June 2021 - Location - lists.ipfire.org

incorporation state of ARIN's asn.txt
by nusenu 15 Jul '21

15 Jul '21

Hi, I'm an indirect user of ipfire IP -> ASN and ASN -> AS name data since the torproject recently switched from an outdated maxmind db to ipfire's database on 2021-06-18. When the switch from maxmind to ipfire's db occurred I observerd a significant increase of ASes without AS name. I did read the recent threads on this mailing list about "Import (technical) AS names from ARIN", which I assume should improve or entirely solve the situation. Is my understanding correct that your recent work [1] on adding ARIN's AS name [2] data has been merged? [1] https://lists.ipfire.org/pipermail/location/2021-June/000394.html [2] https://ftp.arin.net/info/asn.txt As a test I manually verified AS14061 > 14061 DIGITALOCEAN-ASN and was unable find the AS name when using ipfire's db. example lookup: https://location.ipfire.org/lookup/134.209.159.74 Should I already see ARINs asn.txt AS name information or will this be "visible" in ipfire's db in the near future? kind regards, nusenu -- https://nusenu.github.io

3 8

[PATCH] debian: Attribute all maintainers in changlog
by Valters Jansons 14 Jul '21

14 Jul '21

This commit further builds on historical changelog modifications, to properly attribute all authors of the commits. An additional d/genchangelog.sh script has been added. This allows generation of changelog entries, internally using `debchange` (`dch`). The script accepts an argument, which is the commit range to generate entries for. Each commit's subject line (first line of body) is used, along with author name and email. This information is added to the changelog. Automatic detection (via `debchange` built-in functionality) is used to determine whether these entries should be added to an existing version number. If there is no UNRELEASED version, then a new version is automatically tagged. The new version tag will usually need to be modified, for example, replacing an automatically generated 0.9.6-2 with 0.9.7-1. The final release change (s/UNRELEASED/unstable/) needs to be done manually as well, when the Git tag is actually being tagged. `dch -r` can be useful for this particular purpose. Signed-off-by: Valters Jansons <valter.jansons(a)gmail.com> --- debian/changelog | 15 +++++++++------ debian/genchangelog.sh | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+), 6 deletions(-) create mode 100755 debian/genchangelog.sh diff --git a/debian/changelog b/debian/changelog index e58c0ca..6817fb3 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,13 +1,16 @@ libloc (0.9.6-1) unstable; urgency=medium - * location-importer.in: skip networks with unknown country codes - * location-importer.in: process unaligned IP ranges in RIR data files - correctly + [ Michael Tremer ] + * location: Fix list-networks-by-as * database: Free mmapped countries section - * location-importer.in: reduce log noise for unusable networks - * location-importer.in: delete 6to4 IPv6 space as well + + [ Peter Müller ] * location-importer.in: fix typo - * location: Fix list-networks-by-as + * location-importer.in: delete 6to4 IPv6 space as well + * location-importer.in: reduce log noise for unusable networks + * location-importer.in: process unaligned IP ranges in RIR data files + correctly + * location-importer.in: skip networks with unknown country codes -- Michael Tremer <michael.tremer(a)ipfire.org> Wed, 31 Mar 2021 14:06:00 +0100 diff --git a/debian/genchangelog.sh b/debian/genchangelog.sh new file mode 100755 index 0000000..85d3922 --- /dev/null +++ b/debian/genchangelog.sh @@ -0,0 +1,36 @@ +#!/bin/bash -e +gitshow () { + local format=$1 + local commit=$2 + + git show --no-patch --format=format:"$format" "$commit" +} + +main () { + if [ $# -lt 1 ]; then + local bn="$(basename $0)" + echo "Usage: $bn <commit range>" >&2 + echo "Example: $bn 0.9.7..HEAD" >&2 + echo "Example: $bn 0.9.5..0.9.6^" >&2 + return 1 + fi + + local commitrange=$1 + + local commit + for commit in $(git rev-list --reverse "$commitrange"); do + # Skip commits with diffs that only have Makefile.am or d/ changes. + if [ "$(git diff --name-only "${commit}^..${commit}" -- . ':^Makefile.am' ':^debian/' | wc -l)" == 0 ]; then + continue + fi + + local author_name="$(gitshow %an "$commit")" + local author_email="$(gitshow %ae "$commit")" + local subject="$(gitshow %s "$commit")" + + echo "$author_name <$author_email> $subject" + DEBFULLNAME="$author_name" DEBEMAIL="$author_email" debchange --upstream --multimaint-merge "$subject" + done +} + +main "$@" || exit $? -- 2.32.0

2 3

[PATCH 0/8] debian: Mitigate bulk of Lintian issues
by Valters Jansons 14 Jul '21

14 Jul '21

This series breaks apart the previously submitted block of debian/ changes into individual logical changes, which can be individually reviewed and discussed, and approved. This series is however missing the change for d/clean and d/libloc1.symbols, which are both pending rework as discussed in the superseded patch. Valters Jansons (8): debian: Add all temporary files to Gitignore debian: Move libloc1 to 'libs' section debian: Set 'Multi-Arch: foreign' hint for Python debian: Update copyright format link to use HTTPS debian: Add examples/python/ to documentation debian: Drop unintended files from location-python debian: Add watch configuration for uscan systemd: Add Documentation= to location-update debian/.gitignore | 9 +++++---- debian/control | 5 +++-- debian/copyright | 2 +- debian/location-python.examples | 1 + debian/rules | 8 ++++++++ debian/watch | 3 +++ src/systemd/location-update.service.in | 1 + 7 files changed, 22 insertions(+), 7 deletions(-) create mode 100644 debian/location-python.examples create mode 100644 debian/watch -- 2.31.1

2 22

[PATCH] override-{a1,other}: weekly batch of various overrides
by Peter Müller 25 Jun '21

