzip v1.2.6
 	github.com/kolo/xmlrpc v0.0.0-20220921171641-a4b6fa1dd06b
 	github.com/leodido/go-syslog/v4 v4.1.0
+	github.com/likexian/whois v1.15.5
+	github.com/likexian/whois-parser v1.24.20
 	github.com/linkedin/goavro/v2 v2.13.0
 	github.com/logzio/azure-monitor-metrics-receiver v1.1.0
 	github.com/lxc/incus/v6 v6.9.0
@@ -404,6 +406,7 @@ require (
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/leodido/ragel-machinery v0.0.0-20190525184631-5f46317e436b // indirect
+	github.com/likexian/gokit v0.25.15 // indirect
 	github.com/lufia/plan9stats v0.0.0-20240226150601-1dcf7310316a // indirect
 	github.com/magiconair/properties v1.8.9 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect

go.sum

@@ -1802,6 +1802,12 @@ github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.7.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/likexian/gokit v0.25.15 h1:QjospM1eXhdMMHwZRpMKKAHY/Wig9wgcREmLtf9NslY=
+github.com/likexian/gokit v0.25.15/go.mod h1:S2QisdsxLEHWeD/XI0QMVeggp+jbxYqUxMvSBil7MRg=
+github.com/likexian/whois v1.15.5 h1:gpPxyCTJtLtJDmakHCo//0ZjK/ocI01GCAd/WBJ2oH8=
+github.com/likexian/whois v1.15.5/go.mod h1:4b6o1QTCfjwrB5I3KeNQnn79QtuPUTsewsE+ys94I78=
+github.com/likexian/whois-parser v1.24.20 h1:oxEkRi0GxgqWQRLDMJpXU1EhgWmLmkqEFZ2ChXTeQLE=
+github.com/likexian/whois-parser v1.24.20/go.mod h1:rAtaofg2luol09H+ogDzGIfcG8ig1NtM5R16uQADDz4=
 github.com/linkedin/goavro/v2 v2.13.0 h1:L8eI8GcuciwUkt41Ej62joSZS4kKaYIUdze+6for9NU=
 github.com/linkedin/goavro/v2 v2.13.0/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
 github.com/logzio/azure-monitor-metrics-receiver v1.1.0 h1:L2LU/jWTOFibZeSKUeEDBdPY6iFL1gkSE3A/9mnk/Ms=

plugins/inputs/all/whois.go

@@ -0,0 +1,5 @@
+//go:build !custom || inputs || inputs.whois
+
+package all
+
+import _ "github.com/influxdata/telegraf/plugins/inputs/whois" // register plugin

