Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sneak
|
cf30c7460c |
No files matched your search
@@ -285,12 +285,8 @@ address. Every entry has the same fields:
|
||||
empty list when it has none
|
||||
- `flags`: yes-or-no facts about the address:
|
||||
- `is_tor`: true when the address is on the `tor_exits` list
|
||||
- `is_vpn`: true when the address is on any list of VPN servers (see IP
|
||||
lists)
|
||||
- `is_bogon`: true when the address is reserved, so that no network should
|
||||
announce it on the internet
|
||||
- `vpn_providers`: the names of the lists of VPN servers the address is on, or
|
||||
an empty list when it is on none
|
||||
- `ip_lists`: the public IP lists the address is on (see IP lists), or an empty
|
||||
list when it is on none
|
||||
|
||||
@@ -424,27 +420,13 @@ The lists:
|
||||
last 30 days. From
|
||||
[FireHOL](https://iplists.firehol.org/?ipset=firehol_level3), downloaded every
|
||||
3 hours.
|
||||
- `ivpn`: VPN servers run by IVPN. From
|
||||
[IVPN](https://api.ivpn.net/v5/servers.json), downloaded once a day.
|
||||
- `mullvad`: VPN servers run by Mullvad. From
|
||||
[Mullvad](https://api.mullvad.net/www/relays/all/), downloaded once a day.
|
||||
- `nordvpn`: VPN servers run by NordVPN. From
|
||||
[NordVPN](https://api.nordvpn.com/v1/servers?limit=0&fields[servers.station]&fields[servers.ipv6_station]&fields[servers.hostname]),
|
||||
downloaded once a day.
|
||||
- `pia`: VPN servers run by Private Internet Access. From
|
||||
[Private Internet Access](https://serverlist.piaservers.net/vpninfo/servers/v6),
|
||||
downloaded once a day.
|
||||
- `spamhaus_drop` and `spamhaus_dropv6`: IPv4 and IPv6 networks hijacked or
|
||||
leased by spammers or cyber criminals, according to Spamhaus. From
|
||||
[Spamhaus DROP](https://www.spamhaus.org/blocklists/do-not-route-or-peer/),
|
||||
downloaded once a day.
|
||||
- `tor_exits`: the IPv4 and IPv6 addresses of Tor exit nodes, where traffic from
|
||||
the Tor network leaves. From the Tor Project's
|
||||
[Onionoo](https://metrics.torproject.org/onionoo.html) service, downloaded
|
||||
- `tor_exits`: Tor exit nodes, where traffic from the Tor network leaves. From
|
||||
the [Tor Project](https://check.torproject.org/torbulkexitlist), downloaded
|
||||
every hour.
|
||||
- `x4bnet` and `x4bnet_v6`: IPv4 and IPv6 networks of VPN services, according to
|
||||
a community list that names no service. From
|
||||
[X4BNet](https://github.com/X4BNet/lists_vpn), downloaded once a day.
|
||||
|
||||
No list is downloaded more often than its publisher updates it or allows. Each
|
||||
can be downloaded whole without an account or a key.
|
||||
|
||||
@@ -56,13 +56,6 @@ problem the run finds.
|
||||
- 2026-11-10: the tests no longer fail when a busy host stalls for several
|
||||
seconds. Most such waits are now 15 seconds. The test of the stream's idle
|
||||
timeout runs on a fake clock (closes #240)
|
||||
- 2026-11-10: the IP lookup checks the public VPN server lists of Mullvad,
|
||||
NordVPN, Private Internet Access and IVPN, and X4BNet's community list. Each
|
||||
result has `flags.is_vpn` and `vpn_providers` (closes
|
||||
https://git.eeqj.de/sneak/routewatch/issues/235).
|
||||
- 2026-11-10: `tor_exits` comes from Onionoo, so it holds IPv6 exits and
|
||||
`is_tor` is true for them (closes
|
||||
https://git.eeqj.de/sneak/routewatch/issues/234).
|
||||
- 2026-11-10: each result of the IP lookup has a `flags` object with `is_tor`
|
||||
and `is_bogon`. The public IP lists are named `ip_lists` in the answer,
|
||||
`internal/iplist` in the code and `iplists` in the state directory. A list
|
||||
|
||||
@@ -29,28 +29,6 @@ const (
|
||||
// start with the network's first and last address. Lines that start
|
||||
// with # are comments.
|
||||
FormatDShield
|
||||
|
||||
// FormatOnionooJSON is one Onionoo details document. Its relays have
|
||||
// addresses in two fields: exit_addresses, which has IPv4 only, and
|
||||
// or_addresses, which has IPv4 and IPv6, each with a port.
|
||||
FormatOnionooJSON
|
||||
|
||||
// FormatMullvadJSON is Mullvad's JSON list of relays. A relay's addresses
|
||||
// are in ipv4_addr_in, ipv6_addr_in and ipv4_v2ray.
|
||||
FormatMullvadJSON
|
||||
|
||||
// FormatNordVPNJSON is NordVPN's JSON list of servers. A server's
|
||||
// addresses are in station and ipv6_station.
|
||||
FormatNordVPNJSON
|
||||
|
||||
// FormatPIAJSON is Private Internet Access's JSON server list, then a
|
||||
// blank line and a signature. Each region's servers has lists of servers
|
||||
// by protocol, and each server has its address in ip.
|
||||
FormatPIAJSON
|
||||
|
||||
// FormatIVPNJSON is IVPN's JSON server list. The hosts of its wireguard
|
||||
// and openvpn gateways have their addresses in host and v2ray.
|
||||
FormatIVPNJSON
|
||||
)
|
||||
|
||||
// List is one public IP list.
|
||||
@@ -70,9 +48,6 @@ type List struct {
|
||||
|
||||
// Format is how the list's file is written.
|
||||
Format Format
|
||||
|
||||
// VPN says that the list holds servers of VPN services.
|
||||
VPN bool
|
||||
}
|
||||
|
||||
// Listing says that a list contains an address.
|
||||
@@ -83,10 +58,6 @@ type Listing struct {
|
||||
// Updated is when routewatch last downloaded the list, or last heard from
|
||||
// its publisher that its copy was still current.
|
||||
Updated time.Time `json:"updated"`
|
||||
|
||||
// VPN says that the list holds servers of VPN services. A lookup answer
|
||||
// reports it through is_vpn and vpn_providers.
|
||||
VPN bool `json:"-"`
|
||||
}
|
||||
|
||||
// listCopy is a list's last good copy in memory.
|
||||
@@ -153,7 +124,6 @@ func (b *IPLists) Lookup(addr netip.Addr) []Listing {
|
||||
Name: list.Name,
|
||||
Description: list.Description,
|
||||
Updated: c.updated,
|
||||
VPN: list.VPN,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -11,7 +11,6 @@ import (
|
||||
"net/netip"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"slices"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
@@ -29,50 +28,6 @@ const (
|
||||
newListBody = "# A test list\n" + newListedAddr + "\n"
|
||||
)
|
||||
|
||||
// A small Onionoo details document: a relay with an exit address and IPv4 and
|
||||
// IPv6 relay addresses, one without exit addresses, and one with a list of
|
||||
// ports.
