Rename blocklists to IP lists and add IP lookup flags (closes #233)

The answer field is now ip_lists, the package internal/iplist and the
state directory iplists. No compatibility is kept for the old names.

Every IP lookup result gains a flags object with is_tor and is_bogon.
The largest list file accepted is now 200 MiB.

Model: opus-5-5

README.md

@@ -285,12 +285,8 @@ address. Every entry has the same fields:
   empty list when it has none
 - `flags`: yes-or-no facts about the address:
     - `is_tor`: true when the address is on the `tor_exits` list
-    - `is_vpn`: true when the address is on any list of VPN servers (see IP
-      lists)
     - `is_bogon`: true when the address is reserved, so that no network should
       announce it on the internet
-- `vpn_providers`: the names of the lists of VPN servers the address is on, or
-  an empty list when it is on none
 - `ip_lists`: the public IP lists the address is on (see IP lists), or an empty
   list when it is on none
 
@@ -424,27 +420,13 @@ The lists:
   last 30 days. From
   [FireHOL](https://iplists.firehol.org/?ipset=firehol_level3), downloaded every
   3 hours.
-- `ivpn`: VPN servers run by IVPN. From
-  [IVPN](https://api.ivpn.net/v5/servers.json), downloaded once a day.
-- `mullvad`: VPN servers run by Mullvad. From
-  [Mullvad](https://api.mullvad.net/www/relays/all/), downloaded once a day.
-- `nordvpn`: VPN servers run by NordVPN. From
-  [NordVPN](https://api.nordvpn.com/v1/servers?limit=0&fields[servers.station]&fields[servers.ipv6_station]&fields[servers.hostname]),
-  downloaded once a day.
-- `pia`: VPN servers run by Private Internet Access. From
-  [Private Internet Access](https://serverlist.piaservers.net/vpninfo/servers/v6),
-  downloaded once a day.
 - `spamhaus_drop` and `spamhaus_dropv6`: IPv4 and IPv6 networks hijacked or
   leased by spammers or cyber criminals, according to Spamhaus. From
   [Spamhaus DROP](https://www.spamhaus.org/blocklists/do-not-route-or-peer/),
   downloaded once a day.
-- `tor_exits`: the IPv4 and IPv6 addresses of Tor exit nodes, where traffic from
+- `tor_exits`: Tor exit nodes, where traffic from the Tor network leaves. From
-  the Tor network leaves. From the Tor Project's
+  the [Tor Project](https://check.torproject.org/torbulkexitlist), downloaded
-  [Onionoo](https://metrics.torproject.org/onionoo.html) service, downloaded
   every hour.
-- `x4bnet` and `x4bnet_v6`: IPv4 and IPv6 networks of VPN services, according to
-  a community list that names no service. From
-  [X4BNet](https://github.com/X4BNet/lists_vpn), downloaded once a day.
 
 No list is downloaded more often than its publisher updates it or allows. Each
 can be downloaded whole without an account or a key.

TODO.md

@@ -53,13 +53,6 @@ problem the run finds.
 
 # Completed Steps
 
-- 2026-11-10: the IP lookup checks the public VPN server lists of Mullvad,
-  NordVPN, Private Internet Access and IVPN, and X4BNet's community list. Each
-  result has `flags.is_vpn` and `vpn_providers` (closes
-  https://git.eeqj.de/sneak/routewatch/issues/235).
-- 2026-11-10: `tor_exits` comes from Onionoo, so it holds IPv6 exits and
-  `is_tor` is true for them (closes
-  https://git.eeqj.de/sneak/routewatch/issues/234).
 - 2026-11-10: each result of the IP lookup has a `flags` object with `is_tor`
   and `is_bogon`. The public IP lists are named `ip_lists` in the answer,
   `internal/iplist` in the code and `iplists` in the state directory. A list

internal/iplist/iplist.go

@@ -29,28 +29,6 @@ const (
 	// start with the network's first and last address. Lines that start
 	// with # are comments.
 	FormatDShield
-
-	// FormatOnionooJSON is one Onionoo details document. Its relays have
-	// addresses in two fields: exit_addresses, which has IPv4 only, and
-	// or_addresses, which has IPv4 and IPv6, each with a port.
-	FormatOnionooJSON
-
-	// FormatMullvadJSON is Mullvad's JSON list of relays. A relay's addresses
-	// are in ipv4_addr_in, ipv6_addr_in and ipv4_v2ray.
-	FormatMullvadJSON
-
-	// FormatNordVPNJSON is NordVPN's JSON list of servers. A server's
-	// addresses are in station and ipv6_station.
-	FormatNordVPNJSON
-
-	// FormatPIAJSON is Private Internet Access's JSON server list, then a
-	// blank line and a signature. Each region's servers has lists of servers
-	// by protocol, and each server has its address in ip.
-	FormatPIAJSON
-
-	// FormatIVPNJSON is IVPN's JSON server list. The hosts of its wireguard
-	// and openvpn gateways have their addresses in host and v2ray.
-	FormatIVPNJSON
 )
 
 // List is one public IP list.
@@ -70,9 +48,6 @@ type List struct {
 
 	// Format is how the list's file is written.
 	Format Format
-
-	// VPN says that the list holds servers of VPN services.
-	VPN bool
 }
 
