clawbot
7e13f28aa0
check / check (push) Canceled after 0s
A new package, internal/blocklist, downloads seven public lists on a schedule: DShield, Feodo Tracker, FireHOL abusers and level 3, Spamhaus DROP for IPv4 and IPv6, and the Tor exit list. It keeps the last good copy of each in memory and on disk. A download sends back the Last-Modified and ETag the publisher gave for the copy, also kept on disk. Every IP lookup result carries blocklists. An address with no live route now gets a result too, without route fields, so the lookup no longer answers 404. A successful answer carries Cache-Control, private for the caller's own address. The address sets come from go4.org/netipx. Model: opus-5-5
94 lines
3.2 KiB
Go
94 lines
3.2 KiB
Go
package blocklist
|
|
|
|
import "time"
|
|
|
|
// How often each list is downloaded. No list is downloaded more often than
|
|
// its publisher updates it or allows.
|
|
const (
|
|
// DShield asks that its feeds be downloaded at most once an hour:
|
|
// https://isc.sans.edu/feeds_doc.html
|
|
dshieldInterval = time.Hour
|
|
|
|
// abuse.ch makes the list every 5 minutes and recommends a download at
|
|
// least every 15: https://feodotracker.abuse.ch/blocklist/
|
|
feodoTrackerInterval = 15 * time.Minute
|
|
|
|
// FireHOL's page for each list gives how often the list changes on
|
|
// average: about every 5 hours for abusers and every 3 hours for level
|
|
// 3. FireHOL sets no download limit.
|
|
// https://iplists.firehol.org/?ipset=firehol_abusers_30d
|
|
// https://iplists.firehol.org/?ipset=firehol_level3
|
|
fireHOLAbusersInterval = 5 * time.Hour
|
|
fireHOLLevel3Interval = 3 * time.Hour
|
|
|
|
// Spamhaus asks that DROP be downloaded at most once a day:
|
|
// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
|
|
spamhausDROPInterval = 24 * time.Hour
|
|
|
|
// Tor publishes a new exit list every hour and sets no download limit:
|
|
// https://collector.torproject.org/recent/exit-lists/
|
|
torExitsInterval = time.Hour
|
|
)
|
|
|
|
// Lists returns the public blocklists routewatch downloads. Each can be
|
|
// downloaded whole without an account or a key. Spamhaus merged its EDROP
|
|
// list into DROP, so DROP covers both.
|
|
func Lists() []List {
|
|
return []List{
|
|
{
|
|
Name: "dshield",
|
|
Description: "In one of the 20 networks that DShield saw scan " +
|
|
"the most targets in the last three days",
|
|
URL: "https://feeds.dshield.org/block.txt",
|
|
Interval: dshieldInterval,
|
|
Format: FormatDShield,
|
|
},
|
|
{
|
|
Name: "feodo_tracker",
|
|
Description: "A botnet command-and-control server",
|
|
URL: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
|
|
Interval: feodoTrackerInterval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "firehol_abusers_30d",
|
|
Description: "Reported for comment, form or forum spam in the " +
|
|
"last 30 days",
|
|
URL: "https://iplists.firehol.org/files/firehol_abusers_30d.netset",
|
|
Interval: fireHOLAbusersInterval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "firehol_level3",
|
|
Description: "Reported for attacks, spyware or viruses in the " +
|
|
"last 30 days",
|
|
URL: "https://iplists.firehol.org/files/firehol_level3.netset",
|
|
Interval: fireHOLLevel3Interval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "spamhaus_drop",
|
|
Description: "In an IPv4 network that Spamhaus says spammers " +
|
|
"or cyber criminals have hijacked or lease",
|
|
URL: "https://www.spamhaus.org/drop/drop_v4.json",
|
|
Interval: spamhausDROPInterval,
|
|
Format: FormatSpamhausJSON,
|
|
},
|
|
{
|
|
Name: "spamhaus_dropv6",
|
|
Description: "In an IPv6 network that Spamhaus says spammers " +
|
|
"or cyber criminals have hijacked or lease",
|
|
URL: "https://www.spamhaus.org/drop/drop_v6.json",
|
|
Interval: spamhausDROPInterval,
|
|
Format: FormatSpamhausJSON,
|
|
},
|
|
{
|
|
Name: "tor_exits",
|
|
Description: "A Tor exit node, where traffic from the Tor network leaves",
|
|
URL: "https://check.torproject.org/torbulkexitlist",
|
|
Interval: torExitsInterval,
|
|
Format: FormatLines,
|
|
},
|
|
}
|
|
}
|