Adds two VPN lists for #236, each downloaded once a day and shown in flags.is_vpn and vpn_providers with no other change:
protonvpn: ProtonVPN's /24 networks, IPv4 only.
protonvpn_entry: its servers' IPv4 and IPv6 addresses.
Source. Proton's own /vpn/logicals answers 401 "Invalid access token" with a current client's x-pm-appversion, on api.protonvpn.ch and vpn-api.proton.me. It needs a logged-in session. The list comes instead from the public mirror https://github.com/tn3w/ProtonVPN-IPs (updated daily). No request header is needed, so the issue's header constant does not apply.
Parser.FormatProtonVPN reads lines as FormatLines does, but a file with no addresses or networks fails, so an empty list cannot replace a good copy.
Disclosures:
Judgement call: protonvpn uses the mirror's /24 file, not its 631 exact exit addresses, because sneak said coverage matters more than attribution (#203 (comment)). Neighbouring addresses in those networks are listed too. Switching costs one URL.
Unverified: the mirror's README says traffic leaves from unpublished addresses in those /24s. Checking that needs a connection through Proton. Its data does show ExitIP equal to EntryIP on every server.
Risk: the mirror is one person's repository, built from their Proton session. If it stops updating, downloads keep succeeding with old data.
Tried: an anonymous session from Proton's /auth/v4/sessions gets 403 "Access token does not have sufficient scope" from /vpn/logicals (#247 (comment)), so Proton's own list needs a logged-in session.
Model: opus-5-5
Adds two VPN lists for https://git.eeqj.de/sneak/routewatch/issues/236, each downloaded once a day and shown in `flags.is_vpn` and `vpn_providers` with no other change:
- `protonvpn`: ProtonVPN's /24 networks, IPv4 only.
- `protonvpn_entry`: its servers' IPv4 and IPv6 addresses.
**Source.** Proton's own `/vpn/logicals` answers 401 "Invalid access token" with a current client's `x-pm-appversion`, on `api.protonvpn.ch` and `vpn-api.proton.me`. It needs a logged-in session. The list comes instead from the public mirror https://github.com/tn3w/ProtonVPN-IPs (updated daily). No request header is needed, so the issue's header constant does not apply.
**Real download.** A plain GET of https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_ip_ranges.txt parsed to 305 /24 networks, 78,080 addresses. A plain GET of https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_entry_ips.txt, the list `protonvpn_entry`, parsed to 983 addresses: 669 IPv4 and 314 IPv6.
**Parser.** `FormatProtonVPN` reads lines as `FormatLines` does, but a file with no addresses or networks fails, so an empty list cannot replace a good copy.
Disclosures:
- Judgement call: `protonvpn` uses the mirror's /24 file, not its 631 exact exit addresses, because sneak said coverage matters more than attribution (https://git.eeqj.de/sneak/routewatch/issues/203#issuecomment-165190). Neighbouring addresses in those networks are listed too. Switching costs one URL.
- Unverified: the mirror's README says traffic leaves from unpublished addresses in those /24s. Checking that needs a connection through Proton. Its data does show `ExitIP` equal to `EntryIP` on every server.
- Risk: the mirror is one person's repository, built from their Proton session. If it stops updating, downloads keep succeeding with old data.
- Tried: an anonymous session from Proton's `/auth/v4/sessions` gets 403 "Access token does not have sufficient scope" from `/vpn/logicals` (https://git.eeqj.de/sneak/routewatch/pulls/247#issuecomment-174132), so Proton's own list needs a logged-in session.
Model: opus-5-5
internal/iplist/lists.go:155, README.md:437: the protonvpn list holds no IPv6 address, and neither the PR body nor the README says so. protonvpn_ip_ranges.txt is IPv4 only, so a lookup of a ProtonVPN server's IPv6 address answers is_vpn: false and leaves protonvpn out of vpn_providers. 247 of the 526 server hostnames in the mirror's protonvpn_logicals.json have IPv6 addresses in DNS, and the same mirror publishes 314 IPv6 server addresses in protonvpn_entry_ips.txt. Reading taken: the issue asks for "the ProtonVPN server addresses", and sneak's answer at #203 (comment) puts coverage first and accepts moving tor_exits to a source with IPv6. Change:
Add a second entry to vpnLists(): Name: "protonvpn_entry", URL https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_entry_ips.txt, Interval: vpnListInterval, Format: FormatProtonVPN, VPN: true.
In internal/iplist/iplist.go:55, say "one address or network per line", since that file holds addresses.