 // Listing says that a list contains an address.
@@ -83,10 +58,6 @@ type Listing struct {
 	// Updated is when routewatch last downloaded the list, or last heard from
 	// its publisher that its copy was still current.
 	Updated time.Time `json:"updated"`
-
-	// VPN says that the list holds servers of VPN services. A lookup answer
-	// reports it through is_vpn and vpn_providers.
-	VPN bool `json:"-"`
 }
 
 // listCopy is a list's last good copy in memory.
@@ -153,7 +124,6 @@ func (b *IPLists) Lookup(addr netip.Addr) []Listing {
 				Name:        list.Name,
 				Description: list.Description,
 				Updated:     c.updated,
-				VPN:         list.VPN,
 			})
 		}
 	}

internal/iplist/iplist_internal_test.go

@@ -11,7 +11,6 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
-	"slices"
 	"strings"
 	"sync"
 	"testing"
@@ -29,50 +28,6 @@ const (
 	newListBody         = "# A test list\n" + newListedAddr + "\n"
 )
 
-// A small Onionoo details document: a relay with an exit address and IPv4 and
-// IPv6 relay addresses, one without exit addresses, and one with a list of
-// ports.
-const (
-	onionooExitAddr     = "192.0.2.10"
-	onionooIPv6ExitAddr = "2001:db8::1"
-	onionooBody         = `{"version":"8.0","relays":[
-		{"exit_addresses":["` + onionooExitAddr + `"],
-		 "or_addresses":["192.0.2.11:443","[` + onionooIPv6ExitAddr + `]:9001"]},
-		{"or_addresses":["192.0.2.20:443"]},
-		{"or_addresses":["192.0.2.30:80,443"]}
-	],"bridges":[]}`
-)
-
-// Small documents in the VPN services' formats. PIA's and IVPN's have no
-// public IPv6 addresses, and IVPN's holds addresses that are not its servers,
-// which must not be read.
-const (
-	mullvadBody = `[
-		{"hostname":"a-wg-001","ipv4_addr_in":"192.0.2.40","ipv6_addr_in":"2001:db8::40"},
-		{"hostname":"a-br-001","ipv4_addr_in":"192.0.2.41","ipv6_addr_in":null,
-		 "ipv4_v2ray":"192.0.2.42"}
-	]`
-	nordVPNBody = `[
-		{"hostname":"a1.example.com","station":"192.0.2.50","ipv6_station":""},
-		{"hostname":"a2.example.com","station":"192.0.2.51","ipv6_station":"2001:db8::51"}
-	]`
-	piaBody = `{"groups":{"wg":[{"name":"wireguard","ports":[1337]}]},"regions":[
-		{"id":"a","servers":{
-			"wg":[{"ip":"192.0.2.60","cn":"a1"}],
-			"ikev2":[{"ip":"192.0.2.61","cn":"a1"}]}},
-		{"id":"b","servers":{"meta":[{"ip":"192.0.2.62","cn":"b1","van":true}]}}
-	]}` + "\n\nc2lnbmF0dXJl\nbGluZSB0d28=\n"
-	ivpnBody = `{"wireguard":[{"gateway":"a.wg.example.com","hosts":[
-		{"hostname":"a1","host":"192.0.2.70","v2ray":"192.0.2.71",
-		 "ipv6":{"local_ip":"2001:db8::70/96"}}]}],
-	"openvpn":[{"gateway":"a.gw.example.com","hosts":[
-		{"hostname":"a1","host":"192.0.2.72"}]}],
-	"config":{"api":{"ips":["192.0.2.73"]}}}`
-)
-
-// errorPage is a file that is no list, as a publisher's error page is.
-const errorPage = "<!DOCTYPE html>\n<html></html>\n"
-
 // testETag is the ETag a publisher sends with a version of the test list.
 const testETag = `"v1"`
 
@@ -188,7 +143,13 @@ func lookup(t *testing.T, b *IPLists, addr string) []Listing {
 func TestLookupFindsListedAddresses(t *testing.T) {
 	t.Parallel()
 
-	runLookupCases(t, []lookupCase{
+	tests := []struct {
+		name     string
+		format   Format
+		body     string
+		listed   []string
+		unlisted []string
+	}{
 		{
 			name:     "single addresses",
 			format:   FormatLines,
@@ -220,70 +181,9 @@ func TestLookupFindsListedAddresses(t *testing.T) {
 			listed:   []string{"192.0.2.0", "192.0.2.77"},
 			unlisted: []string{"192.0.3.1", "2001:db8::1"},
 		},
-		{
+	}
-			name:   "Onionoo relays",
-			format: FormatOnionooJSON,
-			body:   onionooBody,
-			listed: []string{
-				onionooExitAddr, "192.0.2.11", "192.0.2.20", "192.0.2.30",
-				onionooIPv6ExitAddr,
-			},
-			unlisted: []string{"192.0.2.12", "2001:db8::2"},
-		},
-	})
-}
 