plugins/inputs/whois/README.md

@@ -0,0 +1,60 @@
+# WHOIS Input Plugin
+
+The `whois` input plugin queries **WHOIS** information for configured
+domains and provides metrics such as expiration timestamps, registrar
+details, and domain status.
+
+## Global configuration options <!-- @/docs/includes/plugin_config.md -->
+
+In addition to the plugin-specific configuration settings, plugins support
+additional global and plugin configuration settings. These settings are used to
+modify metrics, tags, and field or create aliases and configure ordering, etc.
+See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
+
+[CONFIGURATION.md]: ../../../docs/CONFIGURATION.md#plugins
+
+## Configuration
+
+```toml @sample.conf
+# Reads WHOIS data and expose as metrics
+[[inputs.whois]]
+  ## List of domains to query
+  domains = ["example.com", "influxdata.com"]
+
+  ## Use Custom WHOIS server
+  ##   example: server = "whois.iana.org"
+  # server = ""
+
+  ## Timeout for WHOIS queries
+  # timeout = "5s"
+```
+
+## Metrics
+
+- whois
+  - tags:
+    - domain
+  - fields:
+    - creation_timestamp (int, seconds)
+    - dnssec_enabled (bool)
+    - expiration_timestamp (int, seconds)
+    - expiry (int, seconds) - Remaining time until the domain expires, in seconds.
+        This value can be **negative** if the domain is already expired.
+        `SELECT (expiry / 60 / 60 / 24) as "expiry_in_days"`
+    - registrar (string)
+    - registrant (string)
+    - status_code (int)
+      - 0 - Unknown
+      - 1 - Pending Delete
+      - 2 - Expired
+      - 3 - Locked
+      - 4 - Registered
+      - 5 - Active
+    - updated_timestamp (int, seconds)
+
+## Example Output
+
+```text
+domain=example.com creation_timestamp=808372800i,dnssec_enabled=true,expiration_timestamp=1755057600i,expiry=15596396i,name_servers="a.iana-servers.net,b.iana-servers.net",registrant="",registrar="RESERVED-Internet Assigned Numbers Authority",status_code=3i,updated_timestamp=1723618894i 1739461204000000000
+domain=influxdata.com creation_timestamp=1403603283i,dnssec_enabled=false,expiration_timestamp=1750758483i,expiry=11297277i,name_servers="ns-1200.awsdns-22.org,ns-127.awsdns-15.com,ns-2037.awsdns-62.co.uk,ns-820.awsdns-38.net",registrant="Redacted for Privacy",registrar="NameCheap, Inc.",status_code=3i,updated_timestamp=1716620263i 1739461206000000000
+```

plugins/inputs/whois/sample.conf

@@ -0,0 +1,11 @@
+# Reads whois data and expose as metrics
+[[inputs.whois]]
+  ## List of domains to query
+  domains = ["example.com", "influxdata.com"]
+
+  ## Use Custom WHOIS server
+  ##   example: server = "whois.iana.org"
+  # server = ""
+
+  ## Timeout for WHOIS queries
+  # timeout = "5s"