|
||||
const (
|
||||
onionooExitAddr = "192.0.2.10"
|
||||
onionooIPv6ExitAddr = "2001:db8::1"
|
||||
onionooBody = `{"version":"8.0","relays":[
|
||||
{"exit_addresses":["` + onionooExitAddr + `"],
|
||||
"or_addresses":["192.0.2.11:443","[` + onionooIPv6ExitAddr + `]:9001"]},
|
||||
{"or_addresses":["192.0.2.20:443"]},
|
||||
{"or_addresses":["192.0.2.30:80,443"]}
|
||||
],"bridges":[]}`
|
||||
)
|
||||
|
||||
// Small documents in the VPN services' formats. PIA's and IVPN's have no
|
||||
// public IPv6 addresses, and IVPN's holds addresses that are not its servers,
|
||||
// which must not be read.
|
||||
const (
|
||||
mullvadBody = `[
|
||||
{"hostname":"a-wg-001","ipv4_addr_in":"192.0.2.40","ipv6_addr_in":"2001:db8::40"},
|
||||
{"hostname":"a-br-001","ipv4_addr_in":"192.0.2.41","ipv6_addr_in":null,
|
||||
"ipv4_v2ray":"192.0.2.42"}
|
||||
]`
|
||||
nordVPNBody = `[
|
||||
{"hostname":"a1.example.com","station":"192.0.2.50","ipv6_station":""},
|
||||
{"hostname":"a2.example.com","station":"192.0.2.51","ipv6_station":"2001:db8::51"}
|
||||
]`
|
||||
piaBody = `{"groups":{"wg":[{"name":"wireguard","ports":[1337]}]},"regions":[
|
||||
{"id":"a","servers":{
|
||||
"wg":[{"ip":"192.0.2.60","cn":"a1"}],
|
||||
"ikev2":[{"ip":"192.0.2.61","cn":"a1"}]}},
|
||||
{"id":"b","servers":{"meta":[{"ip":"192.0.2.62","cn":"b1","van":true}]}}
|
||||
]}` + "\n\nc2lnbmF0dXJl\nbGluZSB0d28=\n"
|
||||
ivpnBody = `{"wireguard":[{"gateway":"a.wg.example.com","hosts":[
|
||||
{"hostname":"a1","host":"192.0.2.70","v2ray":"192.0.2.71",
|
||||
"ipv6":{"local_ip":"2001:db8::70/96"}}]}],
|
||||
"openvpn":[{"gateway":"a.gw.example.com","hosts":[
|
||||
{"hostname":"a1","host":"192.0.2.72"}]}],
|
||||
"config":{"api":{"ips":["192.0.2.73"]}}}`
|
||||
)
|
||||
|
||||
// errorPage is a file that is no list, as a publisher's error page is.
|
||||
const errorPage = "<!DOCTYPE html>\n<html></html>\n"
|
||||
|
||||
// testETag is the ETag a publisher sends with a version of the test list.
|
||||
const testETag = `"v1"`
|
||||
|
||||
@@ -188,7 +143,13 @@ func lookup(t *testing.T, b *IPLists, addr string) []Listing {
|
||||
func TestLookupFindsListedAddresses(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
runLookupCases(t, []lookupCase{
|
||||
tests := []struct {
|
||||
name string
|
||||
format Format
|
||||
body string
|
||||
listed []string
|
||||
unlisted []string
|
||||
}{
|
||||
{
|
||||
name: "single addresses",
|
||||
format: FormatLines,
|
||||
@@ -220,70 +181,9 @@ func TestLookupFindsListedAddresses(t *testing.T) {
|
||||
listed: []string{"192.0.2.0", "192.0.2.77"},
|
||||
unlisted: []string{"192.0.3.1", "2001:db8::1"},
|
||||
},
|
||||
{
|
||||
name: "Onionoo relays",
|
||||
format: FormatOnionooJSON,
|
||||
body: onionooBody,
|
||||
listed: []string{
|
||||
onionooExitAddr, "192.0.2.11", "192.0.2.20", "192.0.2.30",
|
||||
onionooIPv6ExitAddr,
|
||||
},
|
||||
unlisted: []string{"192.0.2.12", "2001:db8::2"},
|
||||
},
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestLookupFindsVPNServers downloads a list in each VPN service's format and
|
||||
// looks up addresses on it and off it.
|
||||
func TestLookupFindsVPNServers(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
runLookupCases(t, []lookupCase{
|
||||
{
|
||||
name: "Mullvad relays",
|
||||
format: FormatMullvadJSON,
|
||||
body: mullvadBody,
|
||||
listed: []string{"192.0.2.40", "192.0.2.41", "192.0.2.42", "2001:db8::40"},
|
||||
unlisted: []string{"192.0.2.43", "2001:db8::41"},
|
||||
},
|
||||
{
|
||||
name: "NordVPN servers",
|
||||
format: FormatNordVPNJSON,
|
||||
body: nordVPNBody,
|
||||
listed: []string{"192.0.2.50", "192.0.2.51", "2001:db8::51"},
|
||||
unlisted: []string{"192.0.2.52", "2001:db8::50"},
|
||||
},
|
||||
{
|
||||
name: "PIA servers, with the signature after the JSON",
|
||||
format: FormatPIAJSON,
|
||||
body: piaBody,
|
||||
listed: []string{"192.0.2.60", "192.0.2.61", "192.0.2.62"},
|
||||
unlisted: []string{"192.0.2.63", "2001:db8::60"},
|
||||
},
|
||||
{
|
||||
name: "IVPN hosts",
|
||||
format: FormatIVPNJSON,
|
||||
body: ivpnBody,
|
||||
listed: []string{"192.0.2.70", "192.0.2.71", "192.0.2.72"},
|
||||
unlisted: []string{"192.0.2.73", "2001:db8::70"},
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// lookupCase is a list file, the addresses it holds and some it does not.
|
||||
type lookupCase struct {
|
||||
name string
|
||||
format Format
|
||||
body string
|
||||
listed []string
|
||||
unlisted []string
|
||||
}
|
||||
|
||||
// runLookupCases downloads each case's list file and checks its addresses.
|
||||
func runLookupCases(t *testing.T, cases []lookupCase) {
|
||||
t.Helper()
|
||||
|
||||
for _, tt := range cases {
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
@@ -295,34 +195,26 @@ func runLookupCases(t *testing.T, cases []lookupCase) {
|
||||
t.Fatalf("download: %v", err)
|
||||
}
|
||||
|
||||
checkLookups(t, b, tt.listed, tt.unlisted)
|
||||
for _, addr := range tt.listed {
|
||||
listings := lookup(t, b, addr)
|
||||
if len(listings) != 1 || listings[0].Name != testListName ||
|
||||
listings[0].Description != testListDescription ||
|
||||
listings[0].Updated.IsZero() {
|
||||
t.Errorf("%s: listings %+v, want one for %s", addr,
|
||||
listings, testListName)
|
||||
}
|
||||
}
|
||||
|
||||
for _, addr := range tt.unlisted {
|
||||
listings := lookup(t, b, addr)
|
||||
if listings == nil || len(listings) != 0 {
|
||||
t.Errorf("%s: listings %#v, want an empty list", addr, listings)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// checkLookups checks that each of listed has one listing that names the test
|
||||
// list, and each of unlisted has an empty list of listings.