25 Jun '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 54 ++++++++++++++++++++++++++++++++++-- overrides/override-other.txt | 7 ++++- 2 files changed, 58 insertions(+), 3 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 3734c56..4dccbfc 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -156,6 +156,11 @@ descr: Anonymizer, Inc. remarks: VPN provider is-anonymous-proxy: yes +aut-num: AS205016 +descr: HERN Labs AB +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + aut-num: AS206819 descr: ANSON NETWORK LIMITED remarks: Autonomous System registered to UK letterbox company, traces back through shady ISPs to TW @@ -169,9 +174,10 @@ is-anonymous-proxy: yes country: BR aut-num: AS208294 -descr: Markus Koch -remarks: Tor relay provider +descr: CIA TRIAD SECURITY LLC +remarks: Tor relay provider located in or near Berlin, DE is-anonymous-proxy: yes +country: DE aut-num: AS208323 descr: Foundation for Applied Privacy @@ -688,6 +694,30 @@ descr: icedoutproxies.com remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +net: 77.111.244.0/24 +descr: HERN Labs AB +remarks: VPN provider [high confidence, but not proofed] located somewhere in EU +is-anonymous-proxy: yes +country: EU + +net: 77.111.245.0/24 +descr: HERN Labs AB +remarks: VPN provider [high confidence, but not proofed] located in SG +is-anonymous-proxy: yes +country: SG + +net: 77.111.246.0/24 +descr: HERN Labs AB +remarks: VPN provider [high confidence, but not proofed] located in US +is-anonymous-proxy: yes +country: US + +net: 77.111.247.0/24 +descr: HERN Labs AB +remarks: VPN provider [high confidence, but not proofed] located in NL +is-anonymous-proxy: yes +country: NL + net: 77.247.181.160/28 descr: Zwiebelfreunde e.V. remarks: Tor relay provider @@ -724,6 +754,11 @@ descr: VPN-Services / KDDI Corporation remarks: VPN provider is-anonymous-proxy: yes +net: 85.203.53.0/24 +descr: Mullvad VPN AB +remarks: VPN provider +is-anonymous-proxy: yes + net: 85.208.112.0/22 descr: VPNHOST SIA remarks: VPN provider @@ -1370,6 +1405,11 @@ descr: PureVPN remarks: VPN provider is-anonymous-proxy: yes +net: 193.19.108.0/24 +descr: Mullvad VPN AB +remarks: VPN provider +is-anonymous-proxy: yes + net: 193.42.136.0/24 descr: IntelligenceHosting remarks: VPN provider [high confidence, but not proofed] @@ -1410,6 +1450,11 @@ descr: Lynx Proxies Ltd. remarks: VPN provider is-anonymous-proxy: yes +net: 194.242.2.0/24 +descr: Mullvad VPN AB +remarks: VPN provider +is-anonymous-proxy: yes + net: 195.138.249.0/24 descr: Perfect Privacy LTD remarks: VPN provider @@ -1710,6 +1755,11 @@ descr: ProtonVPN AG remarks: VPN provider is-anonymous-proxy: yes +net: 2a07:e340::/32 +descr: Mullvad VPN AB +remarks: VPN provider +is-anonymous-proxy: yes + net: 2a09:50c0::/29 descr: VPNHost SIA remarks: VPN provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 87457d8..0b63d41 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -48,6 +48,11 @@ descr: Iron Mountain Data Center remarks: ISP located in US, but some RIR data for announced prefixes contain garbage country: US +aut-num: AS12389 +descr: PJSC Rostelecom +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS18013 descr: ASLINE LIMITED remarks: IP hijacker, traces back to AP region @@ -149,7 +154,7 @@ remarks: ... who thinks messing with countries is funny :-/ country: EU aut-num: AS35624 -descr: Neterra Ltd. +descr: Silverstar Invest Limited remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU -- 2.26.2

1 0

[PATCH] override-{a2,other}: weekly batch of various overrides
by Peter Müller 20 Jun '21

20 Jun '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a2.txt | 6 +++ overrides/override-other.txt | 85 ++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+) diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index 24db2a8..eeb4099 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -1758,6 +1758,12 @@ descr: AITelecom S.A. de C.V. remarks: Satellite Internet provider is-satellite-provider: yes +net: 202.144.196.0/22 +descr: CoreLink Communications +remarks: Chinese satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes +country: AP + net: 202.174.128.0/19 descr: SPEEDCAST Limited remarks: Satellite Internet provider diff --git a/overrides/override-other.txt b/overrides/override-other.txt index ce5bdb5..87457d8 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -138,6 +138,16 @@ descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS35145 +descr: iDea Leaper Innovation Inc. +remarks: tampers with RIR data, traces back to AP area +country: AP + +aut-num: AS35619 +descr: Kevin Buehl +remarks: ... who thinks messing with countries is funny :-/ +country: EU + aut-num: AS35624 descr: Neterra Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage @@ -228,6 +238,16 @@ descr: IP Oleinichenko Denis remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS47105 +descr: Dreamtorrent Corp +remarks: traceroutes dead-end somewhere in or near RU +country: RU + +aut-num: AS47482 +descr: Spectre Operations BV +remarks: ISP located in NL, but some RIR data for suballocations of announced prefixes contain garbage +country: NL + aut-num: AS48090 descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL @@ -258,6 +278,11 @@ descr: F.I.H. FORMULA INVESTMENT HOUSE CLEARING LIMITED remarks: claims GR for announced prefixes, but traceroutes dead-end somewhere else in EU country: EU +aut-num: AS49981 +descr: Worldstream BV +remarks: ISP located in NL, but many RIR data for announced prefixes contain garbage +country: NL + aut-num: AS50360 descr: Tamatiya EOOD / 4Vendeta remarks: Questionable (at best) ISP located in BG, clients massively tamper with RIR data @@ -338,6 +363,11 @@ descr: FOP Gubina Lubov Petrivna remarks: bulletproof ISP operating from a war zone in eastern UA country: UA +aut-num: AS58294 +descr: CloudWall Ltd. +remarks: RIR data neither contain a postal address nor a phone number, traceroutes end in Sofia, BG +country: BG + aut-num: AS58349 descr: INNETRA PC remarks: another shady customer of "DDoS Guard Ltd.", jurisdiction is probably RU, but traceroutes dead-end somewhere else in EU @@ -353,6 +383,16 @@ descr: Batterflyai Media Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS59753 +descr: Vault Dweller OU +remarks: traceroutes dead-end somewhere in or near RU +country: RU + +aut-num: AS60144 +descr: 3W Infra B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS60404 descr: The Infrastructure Group B.V. remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -373,6 +413,11 @@ descr: LeaseWeb Netherlands B.V. remarks: ISP located in Amsterdam, NL, but many RIR data for announced prefixes contain garbage country: NL +aut-num: AS61218 +descr: 4b42 UG (haftungsbeschränkt) +remarks: ... who thinks messing with countries is funny :-/ +country: LI + aut-num: AS61977 descr: Vivo Trade L.P. remarks: another shady customer of "DDoS Guard Ltd." @@ -438,6 +483,11 @@ descr: DXTL Tseung Kwan O Service remarks: tampers with RIR data, traces back to AP region country: AP +aut-num: AS136274 +descr: Cloud Servers Pvt Ltd +remarks: ISP located in NL, all RIR data for announced prefixes contain garbage +country: NL + aut-num: AS136988 descr: Leaseweb Australia Pty. Ltd. remarks: ISP located in AU, some RIR data for announced prefixes contain garbage @@ -483,6 +533,11 @@ descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region country: AP +aut-num: AS196682 +descr: FLP Kochenov Aleksej Vladislavovich +remarks: ISP located in UA, but RIR data for announced prefixes all say EU +country: UA + aut-num: AS200019 descr: ALEXHOST SRL remarks: ISP located in MD, majority of RIR data for announced prefixes contain garbage, we cannot trust this network @@ -548,6 +603,11 @@ descr: DataClub S.A. remarks: another shady customer of "DDoS Guard Ltd." country: RU +aut-num: AS203038 +descr: QuxLabs UG +remarks: traces back to SE +country: SE + aut-num: AS204136 descr: Kevin Holly trading as Silent Ghost e.U. remarks: AS run by someone who thinks allocating IP networks to AQ is funny (it is not, kid) :-/ @@ -638,6 +698,11 @@ descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA country: UA +aut-num: AS209366 +descr: SEMrush CY LTD +remarks: claims CY for announced prefixes, but they are all hosted in NL +country: NL + aut-num: AS209401 descr: Gudaev Maxim Amrakhovich remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage @@ -648,11 +713,26 @@ descr: VPSSC Networks LTD remarks: ISP located in UA, but RIR data for announced prefixes contain garbage country: UA +aut-num: AS211380 +descr: PAYWISE HOLDING Sp. z.o.o. +remarks: ISP located in NL, but RIR data for announced prefixes contain garbage +country: NL + +aut-num: AS211839 +descr: JMT Paso Limited +remarks: ISP located in NL, but RIR data for announced prefixes contain garbage +country: NL + aut-num: AS211849 descr: Kakharov Orinbassar Maratuly remarks: ISP located in RU, but RIR data for announced prefixes contain garbage country: RU +aut-num: AS211992 +descr: WFD SERVICE LTD +remarks: ISP located in NL, but RIR data for announced prefixes contain garbage +country: NL + aut-num: AS212231 descr: Harry Dowd remarks: ISP located in GB, but RIR data for announced prefixes contain garbage @@ -968,6 +1048,11 @@ descr: Securebit AG remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ country: CH +net: 2a0e:b100:3000::/40 +descr: 4b42 UG (haftungsbeschränkt) +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: DE + net: 2a0e:b101:3000::/40 descr: 4b42 UG (haftungsbeschränkt) remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ -- 2.26.2