-// TestLookupFindsVPNServers downloads a list in each VPN service's format and
+	for _, tt := range tests {
-// looks up addresses on it and off it.
-func TestLookupFindsVPNServers(t *testing.T) {
-	t.Parallel()
-
-	runLookupCases(t, []lookupCase{
-		{
-			name:     "Mullvad relays",
-			format:   FormatMullvadJSON,
-			body:     mullvadBody,
-			listed:   []string{"192.0.2.40", "192.0.2.41", "192.0.2.42", "2001:db8::40"},
-			unlisted: []string{"192.0.2.43", "2001:db8::41"},
-		},
-		{
-			name:     "NordVPN servers",
-			format:   FormatNordVPNJSON,
-			body:     nordVPNBody,
-			listed:   []string{"192.0.2.50", "192.0.2.51", "2001:db8::51"},
-			unlisted: []string{"192.0.2.52", "2001:db8::50"},
-		},
-		{
-			name:     "PIA servers, with the signature after the JSON",
-			format:   FormatPIAJSON,
-			body:     piaBody,
-			listed:   []string{"192.0.2.60", "192.0.2.61", "192.0.2.62"},
-			unlisted: []string{"192.0.2.63", "2001:db8::60"},
-		},
-		{
-			name:     "IVPN hosts",
-			format:   FormatIVPNJSON,
-			body:     ivpnBody,
-			listed:   []string{"192.0.2.70", "192.0.2.71", "192.0.2.72"},
-			unlisted: []string{"192.0.2.73", "2001:db8::70"},
-		},
-	})
-}
-
-// lookupCase is a list file, the addresses it holds and some it does not.
-type lookupCase struct {
-	name     string
-	format   Format
-	body     string
-	listed   []string
-	unlisted []string
-}
-
-// runLookupCases downloads each case's list file and checks its addresses.
-func runLookupCases(t *testing.T, cases []lookupCase) {
-	t.Helper()
-
-	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -295,34 +195,26 @@ func runLookupCases(t *testing.T, cases []lookupCase) {
 				t.Fatalf("download: %v", err)
 			}
 
-			checkLookups(t, b, tt.listed, tt.unlisted)
+			for _, addr := range tt.listed {
+				listings := lookup(t, b, addr)
+				if len(listings) != 1 || listings[0].Name != testListName ||
+					listings[0].Description != testListDescription ||
+					listings[0].Updated.IsZero() {
+					t.Errorf("%s: listings %+v, want one for %s", addr,
+						listings, testListName)
+				}
+			}
+
+			for _, addr := range tt.unlisted {
+				listings := lookup(t, b, addr)
+				if listings == nil || len(listings) != 0 {
+					t.Errorf("%s: listings %#v, want an empty list", addr, listings)
+				}
+			}
 		})
 	}
 }
 
-// checkLookups checks that each of listed has one listing that names the test
-// list, and each of unlisted has an empty list of listings.
-func checkLookups(t *testing.T, b *IPLists, listed, unlisted []string) {
-	t.Helper()
-
-	for _, addr := range listed {
-		listings := lookup(t, b, addr)
-		if len(listings) != 1 || listings[0].Name != testListName ||
-			listings[0].Description != testListDescription ||
-			listings[0].Updated.IsZero() {
-			t.Errorf("%s: listings %+v, want one for %s", addr,
-				listings, testListName)
-		}
-	}
-
-	for _, addr := range unlisted {
-		listings := lookup(t, b, addr)
-		if listings == nil || len(listings) != 0 {
-			t.Errorf("%s: listings %#v, want an empty list", addr, listings)
-		}
-	}
-}
-
 // TestFailedDownloadKeepsThePreviousCopy downloads a good version of a list,
 // then one that fails. The good copy stays in memory and on disk, and no
 // part of the failed download is left beside it.
@@ -335,7 +227,7 @@ func TestFailedDownloadKeepsThePreviousCopy(t *testing.T) {
 		body   string
 	}{
 		{"server error", http.StatusInternalServerError, "unavailable"},
-		{"not a list", http.StatusOK, errorPage},
+		{"not a list", http.StatusOK, "<!DOCTYPE html>\n<html></html>\n"},
 	}
 
 	for _, tt := range tests {
@@ -371,164 +263,6 @@ func TestFailedDownloadKeepsThePreviousCopy(t *testing.T) {
 	}
 }
 
