Why does SABnzbd contact Google every time an NZB is added?

[jakenightly]

I run Little Snitch on my Macbook and was surprised to see SABnzbd try to cvontact Google every time an NZB is added. Why does SABnzbd contact Google and what information is sent? Can an admin here post the conents of whatever data packet is sent?

[shypike]

If you're in Debug mode, SABnzbd will ping google at startup.
It does so in order to see whether internet connections are possible
and whether IPv6 is possible at all.

When IPv6 is possible (on most systems), SABnzbd will try to verify this when
creating a new connection to a Usenet server.
The latter is a bit overdone, I will check this.

Nothing, except your IP address is sent to Google.

It's safe to tell LittleSnitch to block the connection.
IPv6 won't work, but that's only a problem for about 0.1% of the users.

[jakenightly]

Thanks for the background information. It's good to know it can be blocked.

[sander]

SABnzbd try to cvontact Google every time an NZB is added.

FWIW: It only happens at startup. Not every time an NZB is added.

In SABnzbd.py You can replace both occurrences of "google.com" resp "ipv6.google.com" with any fqdn with both an IPv4 and IPv6 address, so for example

Code: Select all

cisco.com
facebook.com
test-ipv6.com
youtube.com
geenstijl.nl
akamai.com
bit.nl
wikipedia.org
ccc.de
debian.org
python.org
ipv6forum.org

but NOT (as these have no IPv6 address):

Code: Select all

apple.com
github.com
sourceforge.com
microsoft.com
sabnzbd.org

Furthermore: in SABnzbd.py you can even replace

"google.com" with any public IPv4 address, like "1.2.3.4"
"ipv6.google.com" with any public IPv6 address, like "2001::1"

and it still works on my system. As on those address no server is reachable, it is 100% anonymous.

HTH

[sander]

If you want to play yourself with the code, you can try this:

create a file logging.py:

Code: Select all

def info(*arg):
	print arg[0] % (arg[1:])

and another file print_my_ip_addresses.py (based on SABnzbd.py):

Code: Select all

import logging
import socket

def print_ip_addresses():
    try:
        s_ipv4 = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s_ipv4.connect((ipv4host,80))
        logging.info('IP address = %s', s_ipv4.getsockname()[0])
        s_ipv4.close()
    except:
        logging.info('could not determine IP address')
        pass

    try:
        s_ipv6 = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
        s_ipv6.connect((ipv6host,80))
        logging.info('IPv6 address = %s', s_ipv6.getsockname()[0])
        s_ipv6.close()
    except:
        logging.info('could not determine IPv6 address')
        pass

    return None

ipv4host = 'google.com'
ipv6host = ipv4host
print_ip_addresses()

ipv4host = 'akamai.com'
ipv6host = ipv4host
print_ip_addresses()

ipv4host = 'python.org'
ipv6host = ipv4host
print_ip_addresses()

ipv4host = '1.2.3.4'
ipv6host = '2001::1'
print_ip_addresses()

Then running print_my_ip_addresses.py you see every method works:

Code: Select all

$ python print_my_ip_addresses.py 
IP address = 192.168.1.148
IPv6 address = 2001:aaa:1f15:100c:dd4e:6e10:68c:6288
IP address = 192.168.1.148
IPv6 address = 2001:aaa:1f15:100c:dd4e:6e10:68c:6288
IP address = 192.168.1.148
IPv6 address = 2001:aaa:1f15:100c:dd4e:6e10:68c:6288
IP address = 192.168.1.148
IPv6 address = 2001:aaa:1f15:100c:dd4e:6e10:68c:6288

HTH

[shypike]

Furthermore: in SABnzbd.py you can even replace

"google.com" with any public IPv4 address, like "1.2.3.4"
"ipv6.google.com" with any public IPv6 address, like "2001::1"

and it still works on my system. As on those address no server is reachable, it is 100% anonymous.

Interesting.
I looked up 1.2.3.4. and it's defined as being undefind (see http://en.wikipedia.org/wiki/ICMP_hole_punching )
However 2001::1 seems to be a local address. Is there something equivalent to 1.2.3.4 for IPv6?
Or doesn't it matter in this case?

**Edit**
Could the range reserved for documentation be used?
Like 2001:db8::8080?
See http://www.ietf.org/rfc/rfc3849.txt

[jcfp]

If anything, safer than 2001::/32 which is supposed to be used for teredo tunneling.

1.2.3.0/24 is assigned to apnic research in australia so probably no real use, but (somewhat ironically as far as avoiding google.com goes) traffic send to those addresses always seems to end up going in circles on some google-owned network. RFC 5737 defines a number of test networks for ipv4, such as 192.0.2.0/24 that seem to be as dead as can be. No idea whether they could or should be used in sab though, or the side-effects this could have with overzealous firewalls (local or isp level). Plus any risk of lenghty timeouts in sab if there's nothing answering on the other end?

[shypike]

Thanks.
Maybe we should just use ipify.org with an option to disable it for the paranoid.

[sander]

Thanks.
Maybe we should just use ipify.org with an option to disable it for the paranoid.

1) The Google stuff and ipify are different things.
2) Both only happens with log_level() > 1, so NOT by default, right?

Sander

[sander]

I created two dummy addresses in my domain:

Code: Select all

$ host sabtesting4.appelboor.com
sabtesting4.appelboor.com has address 11.12.13.14

$ host sabtesting6.appelboor.com
sabtesting6.appelboor.com has IPv6 address 2001:2002::2003:2004

And that works:

Code: Select all

ipv4host = "sabtesting4.appelboor.com"
ipv6host = "sabtesting6.appelboor.com"
print_ip_addresses()

Code: Select all

$ python print_my_ip_addresses.py 
Let's go
192.168.1.113
2001:470:aaaa:100c::f5f

So, if this is created:

Code: Select all

testing4.sabnzbd.org
testing6.sabnzbd.org

people will recognize the sabnzbd.org domain and will not get scared?


PS: the above is not related ipify; ipify is really needed to the public IPv4 address

[shypike]

So, if this is created:

Code: Select all

testing4.sabnzbd.org
testing6.sabnzbd.org

people will recognize the sabnzbd.org domain and will not get scared?

There are always people who don't like "phone-home" software.
We already have a switch disabling "check-for-new-version" for much the same reason.
The fact that it only pings in Debug mode is not enough; people would not necessarily expect this side-effect.
Given that we're already using ipify.org for the public IP, why not use it for the other tests as well?
Also, I'm not sure our webmaster likes all those pings.
Furthermore, I want to avoid the impression that we're using a ping to sabnzbd.org to get usage statistics.

[jcfp]

There are always people who don't like "phone-home" software.
We're already have a switch disabling check-new -version for much the same reason.
The fact that it only does the ping in Debug mode is not enough; people would not necessarily expect this side-effect.
Given that we're already using ipify.org for the public IP, why not use it for the other tests as well?
Also, I'm not sure the webmaster likes all those pings.
Furthermore, I want to avoid the impression that we're using a ping to sabnzbd.org to get usage statistics.

Distros have been getting more sensitive to this kind of thing too. Debian has been labelling uncommanded loading of external resources at runtime as a privacy breach, complete with checks like this.

So that 'option to disable it for the paranoid' sure sounds like a plan.