1 0

[PATCH] location-import.in: optimise regular expression for filtering ASN allocations to other RIRs when parsing ARIN AS names file
by Peter Müller 20 Jun '21

20 Jun '21

https://lists.ipfire.org/pipermail/location/2021-June/000394.html Reported-by: Michael Tremer <michael.tremer(a)ipfire.org> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index b235db7..ff90d91 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -811,7 +811,7 @@ class CLI(object): continue # Skip any AS name that appears to be a placeholder for a different RIR or entity... - if re.match(r"^(ASN-BLK|)(AFCONC|AFRINIC|APNIC|ASNBLK|DNIC|LACNIC|RIPE|IANA)(\d?$|\-.*)", name): + if re.match(r"^(ASN-BLK|)(AFCONC|AFRINIC|APNIC|ASNBLK|DNIC|LACNIC|RIPE|IANA)(?:\d?$|\-)", name): continue # Bail out in case the AS name contains anything we do not expect here... -- 2.26.2

1 0

[PATCH] debian: Add dpkg's symbols file
by Valters Jansons 11 Jun '21

11 Jun '21

There are muiltiple standards of listing symbols throughout the Linux ecosystem. For `dpkg`, a d/package.symbols file tracks symbols, and in which version they were added in. This is then used to allow dependency checks/resolution. See man:dpkg-gensymbols(1) for details about the generation, and man:dpkg-shlibdeps(1) for how the symbols file ends up being used. This commit adds a d/libloc1.symbols file, containing the current state of the symbols. There is now also a d/gensymbols.sh script, which generates this symbols file. The script tries to determine what Git tags need to be checked for changes in symbols, by looking at current maximum version referenced in symbols file. After checking tags, the current revision is also processed, to allow building symbols file for a yet unreleased version (prior to tagging it). This is to allow symbols changes to be included in a tag. Do keep in mind, that for the workflow above, when running the script, the d/changelog file should contain information about what version the current revision will be released at (potentially tagged as UNRELEASED in the d/changelog file). Otherwise, if there is no version tagged, the `dpkg-gensymbols` tool will use the old version information, in turn incorrectly attributing new symbols to an old version. --- debian/gensymbols.sh | 50 +++++++++++++++ debian/libloc1.symbols | 134 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 184 insertions(+) create mode 100755 debian/gensymbols.sh create mode 100644 debian/libloc1.symbols diff --git a/debian/gensymbols.sh b/debian/gensymbols.sh new file mode 100755 index 0000000..8523556 --- /dev/null +++ b/debian/gensymbols.sh @@ -0,0 +1,50 @@ +#!/bin/bash +SYMBOLS_PKG=libloc1 +LOCAL_FILE=debian/libloc1.symbols +TEMP_FILE="$(mktemp --tmpdir libloc1.XXXXXX.symbols)" +trap "rm -f ${TEMP_FILE}" EXIT + +generate () { + intltoolize --force --automake + autoreconf --install --symlink + ./configure CFLAGS='-g -O0' --prefix=/usr --sysconfdir=/etc --libdir=/usr/lib + + make + + dpkg-gensymbols -p"$SYMBOLS_PKG" -O"$TEMP_FILE" -esrc/.libs/libloc.so.* + sed -i -E -e 's/( [0-9\.]+)-.+$/\1/' "$TEMP_FILE" + + make clean +} + +main () { + local maxver='0.0.0' + if [ -f "$LOCAL_FILE" ]; then + cp "$LOCAL_FILE" "$TEMP_FILE" + maxver="$(grep -E '^ ' "$LOCAL_FILE" | cut -d' ' -f3 | sort -Vru | head -n1)" + echo "Latest version checked: $maxver" + fi + + + local tag + for tag in $(git tag -l --sort=version:refname) + do + if [ "$(echo -e "${maxver}\n${tag}" | sort -Vr | head -n1)" == "$maxver" ]; then + echo "Tag $tag -- skip" + continue + fi + + echo "Tag $tag -- checking" + git switch --quiet --detach "$tag" || return 1 + generate || return 1 + git switch --quiet - || return 1 + done + + echo "Current -- checking" + generate || return 1 + + mv "$TEMP_FILE" "$LOCAL_FILE" + chmod 644 "$LOCAL_FILE" +} + +main "$@" || exit $? diff --git a/debian/libloc1.symbols b/debian/libloc1.symbols new file mode 100644 index 0000000..74b70b5 --- /dev/null +++ b/debian/libloc1.symbols @@ -0,0 +1,134 @@ +libloc.so.1 libloc1 #MINVER# +* Build-Depends-Package: libloc-dev + LIBLOC_1@LIBLOC_1 0.9.4 + LIBLOC_PRIVATE@LIBLOC_PRIVATE 0.9.4 + loc_as_cmp@LIBLOC_1 0.9.4 + loc_as_get_name@LIBLOC_1 0.9.4 + loc_as_get_number@LIBLOC_1 0.9.4 + loc_as_list_append@LIBLOC_1 0.9.5 + loc_as_list_clear@LIBLOC_1 0.9.5 + loc_as_list_contains@LIBLOC_1 0.9.5 + loc_as_list_contains_number@LIBLOC_1 0.9.5 + loc_as_list_empty@LIBLOC_1 0.9.5 + loc_as_list_get@LIBLOC_1 0.9.5 + loc_as_list_new@LIBLOC_1 0.9.5 + loc_as_list_ref@LIBLOC_1 0.9.5 + loc_as_list_size@LIBLOC_1 0.9.5 + loc_as_list_unref@LIBLOC_1 0.9.5 + loc_as_new@LIBLOC_1 0.9.4 + loc_as_ref@LIBLOC_1 0.9.4 + loc_as_set_name@LIBLOC_1 