- Location - lists.ipfire.org

Update AS, Country ...
by Sebastian Urbach 22 May '21

22 May '21

Dear List, The Ipfire location database needs an update regarding the IP 194.233.71.100. Seems to me that the owner of the IP block has changed. Please check with: https://wq.apnic.net/static/search.html?query=194.233.71.100 Thanks -- Sincerely yours / M.f.G. / Sincères salutations Sebastian Urbach

2 1

[PATCH 1/2] location-importer.in: keep track of sources for networks, ASNs, and organisations
by Peter Müller 21 May '21

21 May '21

This allows us to trace back concrete changes or anomalies to their RIR source, without having to parse everything again. Further, it enables adding 3rd party sources such as IP feeds from Amazon, without loosing track of the changes introduced by them. Depending on the individual systems, it might be necessary to DROP the tables for autnums and networks first. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 93 +++++++++++++++++---------------- 1 file changed, 49 insertions(+), 44 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index e5f55af..fd2bde1 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -155,7 +155,7 @@ class CLI(object): CREATE INDEX IF NOT EXISTS announcements_search ON announcements USING GIST(network inet_ops); -- autnums - CREATE TABLE IF NOT EXISTS autnums(number bigint, name text NOT NULL); + CREATE TABLE IF NOT EXISTS autnums(number bigint, name text NOT NULL, source text NOT NULL); CREATE UNIQUE INDEX IF NOT EXISTS autnums_number ON autnums(number); -- countries @@ -164,7 +164,7 @@ class CLI(object): CREATE UNIQUE INDEX IF NOT EXISTS countries_country_code ON countries(country_code); -- networks - CREATE TABLE IF NOT EXISTS networks(network inet, country text); + CREATE TABLE IF NOT EXISTS networks(network inet, country text, source text NOT NULL); CREATE UNIQUE INDEX IF NOT EXISTS networks_network ON networks(network); CREATE INDEX IF NOT EXISTS networks_family ON networks USING BTREE(family(network)); CREATE INDEX IF NOT EXISTS networks_search ON networks USING GIST(network inet_ops); @@ -369,15 +369,15 @@ class CLI(object): with self.db.transaction(): # Create some temporary tables to store parsed data self.db.execute(""" - CREATE TEMPORARY TABLE _autnums(number integer, organization text) + CREATE TEMPORARY TABLE _autnums(number integer, organization text, source text NOT NULL) ON COMMIT DROP; CREATE UNIQUE INDEX _autnums_number ON _autnums(number); - CREATE TEMPORARY TABLE _organizations(handle text, name text NOT NULL) + CREATE TEMPORARY TABLE _organizations(handle text, name text NOT NULL, source text NOT NULL) ON COMMIT DROP; CREATE UNIQUE INDEX _organizations_handle ON _organizations(handle); - CREATE TEMPORARY TABLE _rirdata(network inet NOT NULL, country text NOT NULL) + CREATE TEMPORARY TABLE _rirdata(network inet NOT NULL, country text NOT NULL, source text NOT NULL) ON COMMIT DROP; CREATE INDEX _rirdata_search ON _rirdata USING BTREE(family(network), masklen(network)); CREATE UNIQUE INDEX _rirdata_network ON _rirdata(network); @@ -395,10 +395,11 @@ class CLI(object): for row in rows: validcountries.append(row.country_code) - for source in location.importer.WHOIS_SOURCES: - with downloader.request(source, return_blocks=True) as f: - for block in f: - self._parse_block(block, validcountries) + for source_key in location.importer.WHOIS_SOURCES: + for single_url in location.importer.WHOIS_SOURCES[source_key]: + with downloader.request(single_url, return_blocks=True) as f: + for block in f: + self._parse_block(block, source_key, validcountries) # Process all parsed networks from every RIR we happen to have access to, # insert the largest network chunks into the networks table immediately... @@ -407,8 +408,8 @@ class CLI(object): for family in (row.family for row in families): smallest = self.db.get("SELECT MIN(masklen(network)) AS prefix FROM _rirdata WHERE family(network) = %s", family) - self.db.execute("INSERT INTO networks(network, country) \ - SELECT network, country FROM _rirdata WHERE masklen(network) = %s AND family(network) = %s", smallest.prefix, family) + self.db.execute("INSERT INTO networks(network, country, source) \ + SELECT network, country, source FROM _rirdata WHERE masklen(network) = %s AND family(network) = %s", smallest.prefix, family) # ... determine any other prefixes for this network family, ... prefixes = self.db.query("SELECT DISTINCT masklen(network) AS prefix FROM _rirdata \ @@ -421,7 +422,8 @@ class CLI(object): WITH candidates AS ( SELECT _rirdata.network, - _rirdata.country + _rirdata.country, + _rirdata.source FROM _rirdata WHERE @@ -434,6 +436,7 @@ class CLI(object): DISTINCT ON (c.network) c.network, c.country, + c.source, masklen(networks.network), networks.country AS parent_country FROM @@ -447,10 +450,11 @@ class CLI(object): masklen(networks.network) DESC NULLS LAST ) INSERT INTO - networks(network, country) + networks(network, country, source) SELECT network, - country + country, + source FROM filtered WHERE @@ -462,19 +466,20 @@ class CLI(object): ) self.db.execute(""" - INSERT INTO autnums(number, name) - SELECT _autnums.number, _organizations.name FROM _autnums + INSERT INTO autnums(number, name, source) + SELECT _autnums.number, _organizations.name, _organizations.source FROM _autnums JOIN _organizations ON _autnums.organization = _organizations.handle ON CONFLICT (number) DO UPDATE SET name = excluded.name; """) # Download all extended sources - for source in location.importer.EXTENDED_SOURCES: - with self.db.transaction(): - # Download data - with downloader.request(source) as f: - for line in f: - self._parse_line(line, validcountries) + for source_key in location.importer.EXTENDED_SOURCES: + for single_url in location.importer.EXTENDED_SOURCES[source_key]: + with self.db.transaction(): + # Download data + with downloader.request(single_url) as f: + for line in f: + self._parse_line(line, source_key, validcountries) def _check_parsed_network(self, network): """ @@ -539,23 +544,23 @@ class CLI(object): # be suitable for libloc consumption... return True - def _parse_block(self, block, validcountries = None): + def _parse_block(self, block, source_key, validcountries = None): # Get first line to find out what type of block this is line = block[0] # aut-num if line.startswith("aut-num:"): - return self._parse_autnum_block(block) + return self._parse_autnum_block(block, source_key) # inetnum if line.startswith("inet6num:") or line.startswith("inetnum:"): - return self._parse_inetnum_block(block, validcountries) + return self._parse_inetnum_block(block, source_key, validcountries) # organisation elif line.startswith("organisation:"): - return self._parse_org_block(block) + return self._parse_org_block(block, source_key) - def _parse_autnum_block(self, block): + def _parse_autnum_block(self, block, source_key): autnum = {} for line in block: # Split line @@ -574,13 +579,13 @@ class CLI(object): return # Insert into database - self.db.execute("INSERT INTO _autnums(number, organization) \ - VALUES(%s, %s) ON CONFLICT (number) DO UPDATE SET \ + self.db.execute("INSERT INTO _autnums(number, organization, source) \ + VALUES(%s, %s, %s) ON CONFLICT (number) DO UPDATE SET \ organization = excluded.organization", - autnum.get("asn"), autnum.get("org"), + autnum.get("asn"), autnum.get("org"), source_key, ) - def _parse_inetnum_block(self, block, validcountries = None): + def _parse_inetnum_block(self, block, source_key, validcountries = None): log.debug("Parsing inetnum block:") inetnum = {} @@ -636,12 +641,12 @@ class CLI(object): break # Everything is fine here, run INSERT statement... - self.db.execute("INSERT INTO _rirdata(network, country) \ - VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", - "%s" % single_network, inetnum.get("country"), + self.db.execute("INSERT INTO _rirdata(network, country, source) \ + VALUES(%s, %s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", + "%s" % single_network, inetnum.get("country"), source_key, ) - def _parse_org_block(self, block): + def _parse_org_block(self, block, source_key): org = {} for line in block: # Split line @@ -656,13 +661,13 @@ class CLI(object): if not org: return - self.db.execute("INSERT INTO _organizations(handle, name) \ - VALUES(%s, %s) ON CONFLICT (handle) DO \ + self.db.execute("INSERT INTO _organizations(handle, name, source) \ + VALUES(%s, %s, %s) ON CONFLICT (handle) DO \ UPDATE SET name = excluded.name", - org.get("organisation"), org.get("org-name"), + org.get("organisation"), org.get("org-name"), source_key, ) - def _parse_line(self, line, validcountries = None): + def _parse_line(self, line, source_key, validcountries = None): # Skip version line if line.startswith("2"): return @@ -689,9 +694,9 @@ class CLI(object): return if type in ("ipv6", "ipv4"): - return self._parse_ip_line(country_code, type, line) + return self._parse_ip_line(country_code, type, line, source_key) - def _parse_ip_line(self, country, type, line): + def _parse_ip_line(self, country, type, line, source_key): try: address, prefix, date, status, organization = line.split("|") except ValueError: @@ -729,10 +734,10 @@ class CLI(object): if not self._check_parsed_network(network): return - self.db.execute("INSERT INTO networks(network, country) \ - VALUES(%s, %s) ON CONFLICT (network) DO \ + self.db.execute("INSERT INTO networks(network, country, source) \ + VALUES(%s, %s, %s) ON CONFLICT (network) DO \ UPDATE SET country = excluded.country", - "%s" % network, country, + "%s" % network, country, source_key, ) def handle_update_announcements(self, ns): -- 2.20.1