|
||||
func checkLookups(t *testing.T, b *IPLists, listed, unlisted []string) {
|
||||
t.Helper()
|
||||
|
||||
for _, addr := range listed {
|
||||
listings := lookup(t, b, addr)
|
||||
if len(listings) != 1 || listings[0].Name != testListName ||
|
||||
listings[0].Description != testListDescription ||
|
||||
listings[0].Updated.IsZero() {
|
||||
t.Errorf("%s: listings %+v, want one for %s", addr,
|
||||
listings, testListName)
|
||||
}
|
||||
}
|
||||
|
||||
for _, addr := range unlisted {
|
||||
listings := lookup(t, b, addr)
|
||||
if listings == nil || len(listings) != 0 {
|
||||
t.Errorf("%s: listings %#v, want an empty list", addr, listings)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestFailedDownloadKeepsThePreviousCopy downloads a good version of a list,
|
||||
// then one that fails. The good copy stays in memory and on disk, and no
|
||||
// part of the failed download is left beside it.
|
||||
@@ -335,7 +227,7 @@ func TestFailedDownloadKeepsThePreviousCopy(t *testing.T) {
|
||||
body string
|
||||
}{
|
||||
{"server error", http.StatusInternalServerError, "unavailable"},
|
||||
{"not a list", http.StatusOK, errorPage},
|
||||
{"not a list", http.StatusOK, "<!DOCTYPE html>\n<html></html>\n"},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
@@ -371,164 +263,6 @@ func TestFailedDownloadKeepsThePreviousCopy(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestFileThatIsNotAnOnionooDocumentKeepsThePreviousCopy downloads a good
|
||||
// Onionoo document, then files that are not one. Each fails the parse, and
|
||||
// the good copy stays.
|
||||
func TestFileThatIsNotAnOnionooDocumentKeepsThePreviousCopy(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
body string
|
||||
}{
|
||||
{"not JSON", errorPage},
|
||||
{"other JSON", `{"status":"ok","data":{"relays_count":1}}`},
|
||||
{"JSON array", `[{"or_addresses":["192.0.2.1:443"]}]`},
|
||||
{"no relays", `{"relays":[],"bridges":[]}`},
|
||||
{"relays without addresses", `{"relays":[{"nickname":"example"}]}`},
|
||||
{"relay address without a port", `{"relays":[{"or_addresses":["192.0.2.1"]}]}`},
|
||||
{"exit address that is not one", `{"relays":[{"exit_addresses":["example"]}]}`},
|
||||
{"text after the document", `{"relays":[{"or_addresses":["192.0.2.1:1"]}]} x`},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
dir := t.TempDir()
|
||||
p, url := newPublisher(t, onionooBody)
|
||||
b := newTestIPLists(dir, testList(url, FormatOnionooJSON))
|
||||
|
||||
err := b.download(t.Context(), b.lists[0])
|
||||
if err != nil {
|
||||
t.Fatalf("first download: %v", err)
|
||||
}
|
||||
|
||||
p.answer(http.StatusOK, tt.body)
|
||||
|
||||
err = b.download(t.Context(), b.lists[0])
|
||||
if err == nil {
|
||||
t.Fatal("second download returned no error")
|
||||
}
|
||||
|
||||
if len(lookup(t, b, onionooExitAddr)) != 1 {
|
||||
t.Errorf("%s is no longer listed", onionooExitAddr)
|
||||
}
|
||||
|
||||
onDisk, err := fs.ReadFile(os.DirFS(dir), testListName)
|
||||
if err != nil || string(onDisk) != onionooBody {
|
||||
t.Errorf("copy on disk %q (%v), want the good version", onDisk, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestWrongVPNDocumentFailsToParse parses documents that are not a VPN
|
||||
// service's list. Each fails, so none can replace a good copy.
|
||||
func TestWrongVPNDocumentFailsToParse(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
formats := []struct {
|
||||
name string
|
||||
format Format
|
||||
good string
|
||||
empty string
|
||||
badAddress string
|
||||
}{
|
||||
{
|
||||
"Mullvad", FormatMullvadJSON, mullvadBody,
|
||||
`[{"hostname":"a"}]`, `[{"ipv4_addr_in":"example"}]`,
|
||||
},
|
||||
{
|
||||
"NordVPN", FormatNordVPNJSON, nordVPNBody,
|
||||
`[{"hostname":"a","station":"","ipv6_station":""}]`,
|
||||
`[{"station":"example"}]`,
|
||||
},
|
||||
{
|
||||
"PIA", FormatPIAJSON, piaBody,
|
||||
`{"regions":[{"id":"a","servers":{}}]}`,
|
||||
`{"regions":[{"servers":{"wg":[{"ip":"example"}]}}]}`,
|
||||
},
|
||||
{
|
||||
"IVPN", FormatIVPNJSON, ivpnBody,
|
||||
`{"wireguard":[{"hosts":[]}],"openvpn":[]}`,
|
||||
`{"wireguard":[{"hosts":[{"host":"example"}]}]}`,
|
||||
},
|
||||
}
|
||||
|
||||
for _, f := range formats {
|
||||
bodies := map[string]string{
|
||||
"not JSON": errorPage,
|
||||
"other JSON": `{"status":"ok","data":{"count":1}}`,
|
||||
"no addresses": f.empty,
|
||||
"bad address": f.badAddress,
|
||||
"cut off": f.good[:len(f.good)/2],
|
||||
"an empty file": "",
|
||||
}
|
||||
|
||||
for name, body := range bodies {
|
||||
t.Run(f.name+" "+name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
addresses, err := parse(strings.NewReader(body), f.format)
|
||||
if err == nil {
|
||||
t.Errorf("parse returned %v and no error", addresses.Ranges())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestLookupMarksVPNLists looks up an address on a VPN list and on another
|
||||
// list. Only the VPN list's listing says it is one.
|
||||
func TestLookupMarksVPNLists(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
_, url := newPublisher(t, goodListBody)
|
||||
vpnList := testList(url, FormatLines)
|
||||
vpnList.Name = "test_vpn_list"
|
||||
vpnList.VPN = true
|
||||
otherList := testList(url, FormatLines)
|
||||
|
||||
b := New(Params{
|
||||
Dir: t.TempDir(),
|
||||
Lists: []List{vpnList, otherList},
|
||||
Logger: slog.New(slog.DiscardHandler),
|
||||
})
|
||||
|
||||
for _, list := range b.lists {
|
||||
err := b.download(t.Context(), list)
|
||||
if err != nil {
|
||||
t.Fatalf("download of %s: %v", list.Name, err)
|
||||
}
|
||||
}
|
||||
|
||||
listings := lookup(t, b, listedAddr)
|
||||
if len(listings) != 2 || !listings[0].VPN || listings[1].VPN {
|
||||
t.Errorf("listings %+v, want the first of two marked as a VPN list",
|
||||
listings)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPublicListsMarkTheVPNLists checks which public lists are VPN lists,
|
||||
// since their names are what vpn_providers reports.