-// TestFileThatIsNotAnOnionooDocumentKeepsThePreviousCopy downloads a good
-// Onionoo document, then files that are not one. Each fails the parse, and
-// the good copy stays.
-func TestFileThatIsNotAnOnionooDocumentKeepsThePreviousCopy(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		body string
-	}{
-		{"not JSON", errorPage},
-		{"other JSON", `{"status":"ok","data":{"relays_count":1}}`},
-		{"JSON array", `[{"or_addresses":["192.0.2.1:443"]}]`},
-		{"no relays", `{"relays":[],"bridges":[]}`},
-		{"relays without addresses", `{"relays":[{"nickname":"example"}]}`},
-		{"relay address without a port", `{"relays":[{"or_addresses":["192.0.2.1"]}]}`},
-		{"exit address that is not one", `{"relays":[{"exit_addresses":["example"]}]}`},
-		{"text after the document", `{"relays":[{"or_addresses":["192.0.2.1:1"]}]} x`},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			dir := t.TempDir()
-			p, url := newPublisher(t, onionooBody)
-			b := newTestIPLists(dir, testList(url, FormatOnionooJSON))
-
-			err := b.download(t.Context(), b.lists[0])
-			if err != nil {
-				t.Fatalf("first download: %v", err)
-			}
-
-			p.answer(http.StatusOK, tt.body)
-
-			err = b.download(t.Context(), b.lists[0])
-			if err == nil {
-				t.Fatal("second download returned no error")
-			}
-
-			if len(lookup(t, b, onionooExitAddr)) != 1 {
-				t.Errorf("%s is no longer listed", onionooExitAddr)
-			}
-
-			onDisk, err := fs.ReadFile(os.DirFS(dir), testListName)
-			if err != nil || string(onDisk) != onionooBody {
-				t.Errorf("copy on disk %q (%v), want the good version", onDisk, err)
-			}
-		})
-	}
-}
-
-// TestWrongVPNDocumentFailsToParse parses documents that are not a VPN
-// service's list. Each fails, so none can replace a good copy.
-func TestWrongVPNDocumentFailsToParse(t *testing.T) {
-	t.Parallel()
-
-	formats := []struct {
-		name       string
-		format     Format
-		good       string
-		empty      string
-		badAddress string
-	}{
-		{
-			"Mullvad", FormatMullvadJSON, mullvadBody,
-			`[{"hostname":"a"}]`, `[{"ipv4_addr_in":"example"}]`,
-		},
-		{
-			"NordVPN", FormatNordVPNJSON, nordVPNBody,
-			`[{"hostname":"a","station":"","ipv6_station":""}]`,
-			`[{"station":"example"}]`,
-		},
-		{
-			"PIA", FormatPIAJSON, piaBody,
-			`{"regions":[{"id":"a","servers":{}}]}`,
-			`{"regions":[{"servers":{"wg":[{"ip":"example"}]}}]}`,
-		},
-		{
-			"IVPN", FormatIVPNJSON, ivpnBody,
-			`{"wireguard":[{"hosts":[]}],"openvpn":[]}`,
-			`{"wireguard":[{"hosts":[{"host":"example"}]}]}`,
-		},
-	}
-
-	for _, f := range formats {
-		bodies := map[string]string{
-			"not JSON":      errorPage,
-			"other JSON":    `{"status":"ok","data":{"count":1}}`,
-			"no addresses":  f.empty,
-			"bad address":   f.badAddress,
-			"cut off":       f.good[:len(f.good)/2],
-			"an empty file": "",
-		}
-
-		for name, body := range bodies {
-			t.Run(f.name+" "+name, func(t *testing.T) {
-				t.Parallel()
-
-				addresses, err := parse(strings.NewReader(body), f.format)
-				if err == nil {
-					t.Errorf("parse returned %v and no error", addresses.Ranges())
-				}
-			})
-		}
-	}
-}
-
-// TestLookupMarksVPNLists looks up an address on a VPN list and on another
-// list. Only the VPN list's listing says it is one.
-func TestLookupMarksVPNLists(t *testing.T) {
-	t.Parallel()
-
-	_, url := newPublisher(t, goodListBody)
-	vpnList := testList(url, FormatLines)
-	vpnList.Name = "test_vpn_list"
-	vpnList.VPN = true
-	otherList := testList(url, FormatLines)
-
-	b := New(Params{
-		Dir:    t.TempDir(),
-		Lists:  []List{vpnList, otherList},
-		Logger: slog.New(slog.DiscardHandler),
-	})
-
-	for _, list := range b.lists {
-		err := b.download(t.Context(), list)
-		if err != nil {
-			t.Fatalf("download of %s: %v", list.Name, err)
-		}
-	}
-
-	listings := lookup(t, b, listedAddr)
-	if len(listings) != 2 || !listings[0].VPN || listings[1].VPN {
-		t.Errorf("listings %+v, want the first of two marked as a VPN list",
-			listings)
-	}
-}
-
-// TestPublicListsMarkTheVPNLists checks which public lists are VPN lists,
-// since their names are what vpn_providers reports.
-func TestPublicListsMarkTheVPNLists(t *testing.T) {
-	t.Parallel()
-
-	var got []string
-
-	for _, list := range Lists() {
-		if list.VPN {
-			got = append(got, list.Name)
-		}
-	}
-
-	want := []string{"ivpn", "mullvad", "nordvpn", "pia", "x4bnet", "x4bnet_v6"}
-	if !slices.Equal(got, want) {
-		t.Errorf("VPN lists %v, want %v", got, want)
-	}
-}
-
 // checkGoodCopyOnDisk checks that dir holds the good version of the test list
 // and no part of a failed download.
 func checkGoodCopyOnDisk(t *testing.T, dir string) {
@@ -821,33 +555,6 @@ func TestStopCancelsADownloadInProgress(t *testing.T) {
 	}
 }
 