1 2

[PATCH] location-importer.in: track original countries as well
by Peter Müller 21 May '21

21 May '21

This helps us to determine how many network objects have more than one country set, and what their original country code set looked like. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 53 ++++++++++++++++++++------------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index e5f55af..c7162cf 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -164,7 +164,7 @@ class CLI(object): CREATE UNIQUE INDEX IF NOT EXISTS countries_country_code ON countries(country_code); -- networks - CREATE TABLE IF NOT EXISTS networks(network inet, country text); + CREATE TABLE IF NOT EXISTS networks(network inet, country text, original_countries text[]); CREATE UNIQUE INDEX IF NOT EXISTS networks_network ON networks(network); CREATE INDEX IF NOT EXISTS networks_family ON networks USING BTREE(family(network)); CREATE INDEX IF NOT EXISTS networks_search ON networks USING GIST(network inet_ops); @@ -377,7 +377,7 @@ class CLI(object): ON COMMIT DROP; CREATE UNIQUE INDEX _organizations_handle ON _organizations(handle); - CREATE TEMPORARY TABLE _rirdata(network inet NOT NULL, country text NOT NULL) + CREATE TEMPORARY TABLE _rirdata(network inet NOT NULL, country text NOT NULL, original_countries text[]) ON COMMIT DROP; CREATE INDEX _rirdata_search ON _rirdata USING BTREE(family(network), masklen(network)); CREATE UNIQUE INDEX _rirdata_network ON _rirdata(network); @@ -407,8 +407,8 @@ class CLI(object): for family in (row.family for row in families): smallest = self.db.get("SELECT MIN(masklen(network)) AS prefix FROM _rirdata WHERE family(network) = %s", family) - self.db.execute("INSERT INTO networks(network, country) \ - SELECT network, country FROM _rirdata WHERE masklen(network) = %s AND family(network) = %s", smallest.prefix, family) + self.db.execute("INSERT INTO networks(network, country, original_countries) \ + SELECT network, country, original_countries FROM _rirdata WHERE masklen(network) = %s AND family(network) = %s", smallest.prefix, family) # ... determine any other prefixes for this network family, ... prefixes = self.db.query("SELECT DISTINCT masklen(network) AS prefix FROM _rirdata \ @@ -421,7 +421,8 @@ class CLI(object): WITH candidates AS ( SELECT _rirdata.network, - _rirdata.country + _rirdata.country, + _rirdata.original_countries FROM _rirdata WHERE @@ -434,6 +435,7 @@ class CLI(object): DISTINCT ON (c.network) c.network, c.country, + c.original_countries, masklen(networks.network), networks.country AS parent_country FROM @@ -447,10 +449,11 @@ class CLI(object): masklen(networks.network) DESC NULLS LAST ) INSERT INTO - networks(network, country) + networks(network, country, original_countries) SELECT network, - country + country, + original_countries FROM filtered WHERE @@ -617,28 +620,36 @@ class CLI(object): inetnum[key] = [ipaddress.ip_network(val, strict=False)] elif key == "country": - inetnum[key] = val.upper() + # Catch RIR data objects with more than one country code... + if not key in inetnum.keys(): + inetnum[key] = [] + else: + if val.upper() in inetnum.get("country"): + # ... but keep this list distinct... + continue + + inetnum[key].append(val.upper()) # Skip empty objects if not inetnum or not "country" in inetnum: return + # Prepare skipping objects with unknown country codes... + invalidcountries = [singlecountry for singlecountry in inetnum.get("country") if singlecountry not in validcountries] + # Iterate through all networks enumerated from above, check them for plausibility and insert # them into the database, if _check_parsed_network() succeeded for single_network in inetnum.get("inet6num") or inetnum.get("inetnum"): if self._check_parsed_network(single_network): - - # Skip objects with unknown country codes - to avoid log spam for invalid or too small - # networks, this check is - kinda ugly - done at this point - if validcountries and inetnum.get("country") not in validcountries: - log.warning("Skipping network with bogus country '%s': %s" % \ - (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) + # Skip objects with unknown country codes if they are valid to avoid log spam... + if validcountries and invalidcountries: + log.warning("Skipping network with bogus countr(y|ies) %s (original countries: %s): %s" % \ + (invalidcountries, inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) break - # Everything is fine here, run INSERT statement... - self.db.execute("INSERT INTO _rirdata(network, country) \ - VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", - "%s" % single_network, inetnum.get("country"), + self.db.execute("INSERT INTO _rirdata(network, country, original_countries) \ + VALUES(%s, %s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", + "%s" % single_network, inetnum.get("country")[0], inetnum.get("country"), ) def _parse_org_block(self, block): @@ -729,10 +740,10 @@ class CLI(object): if not self._check_parsed_network(network): return - self.db.execute("INSERT INTO networks(network, country) \ - VALUES(%s, %s) ON CONFLICT (network) DO \ + self.db.execute("INSERT INTO networks(network, country, original_countries) \ + VALUES(%s, %s, %s) ON CONFLICT (network) DO \ UPDATE SET country = excluded.country", - "%s" % network, country, + "%s" % network, country, [country], ) def handle_update_announcements(self, ns): -- 2.26.2