|
||||
func TestPublicListsMarkTheVPNLists(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
var got []string
|
||||
|
||||
for _, list := range Lists() {
|
||||
if list.VPN {
|
||||
got = append(got, list.Name)
|
||||
}
|
||||
}
|
||||
|
||||
want := []string{"ivpn", "mullvad", "nordvpn", "pia", "x4bnet", "x4bnet_v6"}
|
||||
if !slices.Equal(got, want) {
|
||||
t.Errorf("VPN lists %v, want %v", got, want)
|
||||
}
|
||||
}
|
||||
|
||||
// checkGoodCopyOnDisk checks that dir holds the good version of the test list
|
||||
// and no part of a failed download.
|
||||
func checkGoodCopyOnDisk(t *testing.T, dir string) {
|
||||
@@ -825,33 +559,6 @@ func TestStopCancelsADownloadInProgress(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestTorExitsListHoldsIPv6Exits downloads an Onionoo document as the public
|
||||
// Tor exit list, which is what an IPv6 address's is_tor answer comes from.
|
||||
func TestTorExitsListHoldsIPv6Exits(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
index := slices.IndexFunc(Lists(), func(list List) bool {
|
||||
return list.Name == TorExitsList
|
||||
})
|
||||
if index < 0 {
|
||||
t.Fatalf("no list named %s", TorExitsList)
|
||||
}
|
||||
|
||||
list := Lists()[index]
|
||||
_, list.URL = newPublisher(t, onionooBody)
|
||||
b := newTestIPLists(t.TempDir(), list)
|
||||
|
||||
err := b.download(t.Context(), list)
|
||||
if err != nil {
|
||||
t.Fatalf("download: %v", err)
|
||||
}
|
||||
|
||||
listings := lookup(t, b, onionooIPv6ExitAddr)
|
||||
if len(listings) != 1 || listings[0].Name != TorExitsList {
|
||||
t.Errorf("listings %+v, want one for %s", listings, TorExitsList)
|
||||
}
|
||||
}
|
||||
|
||||
// TestPublicListsAreComplete checks that every public list has what a
|
||||
// download and a lookup answer need, and a unique name.
|
||||
func TestPublicListsAreComplete(t *testing.T) {
|
||||
|
||||
@@ -1,9 +1,6 @@
|
||||
package iplist
|
||||
|
||||
import (
|
||||
"slices"
|
||||
"time"
|
||||
)
|
||||
import "time"
|
||||
|
||||
// TorExitsList is the name of the list of Tor exit nodes.
|
||||
const TorExitsList = "tor_exits"
|
||||
@@ -31,24 +28,15 @@ const (
|
||||
// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
|
||||
spamhausDROPInterval = 24 * time.Hour
|
||||
|
||||
// Onionoo's relay data follows Tor's hourly network consensus, and
|
||||
// Onionoo sets no download limit:
|
||||
// https://metrics.torproject.org/onionoo.html
|
||||
// Tor publishes a new exit list every hour and sets no download limit:
|
||||
// https://collector.torproject.org/recent/exit-lists/
|
||||
torExitsInterval = time.Hour
|
||||
|
||||
// A VPN service's servers change slowly, so once a day is enough.
|
||||
vpnListInterval = 24 * time.Hour
|
||||
)
|
||||
|
||||
// Lists returns the public IP lists routewatch downloads. Each can be
|
||||
// downloaded whole without an account or a key. Spamhaus merged its EDROP
|
||||
// list into DROP, so DROP covers both.
|
||||
func Lists() []List {
|
||||
return slices.Concat(nonVPNLists(), vpnLists())
|
||||
}
|
||||
|
||||
// nonVPNLists returns the public lists that are not lists of VPN servers.
|
||||
func nonVPNLists() []List {
|
||||
return []List{
|
||||
{
|
||||
Name: "dshield",
|
||||
@@ -100,71 +88,9 @@ func nonVPNLists() []List {
|
||||
{
|
||||
Name: TorExitsList,
|
||||
Description: "A Tor exit node, where traffic from the Tor network leaves",
|
||||
URL: "https://onionoo.torproject.org/details?" +
|
||||
"flag=Exit&running=true&fields=exit_addresses,or_addresses",
|
||||
Interval: torExitsInterval,
|
||||
Format: FormatOnionooJSON,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// vpnLists returns the public lists of VPN servers. Their names are what
|
||||
// vpn_providers reports.
|
||||
func vpnLists() []List {
|
||||
return []List{
|
||||
{
|
||||
Name: "ivpn",
|
||||
Description: "A server of the IVPN service",
|
||||
URL: "https://api.ivpn.net/v5/servers.json",
|
||||
Interval: vpnListInterval,
|
||||
Format: FormatIVPNJSON,
|
||||
VPN: true,
|
||||
},
|
||||
{
|
||||
Name: "mullvad",
|
||||
Description: "A server of the Mullvad VPN service",
|
||||
URL: "https://api.mullvad.net/www/relays/all/",
|
||||
Interval: vpnListInterval,
|
||||
Format: FormatMullvadJSON,
|
||||
VPN: true,
|
||||
},
|
||||
{
|
||||
Name: "nordvpn",
|
||||
Description: "A server of the NordVPN service",
|
||||
URL: "https://api.nordvpn.com/v1/servers?limit=0" +
|
||||
"&fields[servers.station]&fields[servers.ipv6_station]" +
|
||||
"&fields[servers.hostname]",
|
||||
Interval: vpnListInterval,
|
||||
Format: FormatNordVPNJSON,
|
||||
VPN: true,
|
||||
},
|
||||
{
|
||||
Name: "pia",
|
||||
Description: "A server of the Private Internet Access VPN service",
|
||||
URL: "https://serverlist.piaservers.net/vpninfo/servers/v6",
|
||||
Interval: vpnListInterval,
|
||||
Format: FormatPIAJSON,
|
||||
VPN: true,
|
||||
},
|
||||
{
|
||||
Name: "x4bnet",
|
||||
Description: "In an IPv4 network of a VPN service, according to " +
|
||||
"X4BNet's community list",
|
||||
URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
|
||||
"output/vpn/ipv4.txt",
|
||||
Interval: vpnListInterval,
|
||||
Format: FormatLines,
|
||||
VPN: true,
|
||||
},
|
||||
{
|
||||
Name: "x4bnet_v6",
|
||||
Description: "In an IPv6 network of a VPN service, according to " +
|
||||
"X4BNet's community list",
|
||||
URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
|
||||
"output/vpn/ipv6.txt",
|
||||
Interval: vpnListInterval,
|
||||
Format: FormatLines,
|
||||
VPN: true,
|
||||
URL: "https://check.torproject.org/torbulkexitlist",
|
||||
Interval: torExitsInterval,
|
||||
Format: FormatLines,
|
||||
},
|
||||
}
|
||||
}
|
||||
+16
-250
@@ -6,9 +6,7 @@ import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"net"
|
||||
"net/netip"
|
||||
"slices"
|
||||
"strings"
|
||||
|
||||
"go4.org/netipx"
|
||||
@@ -34,40 +32,12 @@ var (
|
||||
errUnknownFormat = errors.New("unknown list format")
|
||||
errNoNetwork = errors.New("no network on the line")
|
||||
errBadRange = errors.New("first and last address make no range")
|
||||
errNoAddresses = errors.New("no addresses in the document")
|
||||
)
|
||||
|
||||
// parse reads a list file written in format and returns the addresses it
|
||||
// holds. Anything it cannot read fails the whole file, so a file that is not
|
||||
// holds. A line it cannot read fails the whole file, so a file that is not
|
||||
// the list, such as an error page, never replaces a good copy.
