lookup IPs about opensnitch

[gustavo-iniguez-goya]

latest changes to use a custom qtableview have made incredibly easy to extend the views to add options like this one. I've got it working. I'm working on other things in parallel, but I think that I'll commit it soon.

[MarkoShiva]

That is a nice feature but just tell me how to implement it? There are way too many variables in play. So how it will look the whois lookup? We would need to create another qtwidget window or change the state of this one which is not a big concern.
Other thing is that new connections are blocked before the current connection which is in the popup is resolved. That is not the best implementation but it works right now like that. That mean that we would need to have by default whitelisted whois not the best security practice and not how this small firewall is thought to work.
So I guess it can be implemented with another like scroll area the point is that if you do want to do a whois or dig -x or host lookup just make sure you have allowed permanently those connections before and run the commands in terminal through TOR or without it. I think that might be implemented in this version but should be certainly one of the options in a new opensnitch-ui, basically lookup switch which can be enabled in preferences, to either resolve or do not try to resolve IP addresses and another button which would on press run the whois information. I don't see that that much as the use case but then again not everyone love to work in shell.
lookup can be implemented immediately but for whois we need gui change or spawning a terminal window.

[ei8fdb]

Lil' Snitch does this quite successfully. The instances where a name resolves is very helpful when making the decision to deny or allow.

@evilsocket this would make a great enhancement!

A balance could be struck - if the IP resolves to a single name, then the name is displayed. If it resolves to multiple names, then display the IP.

As a minimum, proof of concept, a link to a web based lookup service could be used intially?

@in1t3r you're point about not everyone being a shell fan is very true.

Also, when prompted with the decision of denying or allowing, the user's main goal is to return to whatever they were doing before the prompt.

It would be great if Opensnitch was able to do the lookup for them and return the needed information.

I can try to put together some UI for this?

[impredicative]

@gustavo-iniguez-goya I don't follow how the linked commit relates to this issue.

In the UI -> Events -> Destination, it would be useful to see the hostname next to entries that are currently listed as just an IP and a port. For example, instead of 52.96.111.34 -> 443, it would be useful to see something like 52.96.111.34 (microsoft.com) -> 443 where microsoft.com is the mapped name.

[gustavo-iniguez-goya]

I don't follow how the linked commit relates to this issue.

oops, sorry for that, I think I typed the wrong issue number 0:)

We display the hostname, if we're able to obtain it. Otherwise we display the IP. Unless you mean the "NetName" or "Organization" field of the whois information.

I don't think that we should display it on the Events view, it would penalize performance quite a lot. But display that information on the Adress or Hosts view would be really interesting. related: #523