Location November 2021

location@lists.ipfire.org

2 participants
6 discussions

ASNs without AS name information (LACNIC and JPNIC)
by nusenu 19 Jan '22

19 Jan '22

Hi, I'm currently evaluating whether I should use ipfire or RIPEstat for AS information. (low number of lookups, lookup latency is not an issue) For tor relay IPs I found 54 ASNs where ipfire's DB has no AS name information. These are likely related to LACNIC and JPNIC. Are there plans to add AS names for these regions as well or will this not improve in the near future (before 2022)? kind regards, nusenu +-----------+---------+ | as_number | country | +-----------+---------+ | AS61493 | ar | | AS7303 | ar | | AS18881 | br | | AS19182 | br | | AS262287 | br | | AS264381 | br | | AS267436 | br | | AS268207 | br | | AS269070 | br | | AS27699 | br | | AS27715 | br | | AS28126 | br | | AS28271 | br | | AS28573 | br | | AS28668 | br | | AS53024 | br | | AS53111 | br | | AS53187 | br | | AS7162 | br | | AS7738 | br | | AS8167 | br | | AS22047 | cl | | AS265831 | cl | | AS270013 | cl | | AS27651 | cl | | AS52368 | cl | | AS64111 | cl | | AS7418 | cl | | AS13489 | co | | AS11830 | cr | | AS3790 | cr | | AS52423 | cr | | AS28118 | do | | AS10010 | jp | | AS17676 | jp | | AS18126 | jp | | AS2510 | jp | | AS2514 | jp | | AS2516 | jp | | AS2527 | jp | | AS4685 | jp | | AS4694 | jp | | AS4713 | jp | | AS4725 | jp | | AS59103 | jp | | AS7506 | jp | | AS7684 | jp | | AS9370 | jp | | AS9371 | jp | | AS13999 | mx | | AS278 | mx | | AS6503 | mx | | AS8151 | mx | | AS27956 | pa | +-----------+---------+

3 11

Release Announcement: libloc 0.9.9
by Michael Tremer 22 Nov '21

22 Nov '21

This is the announcement for release of libloc 0.9.9. This release comes with some feature enhancements and various bug fixes. https://git.ipfire.org/?p=location/libloc.git;a=shortlog;h=refs/tags/0.9.9 https://source.ipfire.org/releases/libloc/libloc-0.9.9.tar.gz API Changes: * loc_country_special_code_to_flag has been added and will translate any special country codes (A1, A2, …) into flags if such flags are available. * loc_network_matches_country_code can now handle any special country codes. This is useful when people want to use special country codes (A1, …) and the library will automatically perform a check for the flag. This is useful when integrating libloc into other applications and we add more special country codes which the application no longer needs to be aware of. * loc_database_lookup takes the address as a constified argument * loc_network_match_address/country_code have been renamed to loc_network_matches_address/country code (match -> matches). * loc_network_match_flag has been dropped. Use loc_network_has_flag. * All string pool and network tree functions have been made private. There is no need to export them. Importer: * We now import a feed from JPNIC. * We import Spamhaus DROP and mark such networks/ASes with the DROP flag (or XD). Performance improvements: * The entire library is now being build with -fno-semantic-interposition if the compiler supports it. This prevents users from overlaying any functions, but allows the compiler to inline more functions which will increase performance of all database operations potentially at the cost of a slightly larger size. Misc. * A statically linked version of the database is being generated in order to test internal functions in the test suite. * All country codes beginning with X are now considered invalid. X is reserved for custom country codes and therefore not recognised any more.

1 0

[PATCH] override-a2: Tag AS36492 as a satellite provider
by Peter Müller 14 Nov '21

14 Nov '21

Fixes: #12723 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a2.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index 1a3cb57..1f84462 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -215,6 +215,11 @@ descr: LVS Transnational Corporation (tm) OOO Nord-telecom remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes +aut-num: AS36492 +descr: Google, LLC +remarks: Announces several IP networks being used for satellite internet access, see also: #12723 +is-satellite-provider: yes + aut-num: AS37019 descr: Intersat Africa Ltd remarks: Satellite Internet provider -- 2.26.2

1 0

[PATCH] override-{a1,other}: Regular batch of various overrides
by Peter Müller 10 Nov '21