2 3

[PATCH] location.in: fix search_networks() function call
by Peter Müller 18 May '21

18 May '21

Fixes: #12617 Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/location.in b/src/python/location.in index ad2ccf5..e02b4e8 100644 --- a/src/python/location.in +++ b/src/python/location.in @@ -506,7 +506,7 @@ class CLI(object): f = writer(sys.stdout, prefix=country_code) # Print all matching networks - for n in db.search_networks(country_code=country_code, family=ns.family): + for n in db.search_networks(country_codes=[country_code], family=ns.family): f.write(n) f.finish() -- 2.26.2

3 3

[PATCH] location-importer.in: treat AQ and BV as invalid countries
by Peter Müller 18 May '21

18 May '21

Both the Bouvet Island (BV) and Antarctica (AQ) are unpopulated at the time of writing. Network owners/operators putting these countries into their RIR data objects are either completely braindead or doing so for hostile reasons. While we might correct these locations to something useful by manually creating overrides for them, the rationale behind this patch is not to let these countries appear on productive systems in the first place, as we know they _cannot_ be true. Therefore, this patch skips any network object that has either AQ or BV country code set. See also: https://lists.ipfire.org/pipermail/location/2020-October/000199.html Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 1e08458..ac678dc 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -624,7 +624,7 @@ class CLI(object): return # Skip objects with unknown country codes - if validcountries and inetnum.get("country") not in validcountries: + if validcountries and (inetnum.get("country") not in validcountries or inetnum.get("country") in ["AQ", "BV"]): log.warning("Skipping network with bogus country '%s': %s" % \ (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) return -- 2.26.2