|
||||
func parse(r io.Reader, format Format) (*netipx.IPSet, error) {
|
||||
switch format {
|
||||
case FormatLines:
|
||||
return parseLines(r, addAddressOrNetwork)
|
||||
case FormatSpamhausJSON:
|
||||
return parseLines(r, addSpamhausNetwork)
|
||||
case FormatDShield:
|
||||
return parseLines(r, addDShieldNetwork)
|
||||
case FormatOnionooJSON:
|
||||
return parseOnionoo(r)
|
||||
case FormatMullvadJSON:
|
||||
return parseMullvad(r)
|
||||
case FormatNordVPNJSON:
|
||||
return parseNordVPN(r)
|
||||
case FormatPIAJSON:
|
||||
return parsePIA(r)
|
||||
case FormatIVPNJSON:
|
||||
return parseIVPN(r)
|
||||
default:
|
||||
return nil, errUnknownFormat
|
||||
}
|
||||
}
|
||||
|
||||
// parseLines reads a list file line by line, skipping blank lines and
|
||||
// comments, and calls addLine with each other line.
|
||||
func parseLines(
|
||||
r io.Reader, addLine func(*netipx.IPSetBuilder, string) error,
|
||||
) (*netipx.IPSet, error) {
|
||||
var builder netipx.IPSetBuilder
|
||||
|
||||
scanner := bufio.NewScanner(r)
|
||||
@@ -78,7 +48,7 @@ func parseLines(
|
||||
continue
|
||||
}
|
||||
|
||||
err := addLine(&builder, line)
|
||||
err := addLine(&builder, line, format)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("line %d: %w", lineNumber, err)
|
||||
}
|
||||
@@ -92,6 +62,20 @@ func parseLines(
|
||||
return builder.IPSet()
|
||||
}
|
||||
|
||||
// addLine adds the address or network on one line of a list file to builder.
|
||||
func addLine(builder *netipx.IPSetBuilder, line string, format Format) error {
|
||||
switch format {
|
||||
case FormatLines:
|
||||
return addAddressOrNetwork(builder, line)
|
||||
case FormatSpamhausJSON:
|
||||
return addSpamhausNetwork(builder, line)
|
||||
case FormatDShield:
|
||||
return addDShieldNetwork(builder, line)
|
||||
default:
|
||||
return errUnknownFormat
|
||||
}
|
||||
}
|
||||
|
||||
// addAddressOrNetwork adds an address, such as 192.0.2.1, or a network, such
|
||||
// as 192.0.2.0/24, to builder.
|
||||
func addAddressOrNetwork(builder *netipx.IPSetBuilder, text string) error {
|
||||
@@ -172,221 +156,3 @@ func addDShieldNetwork(builder *netipx.IPSetBuilder, line string) error {
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// parseOnionoo returns every address in the exit_addresses and or_addresses
|
||||
// fields of the relays in an Onionoo details document. A document with no
|
||||
// addresses fails, because the Tor network always has relays.
|
||||
func parseOnionoo(r io.Reader) (*netipx.IPSet, error) {
|
||||
//nolint:tagliatelle // Onionoo's own field names
|
||||
var details struct {
|
||||
Relays []struct {
|
||||
ExitAddresses []string `json:"exit_addresses"`
|
||||
ORAddresses []string `json:"or_addresses"`
|
||||
} `json:"relays"`
|
||||
}
|
||||
|
||||
err := readJSON(r, &details)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var builder netipx.IPSetBuilder
|
||||
|
||||
for _, relay := range details.Relays {
|
||||
for _, text := range relay.ExitAddresses {
|
||||
err = addAddress(&builder, text)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
for _, text := range relay.ORAddresses {
|
||||
err = addAddressWithPort(&builder, text)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
addresses, err := builder.IPSet()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(addresses.Ranges()) == 0 {
|
||||
return nil, errNoAddresses
|
||||
}
|
||||
|
||||
return addresses, nil
|
||||
}
|
||||
|
||||
// parseMullvad returns the addresses of the relays in a Mullvad document. A
|
||||
// relay with no IPv6 address has null for it, and only bridges have
|
||||
// ipv4_v2ray.
|
||||
func parseMullvad(r io.Reader) (*netipx.IPSet, error) {
|
||||
//nolint:tagliatelle // Mullvad's own field names
|
||||
var relays []struct {
|
||||
IPv4 string `json:"ipv4_addr_in"`
|
||||
IPv6 string `json:"ipv6_addr_in"`
|
||||
IPv4V2Ray string `json:"ipv4_v2ray"`
|
||||
}
|
||||
|
||||
err := readJSON(r, &relays)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var texts []string
|
||||
|
||||
for _, relay := range relays {
|
||||
texts = append(texts, relay.IPv4, relay.IPv6, relay.IPv4V2Ray)
|
||||
}
|
||||
|
||||
return addressSet(texts)
|
||||
}
|
||||
|
||||
// parseNordVPN returns the addresses of the servers in a NordVPN document. A
|
||||
// server with no IPv6 address has an empty ipv6_station.
|
||||
func parseNordVPN(r io.Reader) (*netipx.IPSet, error) {
|
||||
//nolint:tagliatelle // NordVPN's own field names
|
||||
var servers []struct {
|
||||
Station string `json:"station"`
|
||||
IPv6Station string `json:"ipv6_station"`
|
||||
}
|
||||
|
||||
err := readJSON(r, &servers)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var texts []string
|
||||
|
||||
for _, server := range servers {
|
||||
texts = append(texts, server.Station, server.IPv6Station)
|
||||
}
|
||||
|
||||
return addressSet(texts)
|
||||
}
|
||||
|
||||
// parsePIA returns the addresses of the servers in a Private Internet Access
|
||||
// document. json.Decoder stops at the end of the JSON, so the signature after
|
||||
// it is not read.