Add protonvpn_entry to want in TestPublicListsMarkTheVPNLists, and add a case with an IPv6 documentation address to TestLookupFindsVPNServers.
Add the list to the README, saying it holds the servers' IPv4 and IPv6 addresses.
Add the new URL and its address count to the PR body's real-download line.
README.md:437: "The whole /24 is listed because ProtonVPN traffic can leave from an address Proton does not publish." states as fact what the PR body marks unverified. Its only source is the mirror's README, which the comment at internal/iplist/lists.go:152 already names. Replace it with: "The whole /24 is listed because the ProtonVPN-IPs README says traffic leaves from unpublished addresses in it."
Model: opus-5-5
FAIL: `needs-rework`.
1. `internal/iplist/lists.go:155`, `README.md:437`: the `protonvpn` list holds no IPv6 address, and neither the PR body nor the README says so. `protonvpn_ip_ranges.txt` is IPv4 only, so a lookup of a ProtonVPN server's IPv6 address answers `is_vpn: false` and leaves `protonvpn` out of `vpn_providers`. 247 of the 526 server hostnames in the mirror's `protonvpn_logicals.json` have IPv6 addresses in DNS, and the same mirror publishes 314 IPv6 server addresses in `protonvpn_entry_ips.txt`. Reading taken: the issue asks for "the ProtonVPN server addresses", and sneak's answer at https://git.eeqj.de/sneak/routewatch/issues/203#issuecomment-165190 puts coverage first and accepts moving `tor_exits` to a source with IPv6. Change:
- Add a second entry to `vpnLists()`: `Name: "protonvpn_entry"`, URL `https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_entry_ips.txt`, `Interval: vpnListInterval`, `Format: FormatProtonVPN`, `VPN: true`.
- In `internal/iplist/iplist.go:55`, say "one address or network per line", since that file holds addresses.
- Add `protonvpn_entry` to `want` in `TestPublicListsMarkTheVPNLists`, and add a case with an IPv6 documentation address to `TestLookupFindsVPNServers`.
- Add the list to the README, saying it holds the servers' IPv4 and IPv6 addresses.
- Add the new URL and its address count to the PR body's real-download line.
2. `README.md:437`: "The whole /24 is listed because ProtonVPN traffic can leave from an address Proton does not publish." states as fact what the PR body marks unverified. Its only source is the mirror's README, which the comment at `internal/iplist/lists.go:152` already names. Replace it with: "The whole /24 is listed because the ProtonVPN-IPs README says traffic leaves from unpublished addresses in it."
Model: opus-5-5
For the reworker: make the two changes in #247 (comment) exactly as given, and nothing else. Rebase onto current next last, keeping every TODO.md entry.
Model: opus-5-5
For the reworker: make the two changes in https://git.eeqj.de/sneak/routewatch/pulls/247#issuecomment-174070 exactly as given, and nothing else. Rebase onto current `next` last, keeping every `TODO.md` entry.
Model: opus-5-5
Done as listed. protonvpn_entry has the Description "A server of the ProtonVPN service", which the finding did not give, and the commit message now names both lists.
Done with the given sentence.
Rebased onto next at 641798b, with every TODO.md entry kept.
Left unchanged as instructed, but out of date after point 1: the opening and the judgement-call bullet ("not its 631 exact addresses") of the PR body, the "no networks" wording in the same body's Parser line, and "no networks" in the comments on FormatProtonVPN and parseProtonVPN, since protonvpn_entry_ips.txt holds only addresses.
Model: opus-5-5
1. Done as listed. `protonvpn_entry` has the `Description` "A server of the ProtonVPN service", which the finding did not give, and the commit message now names both lists.
2. Done with the given sentence.
3. Rebased onto `next` at `641798b`, with every `TODO.md` entry kept.
Left unchanged as instructed, but out of date after point 1: the opening and the judgement-call bullet ("not its 631 exact addresses") of the PR body, the "no networks" wording in the same body's **Parser** line, and "no networks" in the comments on `FormatProtonVPN` and `parseProtonVPN`, since `protonvpn_entry_ips.txt` holds only addresses.
Model: opus-5-5
For the reworker: fix the wording your last comment listed as out of date (#247 (comment)): the "no networks" comments on FormatProtonVPN and parseProtonVPN, which should say addresses or networks, and the PR body's opening, judgement-call bullet and Parser line. Nothing else changes. Rebase onto current next if it has moved.
Model: opus-5-5
For the reworker: fix the wording your last comment listed as out of date (https://git.eeqj.de/sneak/routewatch/pulls/247#issuecomment-174109): the "no networks" comments on `FormatProtonVPN` and `parseProtonVPN`, which should say addresses or networks, and the PR body's opening, judgement-call bullet and **Parser** line. Nothing else changes. Rebase onto current `next` if it has moved.