2 7

[PATCH] regular batch of various overrides
by Peter Müller 16 May '21

16 May '21

Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 5 ++++ overrides/override-a2.txt | 45 ++++++++++++++++++++++++++++++++++++ overrides/override-other.txt | 25 ++++++++++++++++---- 3 files changed, 70 insertions(+), 5 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index fc97098..3a65232 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -703,6 +703,11 @@ descr: Privax LTD remarks: VPN provider is-anonymous-proxy: yes +net: 92.50.201.0/24 +descr: "InsatCom-V, ISP: Leased lines, VPN (city Volgograd)" +remarks: VPN provider (or something similar) +is-anonymous-proxy: yes + net: 92.118.39.0/24 descr: CloudMine NET remarks: VPN provider [high confidence, but not proofed] diff --git a/overrides/override-a2.txt b/overrides/override-a2.txt index f53053b..b8b3b08 100644 --- a/overrides/override-a2.txt +++ b/overrides/override-a2.txt @@ -197,6 +197,16 @@ descr: Shaw Satellite Services, Inc. remarks: Satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes +aut-num: AS35410 +descr: LVS Transnational Corporation (tm) OOO Nord-telecom +remarks: Satellite Internet provider [high confidence, but not proofed] +is-satellite-provider: yes + +aut-num: AS37019 +descr: Intersat Africa Ltd +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS37296 descr: Afcom Satellite Networks Nigeria Limited remarks: Satellite Internet provider @@ -247,6 +257,11 @@ descr: AXESS Networks Solutions Germany GmbH / CeTEL GmbH / GeoLink remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS39668 +descr: Intersat SRL +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS40305 descr: ViaSat, Inc. remarks: Satellite Internet provider @@ -288,6 +303,11 @@ descr: Telenor Satellite AS remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS44064 +descr: ChronoSat GmbH +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS44720 descr: SatTel Corporation, Ltd. remarks: Satellite Internet provider @@ -423,16 +443,36 @@ descr: YahClick / Star Satellite Communications Company - PJSC remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS207102 +descr: Intersat Telekomunikacije d.o.o. +remarks: Satellite Internet provider +is-satellite-provider: yes + +aut-num: AS208484 +descr: EuroSkyPark GmbH +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS208756 descr: ALCON TELECOM LTD remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS265676 +descr: INTERSAT S.A. +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS265705 descr: HUGHES DE COLOMBIA S.A.S. remarks: Satellite Internet provider is-satellite-provider: yes +aut-num: AS327780 +descr: Intersat Africa Ltd. +remarks: Satellite Internet provider +is-satellite-provider: yes + aut-num: AS327870 descr: Global Broadband Solution remarks: Satellite Internet provider [high confidence, but not proofed] @@ -2053,3 +2093,8 @@ descr: CoreLink Communications remarks: Chinese satellite Internet provider [high confidence, but not proofed] is-satellite-provider: yes country: AP + +net: 2c0f:fad8::/32 +descr: Intersat Africa Ltd. +remarks: Satellite Internet provider +is-satellite-provider: yes diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 4446279..0b521d1 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -248,16 +248,21 @@ descr: Inter Connects Inc. / Jing Yun remarks: part of a dirty ISP conglomerate operating most likely out of SE, hijacking AfriNIC networks country: SE -aut-num: AS62355 -descr: Network Dedicated SAS -remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL -country: NL - aut-num: AS61977 descr: Vivo Trade L.P. remarks: another shady customer of "DDoS Guard Ltd." country: RU +aut-num: AS62068 +descr: SpectraIP B.V. +remarks: bulletproof ISP (linked to AS202425 et al.) located in NL +country: NL + +aut-num: AS62355 +descr: Network Dedicated SAS +remarks: bulletproof ISP and IP hijacker, claims to be located in CH, but traces to NL +country: NL + aut-num: AS62468 descr: VpsQuan L.L.C. remarks: claims to be located in US, but traces to HK @@ -268,6 +273,11 @@ descr: Inter Connects Inc. remarks: part of a dirty ISP conglomerate, traces back to US this time country: US +aut-num: AS64425 +descr: SKB Enterprise B.V. +remarks: bulletproof ISP (linked to AS202425 et al.) located in NL +country: NL + aut-num: AS64437 descr: NForce Entertainment BV remarks: currently hijacks a single stolen /20 AfriNIC IPv4 net, hosted in NL @@ -443,6 +453,11 @@ descr: Kakharov Orinbassar Maratuly remarks: ISP located in RU, but RIR data for announced prefixes contain garbage country: RU +aut-num: AS212231 +descr: Harry Dowd +remarks: ISP located in GB, but RIR data for announced prefixes contain garbage +country: GB + aut-num: AS213035 descr: Serverion BV remarks: ISP located in NL, but RIR data for most announced prefixes contain garbage -- 2.26.2

1 0

How should location-importer.in deal with RIR objects having multiple distinct "country" fields?
by Peter Müller 14 May '21