|
||||
func parsePIA(r io.Reader) (*netipx.IPSet, error) {
|
||||
var list struct {
|
||||
Regions []struct {
|
||||
Servers map[string][]struct {
|
||||
IP string `json:"ip"`
|
||||
} `json:"servers"`
|
||||
} `json:"regions"`
|
||||
}
|
||||
|
||||
err := json.NewDecoder(r).Decode(&list)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var texts []string
|
||||
|
||||
for _, region := range list.Regions {
|
||||
for _, servers := range region.Servers {
|
||||
for _, server := range servers {
|
||||
texts = append(texts, server.IP)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return addressSet(texts)
|
||||
}
|
||||
|
||||
// parseIVPN returns the addresses of the hosts in an IVPN document. A host's
|
||||
// ipv6 object holds only an address inside the VPN, so it is not read.
|
||||
func parseIVPN(r io.Reader) (*netipx.IPSet, error) {
|
||||
type gateway struct {
|
||||
Hosts []struct {
|
||||
Host string `json:"host"`
|
||||
V2Ray string `json:"v2ray"`
|
||||
} `json:"hosts"`
|
||||
}
|
||||
|
||||
var list struct {
|
||||
WireGuard []gateway `json:"wireguard"`
|
||||
OpenVPN []gateway `json:"openvpn"`
|
||||
}
|
||||
|
||||
err := readJSON(r, &list)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var texts []string
|
||||
|
||||
for _, gw := range slices.Concat(list.WireGuard, list.OpenVPN) {
|
||||
for _, host := range gw.Hosts {
|
||||
texts = append(texts, host.Host, host.V2Ray)
|
||||
}
|
||||
}
|
||||
|
||||
return addressSet(texts)
|
||||
}
|
||||
|
||||
// readJSON reads r to its end and decodes it, as one JSON document, into v.
|
||||
func readJSON(r io.Reader, v any) error {
|
||||
data, err := io.ReadAll(r)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return json.Unmarshal(data, v)
|
||||
}
|
||||
|
||||
// addressSet returns the set of the addresses in texts, skipping empty ones.
|
||||
// A list with no addresses fails, because every VPN service has servers.
|
||||
func addressSet(texts []string) (*netipx.IPSet, error) {
|
||||
var builder netipx.IPSetBuilder
|
||||
|
||||
for _, text := range texts {
|
||||
if text == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
err := addAddress(&builder, text)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
addresses, err := builder.IPSet()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(addresses.Ranges()) == 0 {
|
||||
return nil, errNoAddresses
|
||||
}
|
||||
|
||||
return addresses, nil
|
||||
}
|
||||
|
||||
// addAddress adds an address, such as 192.0.2.1, to builder.
|
||||
func addAddress(builder *netipx.IPSetBuilder, text string) error {
|
||||
addr, err := netip.ParseAddr(text)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
builder.Add(addr)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// addAddressWithPort adds the address of text, such as 192.0.2.1:443 or
|
||||
// [2001:db8::1]:443, to builder. Onionoo allows a list of ports after the
|
||||
// address, so the part after the address is not read.
|
||||
func addAddressWithPort(builder *netipx.IPSetBuilder, text string) error {
|
||||
host, _, err := net.SplitHostPort(text)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return addAddress(builder, host)
|
||||
}
|
||||
@@ -781,10 +781,6 @@ type IPLookupResult struct {
|
||||
|
||||
Flags IPLookupFlags `json:"flags"`
|
||||
|
||||
// VPNProviders names the VPN lists the address is on. It is empty, never
|
||||
// nil, when there are none.
|
||||
VPNProviders []string `json:"vpn_providers"`
|
||||
|
||||
// IPLists has one entry for each IP list the address is on.
|
||||
IPLists []iplist.Listing `json:"ip_lists"`
|
||||
}
|
||||
@@ -797,9 +793,6 @@ type IPLookupFlags struct {
|
||||
// IsTor says that the address is on the Tor exit list.
|
||||
IsTor bool `json:"is_tor"`
|
||||
|
||||
// IsVPN says that the address is on a list of VPN servers.
|
||||
IsVPN bool `json:"is_vpn"`
|
||||
|
||||
// IsBogon says that the address is reserved, as package bogon tells.
|
||||
IsBogon bool `json:"is_bogon"`
|
||||
}
|
||||
@@ -984,30 +977,14 @@ func (s *Server) ipLookupResult(ip string, ptrs []string, info IPInfo) IPLookupR
|
||||
listings := s.ipListListings(ip)
|
||||
|
||||
return IPLookupResult{
|
||||
IP: ip,
|
||||
PTR: ptrs,
|
||||
IPInfo: info,
|
||||
Flags: ipLookupFlags(ip, listings),
|
||||
VPNProviders: vpnProviders(listings),
|
||||
IPLists: listings,
|
||||
IP: ip,
|
||||
PTR: ptrs,
|
||||
IPInfo: info,
|
||||
Flags: ipLookupFlags(ip, listings),
|
||||
IPLists: listings,
|
||||
}
|
||||
}
|
||||
|
||||
// vpnProviders returns the names of the VPN lists among listings. It returns
|
||||
// an empty list, never nil, so that an answer's vpn_providers is [] rather
|
||||
// than null.
|
||||
func vpnProviders(listings []iplist.Listing) []string {
|
||||
names := []string{}
|
||||
|
||||
for _, listing := range listings {
|
||||
if listing.VPN {
|
||||
names = append(names, listing.Name)
|
||||
}
|
||||
}
|
||||
|
||||
return names
|
||||
}
|
||||
|
||||
// ipListListings returns the IP lists that contain ip. It returns an empty
|
||||
// list, never nil, so that an answer's ip_lists is [] rather than null.
|
||||
func (s *Server) ipListListings(ip string) []iplist.Listing {
|
||||
@@ -1025,9 +1002,6 @@ func ipLookupFlags(ip string, listings []iplist.Listing) IPLookupFlags {
|
||||
IsTor: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
|
||||
return l.Name == iplist.TorExitsList
|
||||
}),
|
||||
IsVPN: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
|
||||
return l.VPN
|
||||
}),
|
||||
IsBogon: isBogon(ip),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -494,37 +494,34 @@ func TestStatsAnswerGivesConnectionDurationInSeconds(t *testing.T) {
|
||||
// TestStreamDurationsCountSeconds checks that the uptime and the connection
|
||||
// duration of a stream that connected 90 seconds ago are both 90. A stream
|
||||
// that has never connected has an uptime of 0, and one that is not connected
|
||||
// has no connection duration. The test runs in a synctest bubble, whose clock
|
||||
// is fake, so a stall on the host does not add to the 90 seconds.
|
||||
// has no connection duration.