-// TestTorExitsListHoldsIPv6Exits downloads an Onionoo document as the public
-// Tor exit list, which is what an IPv6 address's is_tor answer comes from.
-func TestTorExitsListHoldsIPv6Exits(t *testing.T) {
-	t.Parallel()
-
-	index := slices.IndexFunc(Lists(), func(list List) bool {
-		return list.Name == TorExitsList
-	})
-	if index < 0 {
-		t.Fatalf("no list named %s", TorExitsList)
-	}
-
-	list := Lists()[index]
-	_, list.URL = newPublisher(t, onionooBody)
-	b := newTestIPLists(t.TempDir(), list)
-
-	err := b.download(t.Context(), list)
-	if err != nil {
-		t.Fatalf("download: %v", err)
-	}
-
-	listings := lookup(t, b, onionooIPv6ExitAddr)
-	if len(listings) != 1 || listings[0].Name != TorExitsList {
-		t.Errorf("listings %+v, want one for %s", listings, TorExitsList)
-	}
-}
-
 // TestPublicListsAreComplete checks that every public list has what a
 // download and a lookup answer need, and a unique name.
 func TestPublicListsAreComplete(t *testing.T) {

internal/iplist/lists.go

@@ -1,9 +1,6 @@
 package iplist
 
-import (
+import "time"
-	"slices"
-	"time"
-)
 
 // TorExitsList is the name of the list of Tor exit nodes.
 const TorExitsList = "tor_exits"
@@ -31,24 +28,15 @@ const (
 	// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
 	spamhausDROPInterval = 24 * time.Hour
 
-	// Onionoo's relay data follows Tor's hourly network consensus, and
+	// Tor publishes a new exit list every hour and sets no download limit:
-	// Onionoo sets no download limit:
+	// https://collector.torproject.org/recent/exit-lists/
-	// https://metrics.torproject.org/onionoo.html
 	torExitsInterval = time.Hour
-
-	// A VPN service's servers change slowly, so once a day is enough.
-	vpnListInterval = 24 * time.Hour
 )
 
 // Lists returns the public IP lists routewatch downloads. Each can be
 // downloaded whole without an account or a key. Spamhaus merged its EDROP
 // list into DROP, so DROP covers both.
 func Lists() []List {
-	return slices.Concat(nonVPNLists(), vpnLists())
-}
-
-// nonVPNLists returns the public lists that are not lists of VPN servers.
-func nonVPNLists() []List {
 	return []List{
 		{
 			Name: "dshield",
@@ -100,71 +88,9 @@ func nonVPNLists() []List {
 		{
 			Name:        TorExitsList,
 			Description: "A Tor exit node, where traffic from the Tor network leaves",
-			URL: "https://onionoo.torproject.org/details?" +
+			URL:         "https://check.torproject.org/torbulkexitlist",
-				"flag=Exit&running=true&fields=exit_addresses,or_addresses",
+			Interval:    torExitsInterval,
-			Interval: torExitsInterval,
+			Format:      FormatLines,
-			Format:   FormatOnionooJSON,
-		},
-	}
-}
-
-// vpnLists returns the public lists of VPN servers. Their names are what
-// vpn_providers reports.
-func vpnLists() []List {
-	return []List{
-		{
-			Name:        "ivpn",
-			Description: "A server of the IVPN service",
-			URL:         "https://api.ivpn.net/v5/servers.json",
-			Interval:    vpnListInterval,
-			Format:      FormatIVPNJSON,
-			VPN:         true,
-		},
-		{
-			Name:        "mullvad",
-			Description: "A server of the Mullvad VPN service",
-			URL:         "https://api.mullvad.net/www/relays/all/",
-			Interval:    vpnListInterval,
-			Format:      FormatMullvadJSON,
-			VPN:         true,
-		},
-		{
-			Name:        "nordvpn",
-			Description: "A server of the NordVPN service",
-			URL: "https://api.nordvpn.com/v1/servers?limit=0" +
-				"&fields[servers.station]&fields[servers.ipv6_station]" +
-				"&fields[servers.hostname]",
-			Interval: vpnListInterval,
-			Format:   FormatNordVPNJSON,
-			VPN:      true,
-		},
-		{
-			Name:        "pia",
-			Description: "A server of the Private Internet Access VPN service",
-			URL:         "https://serverlist.piaservers.net/vpninfo/servers/v6",
-			Interval:    vpnListInterval,
-			Format:      FormatPIAJSON,
-			VPN:         true,
-		},
-		{
-			Name: "x4bnet",
-			Description: "In an IPv4 network of a VPN service, according to " +
-				"X4BNet's community list",
-			URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
-				"output/vpn/ipv4.txt",
-			Interval: vpnListInterval,
-			Format:   FormatLines,
-			VPN:      true,
-		},
-		{
-			Name: "x4bnet_v6",
-			Description: "In an IPv6 network of a VPN service, according to " +
-				"X4BNet's community list",
-			URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
-				"output/vpn/ipv6.txt",
-			Interval: vpnListInterval,
-			Format:   FormatLines,
-			VPN:      true,
 		},
 	}
 }

internal/iplist/parse.go

@@ -6,9 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net"
 	"net/netip"
-	"slices"
 	"strings"
 
 	"go4.org/netipx"
@@ -34,40 +32,12 @@ var (
 	errUnknownFormat = errors.New("unknown list format")
 	errNoNetwork     = errors.New("no network on the line")
 	errBadRange      = errors.New("first and last address make no range")
-	errNoAddresses   = errors.New("no addresses in the document")
 )
 