14 May '21

Hello Michael, hello location folks (CC'ed), unfortunately, another problem surfaces when processing inetnum and inet6num feeds from RIRs which provide that kind of more precise data: A decent amount of network objects have multiple distinct "country" fields. Here is an example: > inetnum: 178.79.192.0 - 178.79.255.255 > netname: EU-LLNW-20100512 > country: EU > country: SE > country: DE > country: NL > country: GB > country: ES > country: FR > country: IT > org: ORG-LNI1-RIPE > admin-c: GU2143-RIPE > tech-c: GU2143-RIPE > status: ALLOCATED PA > remarks: ****************** ABUSE COMPLAINTS TO: abuse(a)limelightnetworks.com > mnt-by: RIPE-NCC-HM-MNT > mnt-by: LLNW-MNT > mnt-domains: LLNW-MNT > mnt-routes: LLNW-MNT > created: 2010-05-12T16:20:38Z > last-modified: 2017-09-01T17:39:08Z > source: RIPE # Filtered Currently, the last country item is made persistent via the SQL INSERT statement. Since these do not appear to be sorted in any way, this makes things completely nondeterministic. The network above would be, however, recoverable: If we do not interpret "EU" as the European Union, but rather as the European country, all other country codes given here would be covered by it. Alas, this is not helping in cases such as these two: > Country of network [IPv4Network('77.74.172.0/23')] already set to 'CH', omitting 'FI' (multiple country lines in RIR data?) > Country of network [IPv4Network('185.253.140.0/24')] already set to 'GB', omitting 'NL' (multiple country lines in RIR data?) > Country of network [IPv4Network('185.253.140.0/24')] already set to 'GB', omitting 'US' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'US' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'JP' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'SG' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'AU' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'NL' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'FR' (multiple country lines in RIR data?) > Country of network [IPv4Network('213.230.255.0/24')] already set to 'GB', omitting 'DE' (multiple country lines in RIR data?) > Country of network [IPv4Network('193.109.168.0/22')] already set to 'GB', omitting 'US' (multiple country lines in RIR data?) There are _plenty_ of such networks, I believe RIPE IPv4 only fills several screen pages. Nothing in life is ever easy, and parsing RIR data definitely isn't... :-/ Delegating the task of handling such situations to the application using libloc does not make sense to me, as people are _expecting_ precise answers from it - if we can use the term of preciseness here at all -, otherwise, they could simply parse RIR data on their own. Therefore, we have to somehow make do with this. Possible options would be as follows: (a) We do not process such networks entirely. If a network operator wants to have his/her network covered by libloc, he/she/it should kindly fix it's RIR data. That would not prevent us from obtaining announcements for such networks, but we would not label them with any country anymore. (b) We try to automatically determine meaningful codes in each case. This is tricky and not very deterministic. What about a network having "CY" and "TR" set? Would that be covered by "EU"? 213.230.255.0/24 seems to be used worldwide, but in my point of view, this is not sufficient to classify it as an anycast network. Worse, we have or should assign a country code to anycast networks as well. (c) We try to determine the jurisdiction of a networks' organisation handle. Frankly, I have no idea what problems would arise in this case. If an organisation fails to provide accurate and meaningful RIR data, what will their organisation handle possibly look like? Trying to keep things deterministic, (a) is my current favorite - it is the most brutal, though. Do you see a better way of dealing with such networks? @All: Thoughts? Comments? Opinions? Thanks, and best regards, Peter Müller

2 4

[PATCH] override-{a{1,3},other}: weekly batch of various overrides
by Peter Müller 14 May '21

