clawbot
cf50d195ad
check / check (push) Failing after 10m45s
The lists are not only used for blocking, so the package, the `blocklists` field of the IP lookup answer and the state directory are now IP lists (`internal/iplist`, `ip_lists`, `iplists`). Every result gains a `flags` object with `is_tor` and `is_bogon`. The largest list file accepted is 200 MiB. Judgement call: the dated 2026-10-27 `TODO.md` entry keeps the old word. Rule suppressed: `tagliatelle` on the two result structs, for snake_case keys. Model: opus-5-5
97 lines
3.2 KiB
Go
97 lines
3.2 KiB
Go
package iplist
|
|
|
|
import "time"
|
|
|
|
// TorExitsList is the name of the list of Tor exit nodes.
|
|
const TorExitsList = "tor_exits"
|
|
|
|
// How often each list is downloaded. No list is downloaded more often than
|
|
// its publisher updates it or allows.
|
|
const (
|
|
// DShield asks that its feeds be downloaded at most once an hour:
|
|
// https://isc.sans.edu/feeds_doc.html
|
|
dshieldInterval = time.Hour
|
|
|
|
// abuse.ch makes the list every 5 minutes and recommends a download at
|
|
// least every 15: https://feodotracker.abuse.ch/blocklist/
|
|
feodoTrackerInterval = 15 * time.Minute
|
|
|
|
// FireHOL's page for each list gives how often the list changes on
|
|
// average: about every 5 hours for abusers and every 3 hours for level
|
|
// 3. FireHOL sets no download limit.
|
|
// https://iplists.firehol.org/?ipset=firehol_abusers_30d
|
|
// https://iplists.firehol.org/?ipset=firehol_level3
|
|
fireHOLAbusersInterval = 5 * time.Hour
|
|
fireHOLLevel3Interval = 3 * time.Hour
|
|
|
|
// Spamhaus asks that DROP be downloaded at most once a day:
|
|
// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
|
|
spamhausDROPInterval = 24 * time.Hour
|
|
|
|
// Tor publishes a new exit list every hour and sets no download limit:
|
|
// https://collector.torproject.org/recent/exit-lists/
|
|
torExitsInterval = time.Hour
|
|
)
|
|
|
|
// Lists returns the public IP lists routewatch downloads. Each can be
|
|
// downloaded whole without an account or a key. Spamhaus merged its EDROP
|
|
// list into DROP, so DROP covers both.
|
|
func Lists() []List {
|
|
return []List{
|
|
{
|
|
Name: "dshield",
|
|
Description: "In one of the 20 networks that DShield saw scan " +
|
|
"the most targets in the last three days",
|
|
URL: "https://feeds.dshield.org/block.txt",
|
|
Interval: dshieldInterval,
|
|
Format: FormatDShield,
|
|
},
|
|
{
|
|
Name: "feodo_tracker",
|
|
Description: "A botnet command-and-control server",
|
|
URL: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
|
|
Interval: feodoTrackerInterval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "firehol_abusers_30d",
|
|
Description: "Reported for comment, form or forum spam in the " +
|
|
"last 30 days",
|
|
URL: "https://iplists.firehol.org/files/firehol_abusers_30d.netset",
|
|
Interval: fireHOLAbusersInterval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "firehol_level3",
|
|
Description: "Reported for attacks, spyware or viruses in the " +
|
|
"last 30 days",
|
|
URL: "https://iplists.firehol.org/files/firehol_level3.netset",
|
|
Interval: fireHOLLevel3Interval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "spamhaus_drop",
|
|
Description: "In an IPv4 network that Spamhaus says spammers " +
|
|
"or cyber criminals have hijacked or lease",
|
|
URL: "https://www.spamhaus.org/drop/drop_v4.json",
|
|
Interval: spamhausDROPInterval,
|
|
Format: FormatSpamhausJSON,
|
|
},
|
|
{
|
|
Name: "spamhaus_dropv6",
|
|
Description: "In an IPv6 network that Spamhaus says spammers " +
|
|
"or cyber criminals have hijacked or lease",
|
|
URL: "https://www.spamhaus.org/drop/drop_v6.json",
|
|
Interval: spamhausDROPInterval,
|
|
Format: FormatSpamhausJSON,
|
|
},
|
|
{
|
|
Name: TorExitsList,
|
|
Description: "A Tor exit node, where traffic from the Tor network leaves",
|
|
URL: "https://check.torproject.org/torbulkexitlist",
|
|
Interval: torExitsInterval,
|
|
Format: FormatLines,
|
|
},
|
|
}
|
|
}
|