Model: opus-5-5
parseProtonVPN comment: done, including its first sentence, which also said only networks.
PR body opening: done; it names both lists.
Judgement-call bullet: done; it now applies the choice to protonvpn, calls the 631 exit addresses (protonvpn_ips.txt, not downloaded), and links sneak's words.
Parser line: done.
Rebase: not needed; next is still at 641798b.
Left unchanged as instructed, but out of date since protonvpn_entry was added: the PR title and the TODO.md entry, which name only the networks.
Model: opus-5-5
1. `FormatProtonVPN` comment: done.
2. `parseProtonVPN` comment: done, including its first sentence, which also said only networks.
3. PR body opening: done; it names both lists.
4. Judgement-call bullet: done; it now applies the choice to `protonvpn`, calls the 631 exit addresses (`protonvpn_ips.txt`, not downloaded), and links sneak's words.
5. **Parser** line: done.
6. Rebase: not needed; `next` is still at `641798b`.
Left unchanged as instructed, but out of date since `protonvpn_entry` was added: the PR title and the `TODO.md` entry, which name only the networks.
Model: opus-5-5
TODO.md:56: the Completed Steps entry names only the protonvpn list, but this change also adds protonvpn_entry. Name both: the protonvpn list of ProtonVPN's /24 networks and the protonvpn_entry list of its servers' IPv4 and IPv6 addresses.
PR title: it says only "server networks" and has no closing reference, and a squash merge can take its subject from the title. Set it to the commit's subject: Add the ProtonVPN server networks and addresses to the IP lookup (closes #236).
internal/iplist/lists.go:158 and internal/iplist/lists.go:167: the string https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/ appears twice, and AGENTS.md requires a named constant for a repeated string. Add one constant at the top of the file and use it in both lists. Leave the x4bnet URLs as they are.
Disclosures:
Judgement call, not failed: a ProtonVPN IPv4 server address reports both protonvpn and protonvpn_entry in vpn_providers, which matches the README's definition of that field as list names.
Unverified item closed: the PR body's "Not tried" bullet is now answered. An anonymous session from Proton's /auth/v4/sessions gets 403 "Access token does not have sufficient scope" from /vpn/logicals, so the list does need a logged-in session.
Model: opus-5-5
FAIL: `needs-rework`.
1. `TODO.md:56`: the Completed Steps entry names only the `protonvpn` list, but this change also adds `protonvpn_entry`. Name both: the `protonvpn` list of ProtonVPN's /24 networks and the `protonvpn_entry` list of its servers' IPv4 and IPv6 addresses.
2. PR title: it says only "server networks" and has no closing reference, and a squash merge can take its subject from the title. Set it to the commit's subject: `Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)`.
3. `internal/iplist/lists.go:158` and `internal/iplist/lists.go:167`: the string `https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/` appears twice, and `AGENTS.md` requires a named constant for a repeated string. Add one constant at the top of the file and use it in both lists. Leave the `x4bnet` URLs as they are.
Disclosures:
- Judgement call, not failed: a ProtonVPN IPv4 server address reports both `protonvpn` and `protonvpn_entry` in `vpn_providers`, which matches the README's definition of that field as list names.
- Unverified item closed: the PR body's "Not tried" bullet is now answered. An anonymous session from Proton's `/auth/v4/sessions` gets 403 "Access token does not have sufficient scope" from `/vpn/logicals`, so the list does need a logged-in session.
Model: opus-5-5
clawbot
changed title from Add the ProtonVPN server networks to the IP lookup to Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)2026-11-10 13:30:59 +01:00
For the reworker: make changes 1 and 3 in #247 (comment) exactly as given, and nothing else. Change 2, the PR title, is done. In the PR body, replace the "Not tried" bullet with that comment's result: an anonymous session gets 403 from /vpn/logicals, so Proton's own list needs a logged-in session. Rebase onto current next if it has moved.
Model: opus-5-5
For the reworker: make changes 1 and 3 in https://git.eeqj.de/sneak/routewatch/pulls/247#issuecomment-174132 exactly as given, and nothing else. Change 2, the PR title, is done. In the PR body, replace the "Not tried" bullet with that comment's result: an anonymous session gets 403 from `/vpn/logicals`, so Proton's own list needs a logged-in session. Rebase onto current `next` if it has moved.
Model: opus-5-5
Change 3, repeated URL: done; the constant is protonVPNIPsURL.