14 May '21

AS58110 is especially interesting... Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-a1.txt | 12 +++++++++++- overrides/override-a3.txt | 15 +++++++++++++++ overrides/override-other.txt | 37 +++++++++++++++++++++++++++++++++++- 3 files changed, 62 insertions(+), 2 deletions(-) diff --git a/overrides/override-a1.txt b/overrides/override-a1.txt index 06d2d20..fc97098 100644 --- a/overrides/override-a1.txt +++ b/overrides/override-a1.txt @@ -46,7 +46,7 @@ is-anonymous-proxy: yes aut-num: AS34962 descr: Epik Network -remarks: VPN provider +remarks: Shady ISP and registrar, many prefixes announced refer to "anonymize" infrastructure is-anonymous-proxy: yes aut-num: AS35029 @@ -110,6 +110,11 @@ remarks: Autonomous System registered to offshore company, abuse contact is a is-anonymous-proxy: yes country: AP +aut-num: AS58110 +descr: IP Volume Ltd. / Epik +remarks: Shady Autonomous System registered to letterbox company, possibly copycat operation of Epik registrar, many prefixes announced refer to "anonymize" infrastructure +is-anonymous-proxy: yes + aut-num: AS58546 descr: Astrill VPN remarks: VPN provider @@ -1045,6 +1050,11 @@ descr: Access Now remarks: Tor relay provider is-anonymous-proxy: yes +net: 176.119.142.0/24 +descr: Artykova Alina Biktimerovna / BroVPN +remarks: VPN provider +is-anonymous-proxy: yes + net: 178.170.136.0/22 descr: GZ Systems Limited / PureVPN remarks: VPN provider diff --git a/overrides/override-a3.txt b/overrides/override-a3.txt index 36e03a3..ec246c1 100644 --- a/overrides/override-a3.txt +++ b/overrides/override-a3.txt @@ -190,6 +190,16 @@ descr: Hybula B.V. remarks: Generic anycast network is-anycast: yes +net: 5.182.48.0/24 +descr: FluxCDN +remarks: Generic anycast network +is-anycast: yes + +net: 5.182.49.0/24 +descr: FluxCDN +remarks: Generic anycast network +is-anycast: yes + net: 5.254.74.0/24 descr: VOXILITY LLC remarks: Generic anycast network @@ -535,6 +545,11 @@ descr: Thomas Steen Rasmussen / UncensoredDNS / censurfridns.dk remarks: Public anycast DNS resolver is-anycast: yes +net: 92.118.229.0/24 +descr: Epik +remarks: Generic anycast network +is-anycast: yes + net: 92.223.95.0/24 descr: G-Core Labs S.A. remarks: Generic anycast network diff --git a/overrides/override-other.txt b/overrides/override-other.txt index e56a208..4446279 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -93,6 +93,11 @@ descr: Neterra Ltd. remarks: ISP located in BG, but some RIR data for announced prefixes contain garbage country: BG +aut-num: AS35624 +descr: Neterra Ltd. +remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage +country: RU + aut-num: AS39287 descr: ab stract / Peter Kolmisoppi remarks: tampers with RIR data, traces back to SE @@ -378,6 +383,11 @@ descr: Genius Guard / Genius Security Ltd. remarks: another shady customer of "DDoS Guard Ltd.", probably located in RU country: RU +aut-num: AS206898 +descr: Server Hosting Pty Ltd +remarks: ISP located in NL, but some RIR data for announced prefixes contain garbage +country: NL + aut-num: AS207046 descr: Xtudio Networks S.L.U. remarks: ISP located in ES, but some RIR data for announced prefixes contain garbage @@ -423,6 +433,11 @@ descr: Gudaev Maxim Amrakhovich remarks: announcements scatter across various places in EU (DE/CZ/??), but RIR data contain garbage country: EU +aut-num: AS210119 +descr: VPSSC Networks LTD +remarks: ISP located in UA, but RIR data for announced prefixes contain garbage +country: UA + aut-num: AS211849 descr: Kakharov Orinbassar Maratuly remarks: ISP located in RU, but RIR data for announced prefixes contain garbage @@ -508,6 +523,11 @@ descr: FlokiNET Ltd. remarks: fake offshore location (SC), traces back to RO country: RO +net: 45.89.97.0/24 +descr: IP Volume Ltd. / Epik +remarks: fake location (CH), traces back to GB +country: GB + net: 45.93.16.0/22 descr: IPv4 Superhub Limited remarks: network owned by an HK company, traces back to HK as well - but is assigned to DE. Nice try... @@ -515,7 +535,7 @@ country: HK net: 45.134.12.0/24 descr: MS Network LTD -remarks: fake offshore location (SC), traces back to NLm +remarks: fake offshore location (SC), traces back to NL country: NL net: 45.134.144.0/22 @@ -548,6 +568,21 @@ descr: Golden Internet LLC remarks: fake location (KP), WHOIS contact points to RU country: RU +net: 91.149.194.0/24 +descr: IP Volume Ltd. / Epik +remarks: fake location (CH), traces back to SE +country: SE + +net: 91.149.195.0/24 +descr: IP Volume Ltd. / Epik +remarks: fake location (CH), traces back to SE +country: SE + +net: 91.149.224.0/24 +descr: IP Volume Ltd. / Epik +remarks: fake location (CH), traces back to NO +country: NO + net: 91.243.32.0/19 descr: Petersburg Internet Network Ltd. remarks: RIR data for suballocations contain garbage, they are all located in RU -- 2.26.2

1 0

[PATCH] location-importer.in: emit warnings due to unknown country code for valid networks only
by Peter Müller 03 May '21

03 May '21

This reduces log spam in case of processing RIR database, checking for networks with unknown country codes assigned. If we would not have written into the database, there is no need to warn about them. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- src/python/location-importer.in | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/python/location-importer.in b/src/python/location-importer.in index 1e08458..e5f55af 100644 --- a/src/python/location-importer.in +++ b/src/python/location-importer.in @@ -623,16 +623,19 @@ class CLI(object): if not inetnum or not "country" in inetnum: return - # Skip objects with unknown country codes - if validcountries and inetnum.get("country") not in validcountries: - log.warning("Skipping network with bogus country '%s': %s" % \ - (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) - return - # Iterate through all networks enumerated from above, check them for plausibility and insert # them into the database, if _check_parsed_network() succeeded for single_network in inetnum.get("inet6num") or inetnum.get("inetnum"): if self._check_parsed_network(single_network): + + # Skip objects with unknown country codes - to avoid log spam for invalid or too small + # networks, this check is - kinda ugly - done at this point + if validcountries and inetnum.get("country") not in validcountries: + log.warning("Skipping network with bogus country '%s': %s" % \ + (inetnum.get("country"), inetnum.get("inet6num") or inetnum.get("inetnum"))) + break + + # Everything is fine here, run INSERT statement... self.db.execute("INSERT INTO _rirdata(network, country) \ VALUES(%s, %s) ON CONFLICT (network) DO UPDATE SET country = excluded.country", "%s" % single_network, inetnum.get("country"), -- 2.26.2

