sneak
841262a6bf
check / check (push) Failing after 7m24s
`icloud_private_relay` is Apple's list of Private Relay networks, downloaded once a day. Every result gains `flags.is_relay`. `parseProtonVPN` becomes `parseLinesNotEmpty`, shared with the new parser, which reads only each line's first column. Judgement call: a line with no comma fails the parse, so a plain list of networks at Apple's URL cannot replace a good copy. Model: opus-5-5
210 lines
6.8 KiB
Go
210 lines
6.8 KiB
Go
package iplist
|
|
|
|
import (
|
|
"slices"
|
|
"time"
|
|
)
|
|
|
|
// TorExitsList is the name of the list of Tor exit nodes.
|
|
const TorExitsList = "tor_exits"
|
|
|
|
// ICloudPrivateRelayList is the name of the list of iCloud Private Relay's
|
|
// networks.
|
|
const ICloudPrivateRelayList = "icloud_private_relay"
|
|
|
|
// protonVPNIPsURL is where the ProtonVPN-IPs mirror publishes its files.
|
|
const protonVPNIPsURL = "https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/"
|
|
|
|
// How often each list is downloaded. No list is downloaded more often than
|
|
// its publisher updates it or allows.
|
|
const (
|
|
// DShield asks that its feeds be downloaded at most once an hour:
|
|
// https://isc.sans.edu/feeds_doc.html
|
|
dshieldInterval = time.Hour
|
|
|
|
// abuse.ch makes the list every 5 minutes and recommends a download at
|
|
// least every 15: https://feodotracker.abuse.ch/blocklist/
|
|
feodoTrackerInterval = 15 * time.Minute
|
|
|
|
// FireHOL's page for each list gives how often the list changes on
|
|
// average: about every 5 hours for abusers and every 3 hours for level
|
|
// 3. FireHOL sets no download limit.
|
|
// https://iplists.firehol.org/?ipset=firehol_abusers_30d
|
|
// https://iplists.firehol.org/?ipset=firehol_level3
|
|
fireHOLAbusersInterval = 5 * time.Hour
|
|
fireHOLLevel3Interval = 3 * time.Hour
|
|
|
|
// Apple's iCloud Private Relay file is 12 MB, so once a day.
|
|
iCloudPrivateRelayInterval = 24 * time.Hour
|
|
|
|
// Spamhaus asks that DROP be downloaded at most once a day:
|
|
// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
|
|
spamhausDROPInterval = 24 * time.Hour
|
|
|
|
// Onionoo's relay data follows Tor's hourly network consensus, and
|
|
// Onionoo sets no download limit:
|
|
// https://metrics.torproject.org/onionoo.html
|
|
torExitsInterval = time.Hour
|
|
|
|
// A VPN service's servers change slowly, so once a day is enough.
|
|
vpnListInterval = 24 * time.Hour
|
|
)
|
|
|
|
// Lists returns the public IP lists routewatch downloads. Each can be
|
|
// downloaded whole without an account or a key. Spamhaus merged its EDROP
|
|
// list into DROP, so DROP covers both.
|
|
func Lists() []List {
|
|
return slices.Concat(nonVPNLists(), vpnLists())
|
|
}
|
|
|
|
// nonVPNLists returns the public lists that are not lists of VPN servers.