PR body, "Not tried" bullet: replaced with the result from #247 (comment), which I did not re-run.
Rebase: not needed; next is still at 641798b.
Model: opus-5-5
- Change 1, `TODO.md` entry: done.
- Change 3, repeated URL: done; the constant is `protonVPNIPsURL`.
- PR body, "Not tried" bullet: replaced with the result from https://git.eeqj.de/sneak/routewatch/pulls/247#issuecomment-174132, which I did not re-run.
- Rebase: not needed; `next` is still at `641798b`.
Model: opus-5-5
For the reviewer: a conflict with next confined to TODO.md is not a finding. Rebase locally and judge the code; it is rebased after a pass.
Model: opus-5-5
For the reviewer: a conflict with `next` confined to `TODO.md` is not a finding. Rebase locally and judge the code; it is rebased after a pass.
Model: opus-5-5
PASS: the protonvpn and protonvpn_entry lists meet the definition of done in #236 and the repo's policies.
Model: opus-5-5
PASS: the `protonvpn` and `protonvpn_entry` lists meet the definition of done in https://git.eeqj.de/sneak/routewatch/issues/236 and the repo's policies.
Model: opus-5-5
For the reworker: the review passed. Rebase onto current next, keeping every TODO.md entry and this PR's first, re-run make check, push, and change nothing else.
Model: opus-5-5
For the reworker: the review passed. Rebase onto current `next`, keeping every `TODO.md` entry and this PR's first, re-run `make check`, push, and change nothing else.
Model: opus-5-5
Adds the VPN lists `protonvpn`, the servers' /24 networks, IPv4 only, and `protonvpn_entry`, the servers' IPv4 and IPv6 addresses. Each is downloaded once a day and shows in `flags.is_vpn` and `vpn_providers` with no other change.
Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so both come from the public ProtonVPN-IPs mirror. No request header is needed.
Judgement call: the mirror's /24 file as well as its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.
Model: opus-5-5
Rebase: done, onto next at 0cbd9cd; the only conflict was in TODO.md.
TODO.md: every entry kept, this PR's first.
Push: done; the branch is at e2707b5.
Nothing else changed: the commit message and the code are as reviewed.
Model: opus-5-5
- Rebase: done, onto `next` at `0cbd9cd`; the only conflict was in `TODO.md`.
- `TODO.md`: every entry kept, this PR's first.
- Push: done; the branch is at `e2707b5`.
- Nothing else changed: the commit message and the code are as reviewed.
Model: opus-5-5
clawbot
merged commit b2553f044d into next2026-11-10 14:14:06 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds two VPN lists for #236, each downloaded once a day and shown in
flags.is_vpnandvpn_providerswith no other change:protonvpn: ProtonVPN's /24 networks, IPv4 only.protonvpn_entry: its servers' IPv4 and IPv6 addresses.Source. Proton's own
/vpn/logicalsanswers 401 "Invalid access token" with a current client'sx-pm-appversion, onapi.protonvpn.chandvpn-api.proton.me. It needs a logged-in session. The list comes instead from the public mirror https://github.com/tn3w/ProtonVPN-IPs (updated daily). No request header is needed, so the issue's header constant does not apply.Real download. A plain GET of https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_ip_ranges.txt parsed to 305 /24 networks, 78,080 addresses. A plain GET of https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_entry_ips.txt, the list
protonvpn_entry, parsed to 983 addresses: 669 IPv4 and 314 IPv6.Parser.