|
||||
func TestStreamDurationsCountSeconds(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
synctest.Test(t, func(t *testing.T) {
|
||||
const connectedFor = 90 * time.Second
|
||||
const connectedFor = 90 * time.Second
|
||||
|
||||
connectedSince := time.Now().Add(-connectedFor)
|
||||
want := int64(connectedFor / time.Second)
|
||||
connectedSince := time.Now().Add(-connectedFor)
|
||||
want := int64(connectedFor / time.Second)
|
||||
|
||||
if got := uptimeSeconds(connectedSince); got != want {
|
||||
t.Errorf("uptimeSeconds = %d, want %d", got, want)
|
||||
}
|
||||
if got := uptimeSeconds(connectedSince); got != want {
|
||||
t.Errorf("uptimeSeconds = %d, want %d", got, want)
|
||||
}
|
||||
|
||||
if got := uptimeSeconds(time.Time{}); got != 0 {
|
||||
t.Errorf("uptimeSeconds before any connection = %d, want 0", got)
|
||||
}
|
||||
if got := uptimeSeconds(time.Time{}); got != 0 {
|
||||
t.Errorf("uptimeSeconds before any connection = %d, want 0", got)
|
||||
}
|
||||
|
||||
switch got := connectionDurationSeconds(true, connectedSince); {
|
||||
case got == nil:
|
||||
t.Errorf("connectionDurationSeconds = nil, want %d", want)
|
||||
case *got != want:
|
||||
t.Errorf("connectionDurationSeconds = %d, want %d", *got, want)
|
||||
}
|
||||
switch got := connectionDurationSeconds(true, connectedSince); {
|
||||
case got == nil:
|
||||
t.Errorf("connectionDurationSeconds = nil, want %d", want)
|
||||
case *got != want:
|
||||
t.Errorf("connectionDurationSeconds = %d, want %d", *got, want)
|
||||
}
|
||||
|
||||
if got := connectionDurationSeconds(false, connectedSince); got != nil {
|
||||
t.Errorf("connectionDurationSeconds while not connected = %d, want nil",
|
||||
*got)
|
||||
}
|
||||
})
|
||||
if got := connectionDurationSeconds(false, connectedSince); got != nil {
|
||||
t.Errorf("connectionDurationSeconds while not connected = %d, want nil",
|
||||
*got)
|
||||
}
|
||||
}
|
||||
|
||||
// newTestTable returns a routing table that holds a route for testPrefixV4,
|
||||
@@ -1483,19 +1480,8 @@ const listedUnroutedAddr = "203.0.113.1"
|
||||
// torExitAddr is the address that fakeIPLists lists on the Tor exit list.
|
||||
const torExitAddr = "203.0.113.2"
|
||||
|
||||
// The addresses that fakeIPLists lists on one and on two VPN lists, and the
|
||||
// names of those lists.
|
||||
const (
|
||||
oneVPNListAddr = "203.0.113.3"
|
||||
twoVPNListsAddr = "203.0.113.4"
|
||||
testVPNList = "test_vpn"
|
||||
otherTestVPN = "other_test_vpn"
|
||||
)
|
||||
|
||||
// fakeIPLists has four lists. The test list holds addrInTestPrefixV4,
|
||||
// listedUnroutedAddr and twoVPNListsAddr. The Tor exit list holds torExitAddr.
|
||||
// The test VPN list holds oneVPNListAddr and twoVPNListsAddr, and the other
|
||||
// test VPN list holds twoVPNListsAddr.
|
||||
// fakeIPLists has two lists. The test list holds addrInTestPrefixV4 and
|
||||
// listedUnroutedAddr, and the Tor exit list holds torExitAddr.
|
||||
type fakeIPLists struct{}
|
||||
|
||||
func testListing() iplist.Listing {
|
||||
@@ -1516,18 +1502,6 @@ func (fakeIPLists) Lookup(addr netip.Addr) []iplist.Listing {
|
||||
return []iplist.Listing{{Name: iplist.TorExitsList}}
|
||||
}
|
||||
|
||||
if addr == netip.MustParseAddr(oneVPNListAddr) {
|
||||
return []iplist.Listing{{Name: testVPNList, VPN: true}}
|
||||
}
|
||||
|
||||
if addr == netip.MustParseAddr(twoVPNListsAddr) {
|
||||
return []iplist.Listing{
|
||||
{Name: otherTestVPN, VPN: true},
|
||||
testListing(),
|
||||
{Name: testVPNList, VPN: true},
|
||||
}
|
||||
}
|
||||
|
||||
return []iplist.Listing{}
|
||||
}
|
||||
|
||||
@@ -1536,7 +1510,7 @@ func (fakeIPLists) ShortestInterval() time.Duration {
|
||||
}
|
||||
|
||||
// TestIPLookupFlags looks up addresses with and without a route. Every result
|
||||
// has every flag, under the JSON keys the API documents.
|
||||
// has both flags, under the JSON keys the API documents.
|
||||
func TestIPLookupFlags(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
@@ -1582,9 +1556,7 @@ func TestIPLookupFlags(t *testing.T) {
|
||||
t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
|
||||
}
|
||||
|
||||
want := map[string]bool{
|
||||
"is_tor": tt.tor, "is_vpn": false, "is_bogon": tt.bogon,
|
||||
}
|
||||
want := map[string]bool{"is_tor": tt.tor, "is_bogon": tt.bogon}
|
||||
if !maps.Equal(got, want) {
|
||||
t.Errorf("%s: flags %v, want %v", path, got, want)
|
||||
}
|
||||
@@ -1592,61 +1564,6 @@ func TestIPLookupFlags(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// TestIPLookupReportsVPNProviders looks up addresses on no list, on a list
|
||||
// that is not a VPN list, on one VPN list and on two. is_vpn says whether any
|
||||
// VPN list holds the address, and vpn_providers names only those lists. An
|
||||
// address on none has [], not null.
|
||||
func TestIPLookupReportsVPNProviders(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
s := newServerWithTestRoutes(t)
|
||||
s.resolver = &fakeResolver{}
|
||||
s.SetIPLists(fakeIPLists{})
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
addr string
|
||||
isVPN string
|
||||
providers string
|
||||
}{
|
||||
{"on no list", "1.1.1.1", "false", `[]`},
|
||||
{"on a list that is not a VPN list", listedUnroutedAddr, "false", `[]`},
|
||||
{"on one VPN list", oneVPNListAddr, "true", `["` + testVPNList + `"]`},
|
||||
{
|
||||
"on two VPN lists", twoVPNListsAddr, "true",
|
||||
`["` + otherTestVPN + `","` + testVPNList + `"]`,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
path := "/api/v1/ip/" + tt.addr
|
||||
|
||||
results := resultFields(t, get(t, s, path).Body.Bytes())
|
||||
if len(results) != 1 {
|
||||
t.Fatalf("%s: %d results, want 1", path, len(results))
|
||||
}
|
||||
|
||||
var flags map[string]json.RawMessage
|
||||
|
||||
err := json.Unmarshal(results[0]["flags"], &flags)
|
||||
if err != nil {
|
||||
t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
|
||||
}
|
||||
|
||||
if got := string(flags["is_vpn"]); got != tt.isVPN {
|
||||
t.Errorf("%s: is_vpn %s, want %s", path, got, tt.isVPN)
|
||||
}
|
||||
|
||||
if got := string(results[0]["vpn_providers"]); got != tt.providers {
|
||||
t.Errorf("%s: vpn_providers %s, want %s", path, got, tt.providers)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestIPLookupReportsIPLists looks up two routed addresses, one of them on an
|
||||
// IP list. The listed address's result names the list, says what it means and
|
||||
// when it was updated. The other's result has an empty list.