plugins/inputs/whois/whois.go

@@ -0,0 +1,193 @@
+package whois
+
+import (
+	_ "embed"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/influxdata/telegraf"
+	"github.com/influxdata/telegraf/config"
+	"github.com/influxdata/telegraf/plugins/inputs"
+	"github.com/likexian/whois"
+	"github.com/likexian/whois-parser"
+)
+
+//go:embed sample.conf
+var sampleConfig string
+
+type Whois struct {
+	Domains []string        `toml:"domains"`
+	Server  string          `toml:"server"`
+	Timeout config.Duration `toml:"timeout"`
+	Log     telegraf.Logger `toml:"-"`
+
+	client         *whois.Client
+	whoisLookup    func(client *whois.Client, domain, server string) (string, error)
+	parseWhoisData func(raw string) (whoisparser.WhoisInfo, error)
+}
+
+func (*Whois) SampleConfig() string {
+	return sampleConfig
+}
+
+func (w *Whois) Gather(acc telegraf.Accumulator) error {
+	if w.client == nil {
+		if err := w.Init(); err != nil {
+			return err
+		}
+	}
+
+	for _, domain := range w.Domains {
+		w.Log.Debugf("Fetching WHOIS data for %q using WHOIS server %q with timeout: %v", domain, w.Server, w.Timeout)
+
+		// Fetch WHOIS raw data
+		rawWhois, err := w.whoisLookup(w.client, domain, w.Server)
+		if err != nil {
+			acc.AddError(fmt.Errorf("whois query failed for %q: %w", domain, err))
+			continue
+		}
+
+		// Parse WHOIS data using whois-parser
+		parsedWhois, err := w.parseWhoisData(rawWhois)
+		if err != nil {
+			acc.AddError(fmt.Errorf("whois parsing failed for %q: %w", domain, err))
+			continue
+		}
+
+		w.Log.Debugf("Parsed WHOIS data for %s: %+v", domain, parsedWhois)
+
+		// Prevent nil pointer panic
+		if parsedWhois.Domain == nil {
+			w.Log.Warnf("No domain info found for %s", domain)
+
+			// Always register a metric, even on failure
+			acc.AddFields("whois", map[string]interface{}{
+				"status_code": 0,
+			}, map[string]string{
+				"domain": domain,
+			})
+			continue
+		}
+
+		// Extract expiration date
+		var expirationTimestamp int64
+		var expiry int
+		expiration := parsedWhois.Domain.ExpirationDateInTime
+		if expiration != nil {
+			expirationTimestamp = expiration.Unix()
+
+			// Calculate expiry in seconds
+			expiry = int(time.Until(*expiration).Seconds())
+		}
+
+		// Extract creation date
+		var creationTimestamp int64
+		created := parsedWhois.Domain.CreatedDateInTime
+		if created != nil {
+			creationTimestamp = created.Unix()
+		}
+
+		// Extract updated date
+		var updatedTimestamp int64
+		updated := parsedWhois.Domain.UpdatedDateInTime
+		if updated != nil {
+			updatedTimestamp = updated.Unix()
+		}
+
+		// Extract DNSSEC status
+		dnssec := parsedWhois.Domain.DNSSec
+
+		// Extract NameServers status
+		nameServers := parsedWhois.Domain.NameServers
+
+		// Extract registrar name (handle nil)
+		registrar := ""
+		if parsedWhois.Registrar != nil {
+			registrar = parsedWhois.Registrar.Name
+		}
+
+		// Extract registrant name (handle nil)
+		registrant := ""
+		if parsedWhois.Registrant != nil {
+			registrant = parsedWhois.Registrant.Name
+		}
+
+		// Extract status (handle nil)
+		domainStatus := 0
+		if parsedWhois.Domain.Status != nil {
+			domainStatus = simplifyStatus(parsedWhois.Domain.Status)
+		}
+
+		// Add metrics
+		fields := map[string]interface{}{
+			"creation_timestamp":   creationTimestamp,
+			"dnssec_enabled":       dnssec,
+			"expiration_timestamp": expirationTimestamp,
+			"expiry":               expiry,
+			"updated_timestamp":    updatedTimestamp,
+			"registrar":            registrar,
+			"registrant":           registrant,
+			"status_code":          domainStatus,
+			"name_servers":         strings.Join(nameServers, ","),
+		}
+		tags := map[string]string{
+			"domain": domain,
+		}
+
+		acc.AddFields("whois", fields, tags)
+	}
+
+	return nil
+}
+
+// simplifyStatus maps raw WHOIS statuses to a simpler classification
+func simplifyStatus(statusList []string) int {
+	for _, status := range statusList {
+		switch s := strings.ToLower(status); {
+		case strings.Contains(s, "pendingdelete"):
+			return 1 // PENDING DELETE
+		case strings.Contains(s, "redemptionperiod"):
+			return 2 // EXPIRED
+		case strings.Contains(s, "clienttransferprohibited"), strings.Contains(s, "clientdeleteprohibited"):
+			return 3 // LOCKED
+		case s == "registered":
+			return 4 // REGISTERED
+		case s == "active":
+			return 5 // ACTIVE
+		}
+	}
+	return 0 // UNKNOWN
+}
+
+func (w *Whois) Init() error {
+	if len(w.Domains) == 0 {
+		return errors.New("no domains configured")
+	}
+
+	w.client = whois.NewClient()
+	w.client.SetTimeout(time.Duration(w.Timeout))
+
+	if w.whoisLookup == nil {
+		w.whoisLookup = func(client *whois.Client, domain, server string) (string, error) {
+			return client.Whois(domain, server)
+		}
+	}
+	if w.parseWhoisData == nil {
+		w.parseWhoisData = func(raw string) (whoisparser.WhoisInfo, error) {
+			return whoisparser.Parse(raw)
+		}
+	}
+
+	return nil
+}
+
+// Plugin registration
+func init() {
+	inputs.Add("whois", func() telegraf.Input {
+		return &Whois{
+			Timeout: config.Duration(5 * time.Second),
+		}
+	})
+}