0.9.4 + loc_as_unref@LIBLOC_1 0.9.4 + loc_country_cmp@LIBLOC_1 0.9.4 + loc_country_code_is_valid@LIBLOC_1 0.9.4 + loc_country_get_code@LIBLOC_1 0.9.4 + loc_country_get_continent_code@LIBLOC_1 0.9.4 + loc_country_get_name@LIBLOC_1 0.9.4 + loc_country_list_append@LIBLOC_1 0.9.5 + loc_country_list_clear@LIBLOC_1 0.9.5 + loc_country_list_contains@LIBLOC_1 0.9.5 + loc_country_list_contains_code@LIBLOC_1 0.9.5 + loc_country_list_empty@LIBLOC_1 0.9.5 + loc_country_list_get@LIBLOC_1 0.9.5 + loc_country_list_new@LIBLOC_1 0.9.5 + loc_country_list_ref@LIBLOC_1 0.9.5 + loc_country_list_size@LIBLOC_1 0.9.5 + loc_country_list_unref@LIBLOC_1 0.9.5 + loc_country_new@LIBLOC_1 0.9.4 + loc_country_ref@LIBLOC_1 0.9.4 + loc_country_set_continent_code@LIBLOC_1 0.9.4 + loc_country_set_name@LIBLOC_1 0.9.4 + loc_country_unref@LIBLOC_1 0.9.4 + loc_database_count_as@LIBLOC_1 0.9.4 + loc_database_created_at@LIBLOC_1 0.9.4 + loc_database_enumerator_get_asns@LIBLOC_1 0.9.5 + loc_database_enumerator_get_countries@LIBLOC_1 0.9.5 + loc_database_enumerator_new@LIBLOC_1 0.9.4 + loc_database_enumerator_next_as@LIBLOC_1 0.9.4 + loc_database_enumerator_next_country@LIBLOC_1 0.9.4 + loc_database_enumerator_next_network@LIBLOC_1 0.9.4 + loc_database_enumerator_ref@LIBLOC_1 0.9.4 + loc_database_enumerator_set_asns@LIBLOC_1 0.9.5 + loc_database_enumerator_set_countries@LIBLOC_1 0.9.5 + loc_database_enumerator_set_family@LIBLOC_1 0.9.4 + loc_database_enumerator_set_flag@LIBLOC_1 0.9.4 + loc_database_enumerator_set_string@LIBLOC_1 0.9.4 + loc_database_enumerator_unref@LIBLOC_1 0.9.4 + loc_database_get_as@LIBLOC_1 0.9.4 + loc_database_get_country@LIBLOC_1 0.9.4 + loc_database_get_description@LIBLOC_1 0.9.4 + loc_database_get_license@LIBLOC_1 0.9.4 + loc_database_get_vendor@LIBLOC_1 0.9.4 + loc_database_lookup@LIBLOC_1 0.9.4 + loc_database_lookup_from_string@LIBLOC_1 0.9.4 + loc_database_new@LIBLOC_1 0.9.4 + loc_database_ref@LIBLOC_1 0.9.4 + loc_database_unref@LIBLOC_1 0.9.4 + loc_database_verify@LIBLOC_1 0.9.4 + loc_discover_latest_version@LIBLOC_1 0.9.4 + loc_get_log_priority@LIBLOC_1 0.9.4 + loc_network_address_family@LIBLOC_1 0.9.4 + loc_network_cmp@LIBLOC_1 0.9.5 + loc_network_exclude@LIBLOC_1 0.9.5 + loc_network_exclude_list@LIBLOC_1 0.9.5 + loc_network_format_first_address@LIBLOC_1 0.9.4 + loc_network_format_last_address@LIBLOC_1 0.9.4 + loc_network_get_asn@LIBLOC_1 0.9.4 + loc_network_get_country_code@LIBLOC_1 0.9.4 + loc_network_get_first_address@LIBLOC_1 0.9.5 + loc_network_get_last_address@LIBLOC_1 0.9.5 + loc_network_has_flag@LIBLOC_1 0.9.4 + loc_network_is_subnet@LIBLOC_1 0.9.5 + loc_network_list_clear@LIBLOC_1 0.9.5 + loc_network_list_contains@LIBLOC_1 0.9.5 + loc_network_list_dump@LIBLOC_1 0.9.5 + loc_network_list_empty@LIBLOC_1 0.9.5 + loc_network_list_get@LIBLOC_1 0.9.5 + loc_network_list_merge@LIBLOC_1 0.9.5 + loc_network_list_new@LIBLOC_1 0.9.5 + loc_network_list_pop@LIBLOC_1 0.9.5 + loc_network_list_pop_first@LIBLOC_1 0.9.5 + loc_network_list_push@LIBLOC_1 0.9.5 + loc_network_list_ref@LIBLOC_1 0.9.5 + loc_network_list_size@LIBLOC_1 0.9.5 + loc_network_list_unref@LIBLOC_1 0.9.5 + loc_network_match_address@LIBLOC_1 0.9.5 + loc_network_match_asn@LIBLOC_1 0.9.4 + loc_network_match_country_code@LIBLOC_1 0.9.4 + loc_network_match_flag@LIBLOC_1 0.9.4 + loc_network_new@LIBLOC_1 0.9.4 + loc_network_new_from_string@LIBLOC_1 0.9.4 + loc_network_overlaps@LIBLOC_1 0.9.5 + loc_network_prefix@LIBLOC_1 0.9.5 + loc_network_ref@LIBLOC_1 0.9.4 + loc_network_set_asn@LIBLOC_1 0.9.4 + loc_network_set_country_code@LIBLOC_1 0.9.4 + loc_network_set_flag@LIBLOC_1 0.9.4 + loc_network_str@LIBLOC_1 0.9.4 + loc_network_subnets@LIBLOC_1 0.9.5 + loc_network_unref@LIBLOC_1 0.9.4 + loc_new@LIBLOC_1 0.9.4 + loc_ref@LIBLOC_1 0.9.4 + loc_set_log_fn@LIBLOC_1 0.9.4 + loc_set_log_priority@LIBLOC_1 0.9.4 + loc_stringpool_add@LIBLOC_PRIVATE 0.9.4 + loc_stringpool_dump@LIBLOC_PRIVATE 0.9.4 + loc_stringpool_get@LIBLOC_PRIVATE 0.9.4 + loc_stringpool_get_size@LIBLOC_PRIVATE 0.9.4 + loc_stringpool_new@LIBLOC_PRIVATE 0.9.4 + loc_stringpool_ref@LIBLOC_PRIVATE 0.9.4 + loc_stringpool_unref@LIBLOC_PRIVATE 0.9.4 + loc_unref@LIBLOC_1 0.9.4 + loc_writer_add_as@LIBLOC_1 0.9.4 + loc_writer_add_country@LIBLOC_1 0.9.4 + loc_writer_add_network@LIBLOC_1 0.9.4 + loc_writer_get_description@LIBLOC_1 0.9.4 + loc_writer_get_license@LIBLOC_1 0.9.4 + loc_writer_get_vendor@LIBLOC_1 0.9.4 + loc_writer_new@LIBLOC_1 0.9.4 + loc_writer_ref@LIBLOC_1 0.9.4 + loc_writer_set_description@LIBLOC_1 0.9.4 + loc_writer_set_license@LIBLOC_1 0.9.4 + loc_writer_set_vendor@LIBLOC_1 0.9.4 + loc_writer_unref@LIBLOC_1 0.9.4 + loc_writer_write@LIBLOC_1 0.9.4 -- 2.32.0