 // parse reads a list file written in format and returns the addresses it
-// holds. Anything it cannot read fails the whole file, so a file that is not
+// holds. A line it cannot read fails the whole file, so a file that is not
 // the list, such as an error page, never replaces a good copy.
 func parse(r io.Reader, format Format) (*netipx.IPSet, error) {
-	switch format {
-	case FormatLines:
-		return parseLines(r, addAddressOrNetwork)
-	case FormatSpamhausJSON:
-		return parseLines(r, addSpamhausNetwork)
-	case FormatDShield:
-		return parseLines(r, addDShieldNetwork)
-	case FormatOnionooJSON:
-		return parseOnionoo(r)
-	case FormatMullvadJSON:
-		return parseMullvad(r)
-	case FormatNordVPNJSON:
-		return parseNordVPN(r)
-	case FormatPIAJSON:
-		return parsePIA(r)
-	case FormatIVPNJSON:
-		return parseIVPN(r)
-	default:
-		return nil, errUnknownFormat
-	}
-}
-
-// parseLines reads a list file line by line, skipping blank lines and
-// comments, and calls addLine with each other line.
-func parseLines(
-	r io.Reader, addLine func(*netipx.IPSetBuilder, string) error,
-) (*netipx.IPSet, error) {
 	var builder netipx.IPSetBuilder
 
 	scanner := bufio.NewScanner(r)
@@ -78,7 +48,7 @@ func parseLines(
 			continue
 		}
 
-		err := addLine(&builder, line)
+		err := addLine(&builder, line, format)
 		if err != nil {
 			return nil, fmt.Errorf("line %d: %w", lineNumber, err)
 		}
@@ -92,6 +62,20 @@ func parseLines(
 	return builder.IPSet()
 }
 
+// addLine adds the address or network on one line of a list file to builder.
+func addLine(builder *netipx.IPSetBuilder, line string, format Format) error {
+	switch format {
+	case FormatLines:
+		return addAddressOrNetwork(builder, line)
+	case FormatSpamhausJSON:
+		return addSpamhausNetwork(builder, line)
+	case FormatDShield:
+		return addDShieldNetwork(builder, line)
+	default:
+		return errUnknownFormat
+	}
+}
+
 // addAddressOrNetwork adds an address, such as 192.0.2.1, or a network, such
 // as 192.0.2.0/24, to builder.
 func addAddressOrNetwork(builder *netipx.IPSetBuilder, text string) error {
@@ -172,221 +156,3 @@ func addDShieldNetwork(builder *netipx.IPSetBuilder, line string) error {
 