|
|
func nonVPNLists() []List {
|
|
return []List{
|
|
{
|
|
Name: "dshield",
|
|
Description: "In one of the 20 networks that DShield saw scan " +
|
|
"the most targets in the last three days",
|
|
URL: "https://feeds.dshield.org/block.txt",
|
|
Interval: dshieldInterval,
|
|
Format: FormatDShield,
|
|
},
|
|
{
|
|
Name: "feodo_tracker",
|
|
Description: "A botnet command-and-control server",
|
|
URL: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
|
|
Interval: feodoTrackerInterval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "firehol_abusers_30d",
|
|
Description: "Reported for comment, form or forum spam in the " +
|
|
"last 30 days",
|
|
URL: "https://iplists.firehol.org/files/firehol_abusers_30d.netset",
|
|
Interval: fireHOLAbusersInterval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: "firehol_level3",
|
|
Description: "Reported for attacks, spyware or viruses in the " +
|
|
"last 30 days",
|
|
URL: "https://iplists.firehol.org/files/firehol_level3.netset",
|
|
Interval: fireHOLLevel3Interval,
|
|
Format: FormatLines,
|
|
},
|
|
{
|
|
Name: ICloudPrivateRelayList,
|
|
Description: "In a network where iCloud Private Relay traffic leaves",
|
|
URL: "https://mask-api.icloud.com/egress-ip-ranges.csv",
|
|
Interval: iCloudPrivateRelayInterval,
|
|
Format: FormatICloudPrivateRelayCSV,
|
|
},
|
|
{
|
|
Name: "spamhaus_drop",
|
|
Description: "In an IPv4 network that Spamhaus says spammers " +
|
|
"or cyber criminals have hijacked or lease",
|
|
URL: "https://www.spamhaus.org/drop/drop_v4.json",
|
|
Interval: spamhausDROPInterval,
|
|
Format: FormatSpamhausJSON,
|
|
},
|
|
{
|
|
Name: "spamhaus_dropv6",
|
|
Description: "In an IPv6 network that Spamhaus says spammers " +
|
|
"or cyber criminals have hijacked or lease",
|
|
URL: "https://www.spamhaus.org/drop/drop_v6.json",
|
|
Interval: spamhausDROPInterval,
|
|
Format: FormatSpamhausJSON,
|
|
},
|
|
{
|
|
Name: TorExitsList,
|
|
Description: "A Tor exit node, where traffic from the Tor network leaves",
|
|
URL: "https://onionoo.torproject.org/details?" +
|
|
"flag=Exit&running=true&fields=exit_addresses,or_addresses",
|
|
Interval: torExitsInterval,
|
|
Format: FormatOnionooJSON,
|
|
},
|
|
}
|
|
}
|
|
|
|
// vpnLists returns the public lists of VPN servers. Their names are what
|
|
// vpn_providers reports.
|
|
func vpnLists() []List {
|
|
return []List{
|
|
{
|
|
Name: "ivpn",
|
|
Description: "A server of the IVPN service",
|
|
URL: "https://api.ivpn.net/v5/servers.json",
|
|
Interval: vpnListInterval,
|
|
Format: FormatIVPNJSON,
|
|
VPN: true,
|
|
},
|
|
{
|
|
Name: "mullvad",
|
|
Description: "A server of the Mullvad VPN service",
|
|
URL: "https://api.mullvad.net/www/relays/all/",
|
|
Interval: vpnListInterval,
|
|
Format: FormatMullvadJSON,
|
|
VPN: true,
|
|
},
|
|
{
|
|
Name: "nordvpn",
|
|
Description: "A server of the NordVPN service",
|
|
URL: "https://api.nordvpn.com/v1/servers?limit=0" +
|
|
"&fields[servers.station]&fields[servers.ipv6_station]" +
|
|
"&fields[servers.hostname]",
|
|
Interval: vpnListInterval,
|
|
Format: FormatNordVPNJSON,
|
|
VPN: true,
|
|
},
|
|
{
|
|
Name: "pia",
|
|
Description: "A server of the Private Internet Access VPN service",
|
|
URL: "https://serverlist.piaservers.net/vpninfo/servers/v6",
|
|
Interval: vpnListInterval,
|
|
Format: FormatPIAJSON,
|
|
VPN: true,
|
|
},
|
|
{
|
|
// Proton's own server list needs a logged-in session, so this is
|
|
// the public ProtonVPN-IPs mirror of it. Proton publishes only
|
|
// the addresses clients connect to. The mirror's README says
|
|
// traffic leaves from others in the same /24, so this file of
|
|
// /24 networks is the one it says to use for detecting exits.
|
|
Name: "protonvpn",
|
|
Description: "In a /24 network that holds a server of the " +
|
|
"ProtonVPN service",
|
|
URL: protonVPNIPsURL + "protonvpn_ip_ranges.txt",
|
|
Interval: vpnListInterval,
|
|
Format: FormatProtonVPN,
|
|
VPN: true,
|
|
},
|
|
{
|
|
Name: "protonvpn_entry",
|
|
Description: "A server of the ProtonVPN service",
|
|
URL: protonVPNIPsURL + "protonvpn_entry_ips.txt",
|
|
Interval: vpnListInterval,
|
|
Format: FormatProtonVPN,
|
|
VPN: true,
|
|
},
|
|
{
|
|
Name: "x4bnet",
|
|
Description: "In an IPv4 network of a VPN service, according to " +
|
|
"X4BNet's community list",
|
|
URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
|
|
"output/vpn/ipv4.txt",
|
|
Interval: vpnListInterval,
|
|
Format: FormatLines,
|
|
VPN: true,
|
|
},
|
|
{
|
|
Name: "x4bnet_v6",
|
|
Description: "In an IPv6 network of a VPN service, according to " +
|
|
"X4BNet's community list",
|
|
URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
|
|
"output/vpn/ipv6.txt",
|
|
Interval: vpnListInterval,
|
|
Format: FormatLines,
|
|
VPN: true,
|
|
},
|
|
}
|
|
}
|