2 1

[PATCH] overrides-*: weekly batch of various overrides
by Peter Müller 10 Jun '21

10 Jun '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 36 +++++++++ overrides/override-a2.txt | 10 +++ overrides/override-a3.txt | 88 +++++++++++++++++++- overrides/override-other.txt | 152 ++++++++++++++++++++++++++++++++--- 4 files changed, 274 insertions(+), 12 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 921dd0c..3734c56 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -77,6 +77,12 @@ remarks: VPN provider [high confidence, but not proofed] located in ES is-anonymous-proxy: yes country: ES +aut-num: AS44571 +descr: Netvillage Ltd. +remarks: VPN provider [high confidence, but not proofed] located in or near RU +is-anonymous-proxy: yes +country: RU + aut-num: AS45792 descr: Layer 3 VPN ASN remarks: VPN provider @@ -210,6 +216,11 @@ descr: BOET NOTIFY LTD. remarks: VPN provider [high confidence, but not proofed] is-anonymous-proxy: yes +aut-num: AS212371 +descr: Evolve Proxies Ltd. +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + aut-num: AS212786 descr: Pooky L&W SDN BHD remarks: VPN provider [high confidence, but not proofed] @@ -441,6 +452,11 @@ descr: VPNHost SIA remarks: VPN provider is-anonymous-proxy: yes +net: 45.14.80.0/22 +descr: ALTUS COMMUNICATIONS, INC. +remarks: VPN and/or open proxy provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 45.41.132.0/24 descr: VPN Consumer Network remarks: VPN provider @@ -512,6 +528,16 @@ descr: Low budget VPN service remarks: VPN provider is-anonymous-proxy: yes +net: 45.221.64.0/21 +descr: Secure Internet Limited +remarks: VPN provider +is-anonymous-proxy: yes + +net: 45.231.206.0/23 +descr: SENTRIGLOBAL LTD +remarks: VPN provider [high confidence, but not proofed] +is-anonymous-proxy: yes + net: 46.36.200.0/22 descr: IAPS Security Services, L.L.C. remarks: VPN provider @@ -698,6 +724,11 @@ descr: VPN-Services / KDDI Corporation remarks: VPN provider is-anonymous-proxy: yes +net: 85.208.112.0/22 +descr: VPNHOST SIA +remarks: VPN provider +is-anonymous-proxy: yes + net: 88.81.248.0/24 descr: TopNet ISP VPN remarks: VPN provider @@ -954,6 +985,11 @@ descr: Cloud Innovation Ltd. remarks: hijacked AFRINIC IP chunk, owned by suspicous offshore company, scattered across dirty networks worldwide - not a safe place to go is-anonymous-proxy: yes +net: 156.0.200.0/22 +descr: xTom Limited +remarks: ... network operator thinks messing with countries and having an offshore company for it is funny :-/ +is-anonymous-proxy: yes + net: 161.129.60.0/24 descr: 10VPN Hosting remarks: VPN provider diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index b8b3b08..24db2a8 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -197,6 +197,11 @@ descr: Shaw Satellite Services, Inc. remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes +aut-num: AS32806 +descr: Emerging Markets Communications +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS35410 descr: LVS Transnational Corporation (tm) OOO Nord-telecom remarks: Satellite Internet provider [high confidence, but not proofed] @@ -293,6 +298,11 @@ remarks: Chinese satellite Internet provider [high confidence, but not proofe is-satellite-provider: yes country: AP +aut-num: AS42705 +descr: Talia +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS42726 descr: BusinessCom CZ spol. s r.o. remarks: Satellite Internet provider diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index daacc95..9200b78 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -25,6 +25,11 @@ descr: DirectNIC, Ltd. remarks: Generic anycast network [high confidence, but not proofed] is-anycast: yes +aut-num: AS13335 +descr: Cloudflare, Inc. +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + aut-num: AS16625 descr: Akamai Technologies, Inc. remarks: Worldwide CDN, does not make sense to assign their networks to a specific country @@ -37,14 +42,29 @@ is-anycast: yes aut-num: AS20940 descr: Akamai International BV -remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country is-anycast: yes +aut-num: AS21342 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + +aut-num: AS24319 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yesx + aut-num: AS28064 descr: Smart Data Center S.A. remarks: Generic anycast network [high confidence, but not proofed] is-anycast: yes +aut-num: AS29997 +descr: Vitalwerks Internet Solutions, LLC +remarks: Public anycast DNS resolver network [high confidence, but not proofed] +is-anycast: yes + aut-num: AS31529 descr: DENIC eG remarks: TLD operator's anycast network @@ -55,6 +75,11 @@ descr: Citigroup remarks: Public anycast DNS resolver network [high confidence, but not proofed] is-anycast: yes +aut-num: AS34164 +descr: Akamai International BV +remarks: Worldwide CDN, does not make sense to assign their networks to a specific country +is-anycast: yes + aut-num: AS34738 descr: WEBHOST LIMITED remarks: Generic anycast network [high confidence, but not proofed] @@ -80,6 +105,12 @@ descr: ANEXIA Internetdienstleistungs GmbH remarks: Public anycast DNS nameserver network [high confidence, but not proofed] is-anycast: yes +aut-num: AS49287 +descr: Melbikomas UAB +remarks: Generic anycast network [high confidence, but not proofed] +is-anycast: yes +country: EU + aut-num: AS48550 descr: Pascal Mathis trading as SnapServ Mathis remarks: Generic anycast network @@ -215,6 +246,11 @@ descr: Cloudflare, Inc. remarks: Public anycast DNS resolver is-anycast: yes +net: 2.16.0.0/13 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 2.58.58.0/24 descr: Hybula B.V. remarks: Generic anycast network @@ -250,6 +286,21 @@ descr: Quad9 remarks: Public anycast DNS resolver is-anycast: yes +net: 23.32.0.0/11 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + +net: 23.72.0.0/13 