 	return nil
 }
-
-// parseOnionoo returns every address in the exit_addresses and or_addresses
-// fields of the relays in an Onionoo details document. A document with no
-// addresses fails, because the Tor network always has relays.
-func parseOnionoo(r io.Reader) (*netipx.IPSet, error) {
-	//nolint:tagliatelle // Onionoo's own field names
-	var details struct {
-		Relays []struct {
-			ExitAddresses []string `json:"exit_addresses"`
-			ORAddresses   []string `json:"or_addresses"`
-		} `json:"relays"`
-	}
-
-	err := readJSON(r, &details)
-	if err != nil {
-		return nil, err
-	}
-
-	var builder netipx.IPSetBuilder
-
-	for _, relay := range details.Relays {
-		for _, text := range relay.ExitAddresses {
-			err = addAddress(&builder, text)
-			if err != nil {
-				return nil, err
-			}
-		}
-
-		for _, text := range relay.ORAddresses {
-			err = addAddressWithPort(&builder, text)
-			if err != nil {
-				return nil, err
-			}
-		}
-	}
-
-	addresses, err := builder.IPSet()
-	if err != nil {
-		return nil, err
-	}
-
-	if len(addresses.Ranges()) == 0 {
-		return nil, errNoAddresses
-	}
-
-	return addresses, nil
-}
-
-// parseMullvad returns the addresses of the relays in a Mullvad document. A
-// relay with no IPv6 address has null for it, and only bridges have
-// ipv4_v2ray.
-func parseMullvad(r io.Reader) (*netipx.IPSet, error) {
-	//nolint:tagliatelle // Mullvad's own field names
-	var relays []struct {
-		IPv4      string `json:"ipv4_addr_in"`
-		IPv6      string `json:"ipv6_addr_in"`
-		IPv4V2Ray string `json:"ipv4_v2ray"`
-	}
-
-	err := readJSON(r, &relays)
-	if err != nil {
-		return nil, err
-	}
-
-	var texts []string
-
-	for _, relay := range relays {
-		texts = append(texts, relay.IPv4, relay.IPv6, relay.IPv4V2Ray)
-	}
-
-	return addressSet(texts)
-}
-
-// parseNordVPN returns the addresses of the servers in a NordVPN document. A
-// server with no IPv6 address has an empty ipv6_station.
-func parseNordVPN(r io.Reader) (*netipx.IPSet, error) {
-	//nolint:tagliatelle // NordVPN's own field names
-	var servers []struct {
-		Station     string `json:"station"`
-		IPv6Station string `json:"ipv6_station"`
-	}
-
-	err := readJSON(r, &servers)
-	if err != nil {
-		return nil, err
-	}
-
-	var texts []string
-
-	for _, server := range servers {
-		texts = append(texts, server.Station, server.IPv6Station)
-	}
-
-	return addressSet(texts)
-}
-
-// parsePIA returns the addresses of the servers in a Private Internet Access
-// document. json.Decoder stops at the end of the JSON, so the signature after
-// it is not read.
-func parsePIA(r io.Reader) (*netipx.IPSet, error) {
-	var list struct {
-		Regions []struct {
-			Servers map[string][]struct {
-				IP string `json:"ip"`
-			} `json:"servers"`
-		} `json:"regions"`
-	}
-
-	err := json.NewDecoder(r).Decode(&list)
-	if err != nil {
-		return nil, err
-	}
-
-	var texts []string
-
-	for _, region := range list.Regions {
-		for _, servers := range region.Servers {
-			for _, server := range servers {
-				texts = append(texts, server.IP)
-			}
-		}
-	}
-
-	return addressSet(texts)
-}
-
-// parseIVPN returns the addresses of the hosts in an IVPN document. A host's
-// ipv6 object holds only an address inside the VPN, so it is not read.
-func parseIVPN(r io.Reader) (*netipx.IPSet, error) {
-	type gateway struct {
-		Hosts []struct {
-			Host  string `json:"host"`
-			V2Ray string `json:"v2ray"`
-		} `json:"hosts"`
-	}
-
-	var list struct {
-		WireGuard []gateway `json:"wireguard"`
-		OpenVPN   []gateway `json:"openvpn"`
-	}
-
-	err := readJSON(r, &list)
-	if err != nil {
-		return nil, err
-	}
-
-	var texts []string
-
-	for _, gw := range slices.Concat(list.WireGuard, list.OpenVPN) {
-		for _, host := range gw.Hosts {
-			texts = append(texts, host.Host, host.V2Ray)
-		}
-	}
-
-	return addressSet(texts)
-}
-
-// readJSON reads r to its end and decodes it, as one JSON document, into v.
-func readJSON(r io.Reader, v any) error {
-	data, err := io.ReadAll(r)
-	if err != nil {
-		return err
-	}
-
-	return json.Unmarshal(data, v)
-}
-
-// addressSet returns the set of the addresses in texts, skipping empty ones.
-// A list with no addresses fails, because every VPN service has servers.
-func addressSet(texts []string) (*netipx.IPSet, error) {
-	var builder netipx.IPSetBuilder
-
-	for _, text := range texts {
-		if text == "" {
-			continue
-		}
-
-		err := addAddress(&builder, text)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	addresses, err := builder.IPSet()
-	if err != nil {
-		return nil, err
-	}
-
-	if len(addresses.Ranges()) == 0 {
-		return nil, errNoAddresses
-	}
-
-	return addresses, nil
-}
-
-// addAddress adds an address, such as 192.0.2.1, to builder.
-func addAddress(builder *netipx.IPSetBuilder, text string) error {
-	addr, err := netip.ParseAddr(text)
-	if err != nil {
-		return err
-	}
-
-	builder.Add(addr)
-
-	return nil
-}
-
-// addAddressWithPort adds the address of text, such as 192.0.2.1:443 or
-// [2001:db8::1]:443, to builder. Onionoo allows a list of ports after the
-// address, so the part after the address is not read.
-func addAddressWithPort(builder *netipx.IPSetBuilder, text string) error {
-	host, _, err := net.SplitHostPort(text)
-	if err != nil {
-		return err
-	}
-
-	return addAddress(builder, host)
-}

internal/server/handlers.go

@@ -781,10 +781,6 @@ type IPLookupResult struct {
 
 	Flags IPLookupFlags `json:"flags"`
 
-	// VPNProviders names the VPN lists the address is on. It is empty, never
-	// nil, when there are none.
-	VPNProviders []string `json:"vpn_providers"`
-
 	// IPLists has one entry for each IP list the address is on.
 	IPLists []iplist.Listing `json:"ip_lists"`
 }
@@ -797,9 +793,6 @@ type IPLookupFlags struct {
 	// IsTor says that the address is on the Tor exit list.
 	IsTor bool `json:"is_tor"`
 
-	// IsVPN says that the address is on a list of VPN servers.
-	IsVPN bool `json:"is_vpn"`
-
 	// IsBogon says that the address is reserved, as package bogon tells.
 	IsBogon bool `json:"is_bogon"`
 }
@@ -984,30 +977,14 @@ func (s *Server) ipLookupResult(ip string, ptrs []string, info IPInfo) IPLookupR
 	listings := s.ipListListings(ip)
 
 	return IPLookupResult{
-		IP:           ip,
+		IP:      ip,
-		PTR:          ptrs,
+		PTR:     ptrs,
-		IPInfo:       info,
+		IPInfo:  info,
-		Flags:        ipLookupFlags(ip, listings),
+		Flags:   ipLookupFlags(ip, listings),
-		VPNProviders: vpnProviders(listings),
+		IPLists: listings,
-		IPLists:      listings,
 	}
 }
 