10 Nov '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 27 ++++++++++++++++----------- overrides/override-other.txt | 30 ++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 11 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 70b97e1..5734c08 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -204,6 +204,11 @@ descr: Anonymizer, Inc. remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS201860 +descr: MyTelco Ltd +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + aut-num: AS205016 descr: HERN Labs AB remarks: VPN provider [high confidence, but not proofed] @@ -232,6 +237,11 @@ descr: V6 Networking LLC remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… is-anonymous-proxy: yes +aut-num: AS208169 +descr: Artikel10 e.V. +remarks: Tor relay provider +is-anonymous-proxy: yes + aut-num: AS208256 descr: Stingers, Inc. remarks: Loaded with proxies, see also: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-net… @@ -248,12 +258,6 @@ descr: Foundation for Applied Privacy remarks: Tor relay provider is-anonymous-proxy: yes -aut-num: AS213005 -descr: Proxyseo Ltd. -remarks: VPN provider located in ES -is-anonymous-proxy: yes -country: ES - aut-num: AS208476 descr: Danilenko, Artyom remarks: (Rogue) VPN provider @@ -281,11 +285,6 @@ descr: Privex Inc. remarks: VPN and Tor relay provider is-anonymous-proxy: yes -aut-num: AS201860 -descr: MyTelco Ltd -remarks: VPN provider [high confidence, but not proofed] -is-anonymous-proxy: yes - aut-num: AS212052 descr: BOET NOTIFY LTD. remarks: VPN provider [high confidence, but not proofed] @@ -313,6 +312,12 @@ descr: NekoCloud Solutions Limited remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +aut-num: AS213005 +descr: Proxyseo Ltd. +remarks: VPN provider located in ES +is-anonymous-proxy: yes +country: ES + aut-num: AS213224 descr: Blue Black Squared Limited remarks: Owned by an offshore letterbox company, claims NL, but dead-ends in DE - hard to tell what is going on here diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 997b37e..dab86a0 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -344,6 +344,11 @@ descr: ab stract / Peter Kolmisoppi remarks: tampers with RIR data, traces back to SE country: SE +aut-num: AS39782 +descr: Rack Sphere Hosting S.A. +remarks: claims PA for some prefixes, but they are all hosted in CH +country: CH + aut-num: AS40034 descr: Confluence Networks Inc. remarks: fake offshore location (VG), traces back to Austin, TX, US @@ -409,6 +414,11 @@ descr: NForce Entertainment B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage country: NL +aut-num: AS43440 +descr: Digitale Suisse AG +remarks: ISP located in CH, but some RIR data for announced prefixes contain garbage +country: CH + aut-num: AS43624 descr: PQ HOSTING S.R.L. remarks: tampers with RIR data sometimes, traces back to NL @@ -559,6 +569,11 @@ descr: Cloudie Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region country: AP +aut-num: AS56322 +descr: ServerAstra Kft. +remarks: ISP located in HU, but some RIR data for announced prefixes contain garbage +country: HU + aut-num: AS56382 descr: vServer.site LTD remarks: ISP located in DE, but some RIR data for announced prefixes contain garbage @@ -724,6 +739,11 @@ descr: BGP Consultancy Pte Ltd remarks: possibly invoved in IP hijacking, located somewhere in AP area country: AP +aut-num: AS64122 +descr: SWISS GLOBAL SERVICES S.A.S. +remarks: ... surprisingly, all of their prefixes are hosted in CH, yet they claim CO or PA for them +country: CH + aut-num: AS64425 descr: SKB Enterprise B.V. remarks: bulletproof ISP (linked to AS202425 et al.) located in NL @@ -1124,6 +1144,11 @@ descr: VPSSC Networks LTD remarks: ISP located in UA, but RIR data for announced prefixes contain garbage country: UA +aut-num: AS210848 +descr: Telkom Internet LTD +remarks: shady ISP currently located in NL +country: NL + aut-num: AS211380 descr: PAYWISE HOLDING Sp. z.o.o. remarks: ISP located in NL, but RIR data for announced prefixes contain garbage @@ -1194,6 +1219,11 @@ descr: Private Internet Hosting LTD remarks: bulletproof ISP located in RU country: RU +aut-num: AS213194 +descr: Alfa Web Solutions Ltd. +remarks: shady ISP located in NL +country: NL + aut-num: AS213373 descr: IP Connect Inc. remarks: fake offshore location (SC), traces back to NL -- 2.26.2

1 0

[PATCH] location-other: All prefixes announced by AS2856 are located in the UK
by Peter Müller 09 Nov '21

09 Nov '21

Fixes: #12722 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-other.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 0d36048..997b37e 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -40,6 +40,11 @@ descr: WNET TELECOM USA Corp. remarks: traces back to various locations in UA, seems to tamper with RIR data country: UA +aut-num: AS2856 +descr: BTnet UK Regional network +remarks: ISP located in GB, but some RIR data for announced prefixes contain garbage +country: GB + aut-num: AS3216 descr: PJSC "Vimpelcom" remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage -- 2.26.2

1 0

[PATCH v4 1/2] location-importer: Introduce auxiliary function to sanitise ASNs
by Peter Müller 01 Nov '21

01 Nov '21

The third version of this patch does this in an even more Pythonic way. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index da058d3..ede8a75 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -37,6 +37,14 @@ from location.i18n import _ log = logging.getLogger("location.importer") log.propagate = 1 +# Define constants +VALID_ASN_RANGES = ( + (1, 23455), + (23457, 64495), + (131072, 4199999999), +) + + class CLI(object): def parse_cli(self): parser = argparse.ArgumentParser( @@ -574,6 +582,19 @@ class CLI(object): # be suitable for libloc consumption... return True + def _check_parsed_asn(self, asn): + """ + Assistive function to filter Autonomous System Numbers not being suitable + for adding to our database. Returns False in such cases, and True otherwise. + """ + + for start, end in VALID_ASN_RANGES: + if start <= asn and end >= asn: + return True + + log.info("Supplied ASN %s out of publicly routable ASN ranges" % asn) + return False + def _parse_block(self, block, source_key, validcountries = None): # Get first line to find out what type of block this is line = block[0] @@ -829,8 +850,8 @@ class CLI(object): log.debug("Skipping ARIN AS names line not containing an integer for ASN") continue - if not ((1 <= asn and asn <= 23455) or (23457 <= asn and asn <= 64495) or (131072 <= asn and asn <= 4199999999)): - log.debug("Skipping ARIN AS names line not containing a valid ASN: %s" % asn) + # Filter invalid ASNs... + if not self._check_parsed_asn(asn): continue # Skip any AS name that appears to be a placeholder for a different RIR or entity... -- 2.26.2

1 1

2024

2023

2022

2021

2020

2019

2018

2017

Location November 2021