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + +net: 23.192.0.0/11 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 37.72.151.0/24 descr: LWLcom GmbH remarks: Generic anycast network @@ -575,6 +626,11 @@ descr: Thomas Steen Rasmussen / UncensoredDNS / censurfridns.dk remarks: Public anycast DNS resolver is-anycast: yes +net: 92.122.0.0/15 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 92.118.229.0/24 descr: Epik remarks: Generic anycast network @@ -650,6 +706,11 @@ descr: Vision247 remarks: Generic anycast network is-anycast: yes +net: 95.100.0.0/15 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 95.177.2.0/24 descr: Griffin Internet Infrastructure Anycast remarks: Generic anycast network @@ -660,6 +721,11 @@ descr: VikingHost remarks: Generic anycast network is-anycast: yes +net: 104.64.0.0/10 +descr: Akamai International B.V. +remarks: IP chunk in use for providing CDN services worldwide, subnets scatter across various Autonomous Systems +is-anycast: yes + net: 109.72.143.0/24 descr: GPC Services AG remarks: Generic anycast network @@ -1462,6 +1528,11 @@ descr: SafeDNS, Inc. remarks: Generic anycast network is-anycast: yes +net: 195.47.253.0/24 +descr: LLC "Hostmaster" +remarks: TLD operator's anycast network +is-anycast: yes + net: 195.80.153.0/24 descr: SAFECLOUDBOX remarks: Generic anycast network @@ -1587,6 +1658,11 @@ descr: Thomas Steen Rasmussen / UncensoredDNS / censurfridns.dk remarks: Public anycast DNS resolver is-anycast: yes +net: 2001:678:a80::/48 +descr: Informatics Solutions Limited +remarks: Generic anycast network +is-anycast: yes + net: 2606:4700:4700::/48 descr: Cloudflare, Inc. remarks: Public anycast DNS resolver @@ -1612,6 +1688,11 @@ descr: Thomas Harwood remarks: Public anycast DNS resolver is-anycast: yes +net: 2a06:e881:4300::/44 +descr: RISHIKESHAN LAVAKUMAR +remarks: Generic anycast network +is-anycast: yes + net: 2a07:59c6:d006::/48 descr: NetShelter remarks: Generic anycast network @@ -1627,6 +1708,11 @@ descr: Zeimudo Networks remarks: Generic anycast network is-anycast: yes +net: 2a0b:6b83::/48 +descr: Roelf Wichertjes +remarks: Generic anycast network +is-anycast: yes + net: 2a0c:3800:ff::/48 descr: Jean-Remy Buchs remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index e387dbd..ce5bdb5 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -23,10 +23,15 @@ descr: PJSC "Vimpelcom" remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS3741 +descr: Dimension Data +remarks: ISP (?) located in ZA, but some RIR data for announced prefixes contain garbage +country: ZA + aut-num: AS6134 descr: XNNET LLC remarks: traces back to an unknown oversea location (HK?), seems to tamper with RIR data -country: HK +country: AP aut-num: AS7203 descr: Leaseweb USA, Inc. @@ -53,6 +58,11 @@ descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region country: AP +aut-num: AS21100 +descr: ITL LLC +remarks: ISP headquatered in BG and/or UA, physically located in NL, some RIR data for announced prefixes contain inaccurate data +country: NL + aut-num: AS22769 descr: DDOSING NETWORK remarks: IP hijacker located somewhere in AP, massively tampers with RIR data @@ -78,6 +88,11 @@ descr: Netcalibre Ltd. remarks: ISP located in GB, but some RIR data for announced prefixes contain garbage country: GB +aut-num: AS26021 +descr: Unicycle, LLC +remarks: traces back to NL +country: NL + aut-num: AS27411 descr: Leaseweb USA, Inc. remarks: ISP located in US, but some RIR data for announced prefixes contain garbage @@ -128,6 +143,11 @@ descr: Neterra Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS39182 +descr: Netex Limited +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS39287 descr: ab stract / Peter Kolmisoppi remarks: tampers with RIR data, traces back to SE @@ -138,6 +158,11 @@ descr: Confluence Networks Inc. remarks: fake offshore location (VG), traces back to Austin, TX, US country: US +aut-num: AS40065 +descr: CNSERVERS LLC +remarks: Shady ISP located in US, tampers with RIR data +country: US + aut-num: AS41466 descr: Treidinvest LLC remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -146,7 +171,12 @@ country: BG aut-num: AS41564 descr: Packet Exchange Limited remarks: shady uplink for a bunch of dirty ISPs in SE (and likely elsewhere in EU), routing stolen AfriNIC networks, RIR data of prefixes announced by this AS cannot be trusted -country: EU +country: SE + +aut-num: AS41608 +descr: NextGenWebs, S.L. +remarks: traces back to NL +country: NL aut-num: AS42397 descr: Bunea TELECOM SRL @@ -165,14 +195,29 @@ country: GB aut-num: AS42960 descr: Cloud Management LLC -remarks: tampers with RIR data, traces back to HK -country: HK +remarks: tampers with RIR data, traces back to AP area +country: AP + +aut-num: AS43260 +descr: DGN TEKNOLOJI A.S. +remarks: ISP located in TR, but many RIR data for announced prefixes contain garbage +country: TR aut-num: AS43310 descr: TOV "LVS" remarks: ISP located in UA, but some RIR data for announced prefixes contain garbage country: UA +aut-num: AS43350 +descr: NForce Entertainment B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + +aut-num: AS43624 +descr: PQ HOSTING S.R.L. +remarks: tampers with RIR data sometimes, traces back to NL +country: NL + aut-num: AS44015 descr: Landgard Management Inc. remarks: bulletproof ISP with strong links to RU @@ -188,16 +233,16 @@ descr: PPTECHNOLOGY LIMITED remarks: bulletproof ISP (related to AS204655) located in NL country: NL -aut-num: AS41564 -descr: Global Colocation Limited -remarks: part of a dirty ISP conglomerate most likely operating out of SE -country: SE - aut-num: AS48721 descr: ADM Service Ltd. remarks: traces back to Vilnius, LT country: LT +aut-num: AS49392 +descr: LLC Baxet +remarks: tampers with RIR data, traces back to RU +country: RU + aut-num: AS49466 descr: KLAYER LLC remarks: part of the "Asline" IP hijacking gang, traces back to AP region @@ -218,11 +263,21 @@ descr: Tamatiya EOOD / 4Vendeta remarks: Questionable (at best) ISP located in BG, clients massively tamper with RIR data country: BG +aut-num: AS50673 +descr: Serverius Holding B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS51558 descr: Smart Telecom S.A.R.L remarks: tampers with RIR data, traces back to RU country: RU +aut-num: AS51659 +descr: LLC Baxet +remarks: tampers with RIR data, traces back to RU +country: RU + aut-num: AS55933 descr: Cloudie Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -238,6 +293,11 @@ descr: PE Skurykhin Mukola Volodumurovuch remarks: tampers with RIR data, traces back to UA country: UA +aut-num: AS57043 +descr: Hostkey B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS57717 descr: FiberXpress BV remarks: bulletproof ISP (related to AS202425) located in NL @@ -248,11 +308,26 @@ descr: DDOS-GUARD LTD remarks: shady ISP, customers massively tamper with RIR data, we cannot trust this network country: RU +aut-num: AS57756 +descr: Telefonica LLC +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS57858 descr: Inter Connects Inc. remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data country: SE +aut-num: AS57972 +descr: Inter Connects Inc. +remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking stolen AfriNIC networks, massively tampers with RIR data +country: SE + +aut-num: AS58061 +descr: Scalaxy B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS58073 descr: YISP BV remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage @@ -278,6 +353,11 @@ descr: Batterflyai Media Ltd. remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage country: RU +aut-num: AS60404 +descr: The Infrastructure Group B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS60412 descr: DignusData LLC remarks: ISP located in PL, but _all_ RIR data for announced prefixes contain garbage @@ -313,6 +393,11 @@ descr: VpsQuan L.L.C. remarks: claims to be located in US, but traces to HK country: HK +aut-num: AS62900 +descr: ColoMX LLC +remarks: ISP located in US, but many RIR data for announced prefixes contain garbage +country: US + aut-num: AS63119 descr: Inter Connects Inc. remarks: part of a dirty ISP conglomerate, traces back to US this time @@ -338,6 +423,11 @@ descr: Leaseweb Asia Pacific pte. ltd. remarks: ISP located in HK, some RIR data for announced prefixes contain garbage country: HK +aut-num: AS134196 +descr: ULan Network Limited +remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region +country: AP + aut-num: AS134351 descr: Leaseweb Japan K.K. remarks: ISP located in JP, some RIR data for announced prefixes contain garbage @@ -383,6 +473,11 @@ descr: ANLIAN NETWORK TECHNOLOGY CO., LIMITED remarks: ISP located in HK, tampers with RIR data country: HK +aut-num: AS139879 +descr: Galaxy Broadband +remarks: ISP located in PK, but announces 204.137.128.0/18, which is ARIN space, assigned to "AGIS" / Cogent - odd... +country: PK + aut-num: AS140733 descr: Wujidun Network Limited remarks: part of the "Asline" IP hijacking gang, tampers with RIR data, traces back to AP region @@ -440,8 +535,8 @@ country: NL aut-num: AS202492 descr: SILVERHILL GROUP HOLDING LTD / SAKIS POLUNIGIS -remarks: fake offshore location (SC), traces back to NL -country: NL +remarks: fake offshore location (SC), traces back to RU +country: RU aut-num: AS202769 descr: Cooperative Investments LLC @@ -458,6 +553,11 @@ descr: Kevin Holly trading as Silent Ghost e.U. remarks: AS run by someone who thinks allocating IP networks to AQ is funny (it is not, kid) :-/ country: NL +aut-num: AS204307 +descr: Rishikeshan Lavakumar +remarks: Network operator thinks messing with RIR data is funny... :-/ +country: EU + aut-num: AS204353 descr: Global Offshore Limited remarks: part of a dirty ISP conglomerate with links to SE, RIR data of prefixes announced by this AS cannot be trusted @@ -513,6 +613,11 @@ descr: Maximilian Kutzner trading as HostSlick remarks: traces back to NL, but some RIR data for announced prefixes contain garbage country: NL +aut-num: AS208258 +descr: Access2.IT Group B.V. +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS208410 descr: Internet Hosting Ltd. remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data @@ -553,6 +658,11 @@ descr: Harry Dowd remarks: ISP located in GB, but RIR data for announced prefixes contain garbage country: GB +aut-num: AS212477 +descr: RoyaleHosting B.V. +remarks: ISP located in NL, but RIR data for announced prefixes contain garbage +country: NL + aut-num: AS212962 descr: Quality Area Ltd. remarks: traceroutes dead-end somewhere near Crimera, UA @@ -798,6 +908,11 @@ descr: NetConn Services Ltd remarks: APNIC chunk owned by a HK-based company, routed to AP region, but assigned to SC country: AP +net: 193.186.196.0/22 +descr: QUIKA LTD +remarks: claims to be located in DE, traces back to GB +country: GB + net: 195.66.165.0/24 descr: Posta Crne Gore remarks: Orphaned RIR data, see: https://lists.ipfire.org/pipermail/location/2021-April/000267.html @@ -848,7 +963,22 @@ descr: Datashield, Inc. remarks: fake offshore location (SC), traces back to NL country: NL +net: 2a09:4c0:3000::/40 +descr: Securebit AG +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: CH + +net: 2a0e:b101:3000::/40 +descr: 4b42 UG (haftungsbeschränkt) +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: DE + net: 2a0f:7a80::/29 descr: ASLINE Limited remarks: APNIC chunk owned by a HK-based company, but assigned to DE country: AP + +net: 2a0f:e400:3000::/40 +descr: Kevin Buehl +remarks: ... who thinks assigning networks to unpopulated Bouvet Island (BV) is funny :-/ +country: CH -- 2.26.2