FormatProtonVPNreads lines asFormatLinesdoes, but a file with no addresses or networks fails, so an empty list cannot replace a good copy.Disclosures:
protonvpnuses the mirror's /24 file, not its 631 exact exit addresses, because sneak said coverage matters more than attribution (#203 (comment)). Neighbouring addresses in those networks are listed too. Switching costs one URL.ExitIPequal toEntryIPon every server./auth/v4/sessionsgets 403 "Access token does not have sufficient scope" from/vpn/logicals(#247 (comment)), so Proton's own list needs a logged-in session.Model: opus-5-5
FAIL:
needs-rework.internal/iplist/lists.go:155,README.md:437: theprotonvpnlist holds no IPv6 address, and neither the PR body nor the README says so.protonvpn_ip_ranges.txtis IPv4 only, so a lookup of a ProtonVPN server's IPv6 address answersis_vpn: falseand leavesprotonvpnout ofvpn_providers. 247 of the 526 server hostnames in the mirror'sprotonvpn_logicals.jsonhave IPv6 addresses in DNS, and the same mirror publishes 314 IPv6 server addresses inprotonvpn_entry_ips.txt. Reading taken: the issue asks for "the ProtonVPN server addresses", and sneak's answer at #203 (comment) puts coverage first and accepts movingtor_exitsto a source with IPv6. Change:vpnLists():Name: "protonvpn_entry", URLhttps://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/protonvpn_entry_ips.txt,Interval: vpnListInterval,Format: FormatProtonVPN,VPN: true.internal/iplist/iplist.go:55, say "one address or network per line", since that file holds addresses.protonvpn_entrytowantinTestPublicListsMarkTheVPNLists, and add a case with an IPv6 documentation address toTestLookupFindsVPNServers.README.md:437: "The whole /24 is listed because ProtonVPN traffic can leave from an address Proton does not publish." states as fact what the PR body marks unverified. Its only source is the mirror's README, which the comment atinternal/iplist/lists.go:152already names. Replace it with: "The whole /24 is listed because the ProtonVPN-IPs README says traffic leaves from unpublished addresses in it."Model: opus-5-5
For the reworker: make the two changes in #247 (comment) exactly as given, and nothing else. Rebase onto current
nextlast, keeping everyTODO.mdentry.Model: opus-5-5
5713e6e181to48569a7f5148569a7f51toc3fc15ed80protonvpn_entryhas theDescription"A server of the ProtonVPN service", which the finding did not give, and the commit message now names both lists.nextat641798b, with everyTODO.mdentry kept.Left unchanged as instructed, but out of date after point 1: the opening and the judgement-call bullet ("not its 631 exact addresses") of the PR body, the "no networks" wording in the same body's Parser line, and "no networks" in the comments on
FormatProtonVPNandparseProtonVPN, sinceprotonvpn_entry_ips.txtholds only addresses.Model: opus-5-5
For the reworker: fix the wording your last comment listed as out of date (#247 (comment)): the "no networks" comments on
FormatProtonVPNandparseProtonVPN, which should say addresses or networks, and the PR body's opening, judgement-call bullet and Parser line. Nothing else changes. Rebase onto currentnextif it has moved.Model: opus-5-5
c3fc15ed80toc149de1d9aFormatProtonVPNcomment: done.parseProtonVPNcomment: done, including its first sentence, which also said only networks.protonvpn, calls the 631 exit addresses (protonvpn_ips.txt, not downloaded), and links sneak's words.nextis still at641798b.Left unchanged as instructed, but out of date since
protonvpn_entrywas added: the PR title and theTODO.mdentry, which name only the networks.Model: opus-5-5
FAIL:
needs-rework.TODO.md:56: the Completed Steps entry names only theprotonvpnlist, but this change also addsprotonvpn_entry. Name both: theprotonvpnlist of ProtonVPN's /24 networks and theprotonvpn_entrylist of its servers' IPv4 and IPv6 addresses.Add the ProtonVPN server networks and addresses to the IP lookup (closes #236).internal/iplist/lists.go:158andinternal/iplist/lists.go:167: the stringhttps://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/appears twice, andAGENTS.mdrequires a named constant for a repeated string. Add one constant at the top of the file and use it in both lists. Leave thex4bnetURLs as they are.Disclosures:
protonvpnandprotonvpn_entryinvpn_providers, which matches the README's definition of that field as list names./auth/v4/sessionsgets 403 "Access token does not have sufficient scope" from/vpn/logicals, so the list does need a logged-in session.Model: opus-5-5
Add the ProtonVPN server networks to the IP lookupto Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)For the reworker: make changes 1 and 3 in #247 (comment) exactly as given, and nothing else. Change 2, the PR title, is done. In the PR body, replace the "Not tried" bullet with that comment's result: an anonymous session gets 403 from
/vpn/logicals, so Proton's own list needs a logged-in session. Rebase onto currentnextif it has moved.Model: opus-5-5
c149de1d9atoeea0382b37TODO.mdentry: done.protonVPNIPsURL.nextis still at641798b.Model: opus-5-5
For the reviewer: a conflict with
nextconfined toTODO.mdis not a finding. Rebase locally and judge the code; it is rebased after a pass.Model: opus-5-5
PASS: the
protonvpnandprotonvpn_entrylists meet the definition of done in #236 and the repo's policies.Model: opus-5-5
For the reworker: the review passed. Rebase onto current
next, keeping everyTODO.mdentry and this PR's first, re-runmake check, push, and change nothing else.Model: opus-5-5
eea0382b37toe2707b5e41nextat0cbd9cd; the only conflict was inTODO.md.TODO.md: every entry kept, this PR's first.e2707b5.Model: opus-5-5