-// vpnProviders returns the names of the VPN lists among listings. It returns
-// an empty list, never nil, so that an answer's vpn_providers is [] rather
-// than null.
-func vpnProviders(listings []iplist.Listing) []string {
-	names := []string{}
-
-	for _, listing := range listings {
-		if listing.VPN {
-			names = append(names, listing.Name)
-		}
-	}
-
-	return names
-}
-
 // ipListListings returns the IP lists that contain ip. It returns an empty
 // list, never nil, so that an answer's ip_lists is [] rather than null.
 func (s *Server) ipListListings(ip string) []iplist.Listing {
@@ -1025,9 +1002,6 @@ func ipLookupFlags(ip string, listings []iplist.Listing) IPLookupFlags {
 		IsTor: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
 			return l.Name == iplist.TorExitsList
 		}),
-		IsVPN: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
-			return l.VPN
-		}),
 		IsBogon: isBogon(ip),
 	}
 }

internal/server/handlers_internal_test.go

@@ -1441,19 +1441,8 @@ const listedUnroutedAddr = "203.0.113.1"
 // torExitAddr is the address that fakeIPLists lists on the Tor exit list.
 const torExitAddr = "203.0.113.2"
 
-// The addresses that fakeIPLists lists on one and on two VPN lists, and the
+// fakeIPLists has two lists. The test list holds addrInTestPrefixV4 and
-// names of those lists.
+// listedUnroutedAddr, and the Tor exit list holds torExitAddr.
-const (
-	oneVPNListAddr  = "203.0.113.3"
-	twoVPNListsAddr = "203.0.113.4"
-	testVPNList     = "test_vpn"
-	otherTestVPN    = "other_test_vpn"
-)
-
-// fakeIPLists has four lists. The test list holds addrInTestPrefixV4,
-// listedUnroutedAddr and twoVPNListsAddr. The Tor exit list holds torExitAddr.
-// The test VPN list holds oneVPNListAddr and twoVPNListsAddr, and the other
-// test VPN list holds twoVPNListsAddr.
 type fakeIPLists struct{}
 
 func testListing() iplist.Listing {
@@ -1474,18 +1463,6 @@ func (fakeIPLists) Lookup(addr netip.Addr) []iplist.Listing {
 		return []iplist.Listing{{Name: iplist.TorExitsList}}
 	}
 
-	if addr == netip.MustParseAddr(oneVPNListAddr) {
-		return []iplist.Listing{{Name: testVPNList, VPN: true}}
-	}
-
-	if addr == netip.MustParseAddr(twoVPNListsAddr) {
-		return []iplist.Listing{
-			{Name: otherTestVPN, VPN: true},
-			testListing(),
-			{Name: testVPNList, VPN: true},
-		}
-	}
-
 	return []iplist.Listing{}
 }
 
@@ -1494,7 +1471,7 @@ func (fakeIPLists) ShortestInterval() time.Duration {
 }
 
 // TestIPLookupFlags looks up addresses with and without a route. Every result
-// has every flag, under the JSON keys the API documents.
+// has both flags, under the JSON keys the API documents.
 func TestIPLookupFlags(t *testing.T) {
 	t.Parallel()
 
@@ -1540,9 +1517,7 @@ func TestIPLookupFlags(t *testing.T) {
 				t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
 			}
 
-			want := map[string]bool{
+			want := map[string]bool{"is_tor": tt.tor, "is_bogon": tt.bogon}
-				"is_tor": tt.tor, "is_vpn": false, "is_bogon": tt.bogon,
-			}
 			if !maps.Equal(got, want) {
 				t.Errorf("%s: flags %v, want %v", path, got, want)
 			}
@@ -1550,61 +1525,6 @@ func TestIPLookupFlags(t *testing.T) {
 	}
 }
 
-// TestIPLookupReportsVPNProviders looks up addresses on no list, on a list
-// that is not a VPN list, on one VPN list and on two. is_vpn says whether any
-// VPN list holds the address, and vpn_providers names only those lists. An
-// address on none has [], not null.
-func TestIPLookupReportsVPNProviders(t *testing.T) {
-	t.Parallel()
-
-	s := newServerWithTestRoutes(t)
-	s.resolver = &fakeResolver{}
-	s.SetIPLists(fakeIPLists{})
-
-	tests := []struct {
-		name      string
-		addr      string
-		isVPN     string
-		providers string
-	}{
-		{"on no list", "1.1.1.1", "false", `[]`},
-		{"on a list that is not a VPN list", listedUnroutedAddr, "false", `[]`},
-		{"on one VPN list", oneVPNListAddr, "true", `["` + testVPNList + `"]`},
-		{
-			"on two VPN lists", twoVPNListsAddr, "true",
-			`["` + otherTestVPN + `","` + testVPNList + `"]`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			path := "/api/v1/ip/" + tt.addr
-
-			results := resultFields(t, get(t, s, path).Body.Bytes())
-			if len(results) != 1 {
-				t.Fatalf("%s: %d results, want 1", path, len(results))
-			}
-
-			var flags map[string]json.RawMessage
-
-			err := json.Unmarshal(results[0]["flags"], &flags)
-			if err != nil {
-				t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
-			}
-
-			if got := string(flags["is_vpn"]); got != tt.isVPN {
-				t.Errorf("%s: is_vpn %s, want %s", path, got, tt.isVPN)
-			}
-
-			if got := string(results[0]["vpn_providers"]); got != tt.providers {
-				t.Errorf("%s: vpn_providers %s, want %s", path, got, tt.providers)
-			}
-		})
-	}
-}
-
 // TestIPLookupReportsIPLists looks up two routed addresses, one of them on an
 // IP list. The listed address's result names the list, says what it means and
 // when it was updated. The other's result has an empty list.