1 0

[PATCH] location-importer.in: import additional IP information for Amazon AWS IP networks
by Peter Müller 10 Jun '21

10 Jun '21

Amazon publishes information regarding some of their IP networks primarily used for AWS cloud services in a machine-readable format. To improve libloc lookup results for these, we have little choice other than importing and parsing them. Unfortunately, there seems to be no machine-readable list of the locations of their data centers or availability zones available. If there _is_ any, please let the author know. Fixes: #12594 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 110 ++++++++++++++++++++++++++++++++ 1 file changed, 110 insertions(+) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 1e08458..5be1d61 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -19,6 +19,7 @@ import argparse import ipaddress +import json import logging import math import re @@ -931,6 +932,10 @@ class CLI(object): TRUNCATE TABLE network_overrides; """) + # Update overrides for various cloud providers big enough to publish their own IP + # network allocation lists in a machine-readable format... + self._update_overrides_for_aws() + for file in ns.files: log.info("Reading %s..." % file) @@ -998,6 +1003,111 @@ class CLI(object): else: log.warning("Unsupported type: %s" % type) + def _update_overrides_for_aws(self): + # Download Amazon AWS IP allocation file to create overrides... + downloader = location.importer.Downloader() + + try: + with downloader.request("https://ip-ranges.amazonaws.com/ip-ranges.json", return_blocks=False) as f: + aws_ip_dump = json.load(f.body) + except Exception as e: + log.error("unable to preprocess Amazon AWS IP ranges: %s" % e) + return + + # XXX: Set up a dictionary for mapping a region name to a country. Unfortunately, + # there seems to be no machine-readable version available of this other than + # https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availabil… + # (worse, it seems to be incomplete :-/ ); https://www.cloudping.cloud/endpoints + # was helpful here as well. + aws_region_country_map = { + "af-south-1": "ZA", + "ap-east-1": "HK", + "ap-south-1": "IN", + "ap-south-2": "IN", + "ap-northeast-3": "JP", + "ap-northeast-2": "KR", + "ap-southeast-1": "SG", + "ap-southeast-2": "AU", + "ap-southeast-3": "MY", + "ap-northeast-1": "JP", + "ca-central-1": "CA", + "eu-central-1": "DE", + "eu-central-2": "CH", + "eu-west-1": "IE", + "eu-west-2": "GB", + "eu-south-1": "IT", + "eu-south-2": "ES", + "eu-west-3": "FR", + "eu-north-1": "SE", + "me-south-1": "BH", + "sa-east-1": "BR" + } + + # Fetch all valid country codes to check parsed networks aganist... + rows = self.db.query("SELECT * FROM countries ORDER BY country_code") + validcountries = [] + + for row in rows: + validcountries.append(row.country_code) + + with self.db.transaction(): + for snetwork in aws_ip_dump["prefixes"] + aws_ip_dump["ipv6_prefixes"]: + try: + network = ipaddress.ip_network(snetwork.get("ip_prefix") or snetwork.get("ipv6_prefix"), strict=False) + except ValueError: + log.warning("Unable to parse line: %s" % snetwork) + continue + + # Sanitize parsed networks... + if not self._check_parsed_network(network): + continue + + # Determine region of this network... + region = snetwork["region"] + cc = None + is_anycast = False + + # Any region name starting with "us-" will get "US" country code assigned straight away... + if region.startswith("us-"): + cc = "US" + elif region.startswith("cn-"): + # ... same goes for China ... + cc = "CN" + elif region == "GLOBAL": + # ... funny region name for anycast-like networks ... + is_anycast = True + elif region in aws_region_country_map: + # ... assign looked up country code otherwise ... + cc = aws_region_country_map[region] + else: + # ... and bail out if we are missing something here + log.warning("Unable to determine country code for line: %s" % snetwork) + continue + + # Skip networks with unknown country codes + if not is_anycast and validcountries and cc not in validcountries: + log.warning("Skipping Amazon AWS network with bogus country '%s': %s" % \ + (cc, network)) + return + + # Conduct SQL statement... + self.db.execute(""" + INSERT INTO network_overrides( + network, + country, + is_anonymous_proxy, + is_satellite_provider, + is_anycast + ) VALUES (%s, %s, %s, %s, %s) + ON CONFLICT (network) DO NOTHING""", + "%s" % network, + cc, + None, + None, + is_anycast, + ) + + @staticmethod def _parse_bool(block, key): val = block.get(key) -- 2.26.2

2 11

[PATCH v2] location-importer.in: Import (technical) AS names from ARIN
by Peter Müller 10 Jun '21

10 Jun '21

ARIN and LACNIC, unfortunately, do not seem to publish data containing human readable AS names. For the former, we at least have a list of tecnical names, which this patch fetches and inserts into the autnums table. While some of them do not seem to be suitable for human consumption (i. e. being very cryptic), providing these data might be helpful neverthelesss. The second version of this patch contains some additional remarks on efficient Python coding style from Michael, doing things more "pythonic". Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 55 +++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index aa3b8f7..6ccee3b 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -505,6 +505,9 @@ class CLI(object): for line in f: self._parse_line(line, source_key, validcountries) + # Download and import (technical) AS names from ARIN + self._import_as_names_from_arin() + def _check_parsed_network(self, network): """ Assistive function to detect and subsequently sort out parsed @@ -775,6 +778,58 @@ class CLI(object): "%s" % network, country, [country], source_key, ) + def _import_as_names_from_arin(self): + downloader = location.importer.Downloader() + + # XXX: Download AS names file from ARIN (note that these names appear to be quite + # technical, not intended for human consumption, as description fields in + # organisation handles for other RIRs are - however, this is what we have got, + # and in some cases, it might be still better than nothing) + with downloader.request("https://ftp.arin.net/info/asn.txt", return_blocks=False) as f: + for line in f: + # Convert binary line to string... + line = str(line) + + # ... valid lines start with a space, followed by the number of the Autonomous System ... + if not line.startswith(" "): + continue + + # Split line and check if there is a valid ASN in it... + asn, name = line.split()[0:2] + + try: + asn = int(asn) + except ValueError: + log.debug("Skipping ARIN AS names line not containing an integer for ASN") + continue + + if not ((1 <= asn and asn <= 23455) or (23457 <= asn and asn <= 64495) or (131072 <= asn and asn <= 4199999999)): + log.debug("Skipping ARIN AS names line not containing a valid ASN: %s" % asn) + continue + + # Skip any AS name that appears to be a placeholder for a different RIR or entity... + if re.match(r"^(ASN-BLK|)(AFCONC|AFRINIC|APNIC|ASNBLK|DNIC|LACNIC|RIPE|IANA)(\d?$|\-.*)", name): + continue + + # Bail out in case the AS name contains anything we do not expect here... + if re.search(r"[^a-zA-Z0-9-_]", name): + log.debug("Skipping ARIN AS name for %s containing invalid characters: %s" % \ + (asn, name)) + + # Things look good here, run INSERT statement and skip this one if we already have + # a (better?) name for this Autonomous System... + self.db.execute(""" + INSERT INTO autnums( + number, + name, + source + ) VALUES (%s, %s, %s) + ON CONFLICT (number) DO NOTHING""", + asn, + name, + "ARIN", + ) + def handle_update_announcements(self, ns): server = ns.server[0] -- 2.20.1

2 1

2024

2023

2022

2021

2020

2019

2018

2017

Location June 2021