|
||||
|
||||
@@ -578,7 +578,7 @@ func TestStopBeforeMessageReachesQueues(t *testing.T) {
|
||||
func TestReconnectWhenStreamEnds(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
endResponse := pipeTransport{write: func(context.Context, io.Writer) {}}
|
||||
endResponse := func(http.ResponseWriter, *http.Request) {}
|
||||
checkReconnect(t, endResponse, streamIdleTimeout)
|
||||
}
|
||||
|
||||
@@ -590,8 +590,9 @@ func TestReconnectWhenStreamGoesIdle(t *testing.T) {
|
||||
|
||||
const idleTimeout = 50 * time.Millisecond
|
||||
|
||||
holdResponse := pipeTransport{
|
||||
write: func(ctx context.Context, _ io.Writer) { <-ctx.Done() },
|
||||
holdResponse := func(w http.ResponseWriter, r *http.Request) {
|
||||
flush(w)
|
||||
<-r.Context().Done()
|
||||
}
|
||||
checkReconnect(t, holdResponse, idleTimeout)
|
||||
}
|
||||
@@ -604,13 +605,9 @@ func TestReconnectWhenServerNeverAnswers(t *testing.T) {
|
||||
|
||||
const idleTimeout = 50 * time.Millisecond
|
||||
|
||||
neverAnswer := roundTripFunc(
|
||||
func(req *http.Request) (*http.Response, error) {
|
||||
<-req.Context().Done()
|
||||
|
||||
return nil, req.Context().Err()
|
||||
},
|
||||
)
|
||||
neverAnswer := func(_ http.ResponseWriter, r *http.Request) {
|
||||
<-r.Context().Done()
|
||||
}
|
||||
checkReconnect(t, neverAnswer, idleTimeout)
|
||||
}
|
||||
|
||||
@@ -637,13 +634,6 @@ func (p pipeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||
return &http.Response{StatusCode: http.StatusOK, Body: body}, nil
|
||||
}
|
||||
|
||||
// roundTripFunc makes a function an http.RoundTripper.
|
||||
type roundTripFunc func(*http.Request) (*http.Response, error)
|
||||
|
||||
func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||
return f(req)
|
||||
}
|
||||
|
||||
// TestStreamNotDroppedWhileLinesArrive has a response send lines well within
|
||||
// the idle timeout for several times the timeout, then end. Each line must
|
||||
// start the idle timeout over, so the stream lasts until the response ends
|
||||
@@ -864,70 +854,61 @@ func streamLines(t *testing.T, s *Streamer, lines string) {
|
||||
// line and then stays open. The streamer must come back for a second
|
||||
// response, must not be marked connected when it does, and must handle the
|
||||
// UPDATE in it.
|
||||
//
|
||||
// It runs in a synctest bubble, whose clock is fake, so a stall on the host
|
||||
// does not use up the idle timeout. The fake server gets the requests in the
|
||||
// order the streamer makes them, because no real connection carries them.
|
||||
func checkReconnect(
|
||||
t *testing.T, firstResponse http.RoundTripper, idleTimeout time.Duration,
|
||||
t *testing.T, firstResponse http.HandlerFunc, idleTimeout time.Duration,
|
||||
) {
|
||||
t.Helper()
|
||||
|
||||
const maxWait = 15 * time.Second
|
||||
|
||||
// The tracker is made outside the bubble. It starts a goroutine that never
|
||||
// returns, and a bubble waits for each of its goroutines to return.
|
||||
tracker := metrics.New()
|
||||
connectedAtReconnect := make(chan bool, 1)
|
||||
|
||||
synctest.Test(t, func(t *testing.T) {
|
||||
connectedAtReconnect := make(chan bool, 1)
|
||||
laterResponse := pipeTransport{
|
||||
write: func(ctx context.Context, w io.Writer) {
|
||||
_, _ = io.WriteString(w, updateLine)
|
||||
var requests atomic.Int32
|
||||
|
||||
<-ctx.Done()
|
||||
},
|
||||
}
|
||||
srv := httptest.NewServer(http.HandlerFunc(
|
||||
func(w http.ResponseWriter, r *http.Request) {
|
||||
if requests.Add(1) == 1 {
|
||||
firstResponse(w, r)
|
||||
|
||||
var requests atomic.Int32
|
||||
return
|
||||
}
|
||||
|
||||
s := New(logger.New(), tracker)
|
||||
s.client = &http.Client{Transport: roundTripFunc(
|
||||
func(req *http.Request) (*http.Response, error) {
|
||||
if requests.Add(1) == 1 {
|
||||
return firstResponse.RoundTrip(req)
|
||||
}
|
||||
select {
|
||||
case connectedAtReconnect <- tracker.IsConnected():
|
||||
default:
|
||||
}
|
||||
|
||||
select {
|
||||
case connectedAtReconnect <- tracker.IsConnected():
|
||||
default:
|
||||
}
|
||||
_, _ = io.WriteString(w, updateLine)
|
||||
|
||||
return laterResponse.RoundTrip(req)
|
||||
},
|
||||
)}
|
||||
s.idleTimeout = idleTimeout
|
||||
s.minBackoff = time.Millisecond
|
||||
handler := updateHandler{handled: make(chan struct{}, 1)}
|
||||
s.RegisterHandler(handler)
|
||||
flush(w)
|
||||
<-r.Context().Done()
|
||||
}))
|
||||
defer srv.Close()
|
||||
|
||||
err := s.Start(t.Context())
|
||||
if err != nil {
|
||||
t.Fatalf("Start returned error: %v", err)
|
||||
}
|
||||
defer s.Stop(t.Context())
|
||||
s := New(logger.New(), tracker)
|
||||
s.url = srv.URL
|
||||
s.idleTimeout = idleTimeout
|
||||
s.minBackoff = time.Millisecond
|
||||
handler := updateHandler{handled: make(chan struct{}, 1)}
|
||||
s.RegisterHandler(handler)
|
||||
|
||||
select {
|
||||
case <-handler.handled:
|
||||
case <-time.After(maxWait):
|
||||
t.Fatalf("no message from a second response handled within %s", maxWait)
|
||||
}
|
||||
err := s.Start(t.Context())
|
||||
if err != nil {
|
||||
t.Fatalf("Start returned error: %v", err)
|
||||
}
|
||||
defer s.Stop(t.Context())
|
||||
|
||||
if <-connectedAtReconnect {
|
||||
t.Error("streamer was still marked connected when it came back " +
|
||||
"for a second response")
|
||||
}
|
||||
})
|
||||
select {
|
||||
case <-handler.handled:
|
||||
case <-time.After(maxWait):
|
||||
t.Fatalf("no message from a second response handled within %s", maxWait)
|
||||
}
|
||||
|
||||
if <-connectedAtReconnect {
|
||||
t.Error("streamer was still marked connected when it came back " +
|
||||
"for a second response")
|
||||
}
|
||||
}
|
||||
|
||||
// settledGoroutineCount lets transient goroutines finish, then reports the
|
||||
|
||||
Reference in new issue
Block a user