package blocklist

import "time"

// How often each list is downloaded. No list is downloaded more often than
// its publisher updates it or allows.
const (
	// DShield asks that its feeds be downloaded at most once an hour:
	// https://isc.sans.edu/feeds_doc.html
	dshieldInterval = time.Hour

	// abuse.ch makes the list every 5 minutes and recommends a download at
	// least every 15: https://feodotracker.abuse.ch/blocklist/
	feodoTrackerInterval = 15 * time.Minute

	// FireHOL's page for each list gives how often the list changes on
	// average: about every 5 hours for abusers and every 3 hours for level
	// 3. FireHOL sets no download limit.
	// https://iplists.firehol.org/?ipset=firehol_abusers_30d
	// https://iplists.firehol.org/?ipset=firehol_level3
	fireHOLAbusersInterval = 5 * time.Hour
	fireHOLLevel3Interval  = 3 * time.Hour

	// Spamhaus asks that DROP be downloaded at most once a day:
	// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
	spamhausDROPInterval = 24 * time.Hour

	// Tor publishes a new exit list every hour and sets no download limit:
	// https://collector.torproject.org/recent/exit-lists/
	torExitsInterval = time.Hour
)

// Lists returns the public blocklists routewatch downloads. Each can be
// downloaded whole without an account or a key. Spamhaus merged its EDROP
// list into DROP, so DROP covers both.
func Lists() []List {
	return []List{
		{
			Name: "dshield",
			Description: "In one of the 20 networks that DShield saw scan " +
				"the most targets in the last three days",
			URL:      "https://feeds.dshield.org/block.txt",
			Interval: dshieldInterval,
			Format:   FormatDShield,
		},
		{
			Name:        "feodo_tracker",
			Description: "A botnet command-and-control server",
			URL:         "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
			Interval:    feodoTrackerInterval,
			Format:      FormatLines,
		},
		{
			Name: "firehol_abusers_30d",
			Description: "Reported for comment, form or forum spam in the " +
				"last 30 days",
			URL:      "https://iplists.firehol.org/files/firehol_abusers_30d.netset",
			Interval: fireHOLAbusersInterval,
			Format:   FormatLines,
		},
		{
			Name: "firehol_level3",
			Description: "Reported for attacks, spyware or viruses in the " +
				"last 30 days",
			URL:      "https://iplists.firehol.org/files/firehol_level3.netset",
			Interval: fireHOLLevel3Interval,
			Format:   FormatLines,
		},
		{
			Name: "spamhaus_drop",
			Description: "In an IPv4 network that Spamhaus says spammers " +
				"or cyber criminals have hijacked or lease",
			URL:      "https://www.spamhaus.org/drop/drop_v4.json",
			Interval: spamhausDROPInterval,
			Format:   FormatSpamhausJSON,
		},
		{
			Name: "spamhaus_dropv6",
			Description: "In an IPv6 network that Spamhaus says spammers " +
				"or cyber criminals have hijacked or lease",
			URL:      "https://www.spamhaus.org/drop/drop_v6.json",
			Interval: spamhausDROPInterval,
			Format:   FormatSpamhausJSON,
		},
		{
			Name:        "tor_exits",
			Description: "A Tor exit node, where traffic from the Tor network leaves",
			URL:         "https://check.torproject.org/torbulkexitlist",
			Interval:    torExitsInterval,
			Format:      FormatLines,
		},
	}
}