1 0

[PATCH 1/3] override-other: mitigate tampered RIR data from customers of Tamatiya EOOD / 4Vendeta
by Peter Müller 29 Apr '21

29 Apr '21

AS50360 has an impressive history on providing IP transit services to shady Autonomous Systems, and continues to do so. While the amount of prefixes with tampered RIR data announced by AS50360 itself has ceased within the past years, it's customers continue to propagate IP space with faked country information. We cannot trust these networks, which is why we pin them on BG altogether, as they are all hosted in Sofia, Bulgaria: 1. X 2. X 3. AS9002 ae5-10.RT.TLP.SOF.BG.retn.net (87.245.232.164) <= RETN infrastructure in Telehouse Sofia, BG 4. AS9002 GW-Tamatiya.retn.net (87.245.240.159) <= Gateway to Tamatiya / 4Vendeta 5. AS50360 ip-25-22.4vendeta.com (195.230.25.22) <= And BOOM goes the dynamite... 6. (waiting for reply) 1. X 2. X 3. AS??? ge0-3.ams.OTEglobe.net (80.249.208.179) 4. AS??? 62.75.27.82 (62.75.27.82) 5. AS12713 62.75.3.2 (62.75.3.2) 6. AS57344 185.148.160.77 (185.148.160.77) 7. AS50360 ip-25-22.4vendeta.com (195.230.25.22) 8. (waiting for reply) Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- overrides/override-other.txt | 42 ++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-) diff --git a/overrides/override-other.txt b/overrides/override-other.txt index 0ec8fa2..f750da0 100644 --- a/overrides/override-other.txt +++ b/overrides/override-other.txt @@ -105,8 +105,8 @@ country: US aut-num: AS41466 descr: Treidinvest LLC -remarks: ISP located in RU, but some RIR data for announced prefixes contain garbage -country: RU +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG aut-num: AS41564 descr: Packet Exchange Limited @@ -173,6 +173,11 @@ descr: F.I.H. FORMULA INVESTMENT HOUSE CLEARING LIMITED remarks: claims GR for announced prefixes, but traceroutes dead-end somewhere else in EU country: EU +aut-num: AS50360 +descr: Tamatiya EOOD / 4Vendeta +remarks: Questionable (at best) ISP located in BG, clients massively tamper with RIR data +country: BG + aut-num: AS51558 descr: Smart Telecom S.A.R.L remarks: tampers with RIR data, traces back to RU @@ -288,6 +293,11 @@ descr: ALEXHOST SRL remarks: ISP located in MD, majority of RIR data for announced prefixes contain garbage, we cannot trust this network country: MD +aut-num: AS200391 +descr: KREZ 999 EOOD +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG + aut-num: AS200699 descr: Datashield, Inc. remarks: fake offshore location (SC), traces back to NL @@ -313,10 +323,10 @@ descr: FutureNow Incorporated remarks: ISP located in BG, but RIR data for announced prefixes contain garbage country: BG -aut-num: AS202920 -descr: DataClub S.A. -remarks: another shady customer of "DDoS Guard Ltd." -country: RU +aut-num: AS202325 +descr: 4Media Ltd. +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG aut-num: AS202425 descr: IP Volume Inc. @@ -333,6 +343,11 @@ descr: Cooperative Investments LLC remarks: bulletproof ISP and IP hijacker, related to AS202425 and AS62355, traces to NL country: NL +aut-num: AS202920 +descr: DataClub S.A. +remarks: another shady customer of "DDoS Guard Ltd." +country: RU + aut-num: AS204136 descr: Kevin Holly trading as Silent Ghost e.U. remarks: AS run by someone who thinks allocating IP networks to AQ is funny (it is not, kid) :-/ @@ -368,16 +383,31 @@ descr: Altrosky Technology Ltd. remarks: fake offshore location (SC), traces back to CZ and NL country: EU +aut-num: AS207812 +descr: DM AUTO EOOD +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG + aut-num: AS208046 descr: Maximilian Kutzner trading as HostSlick remarks: traces back to NL, but some RIR data for announced prefixes contain garbage country: NL +aut-num: AS208410 +descr: Internet Hosting Ltd. +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG + aut-num: AS209132 descr: Alviva Holding Limited remarks: ISP located in BG, but RIR data for announced prefixes contain garbage country: BG +aut-num: AS209160 +descr: Miti 2000 EOOD +remarks: another shady customer of "Tamatiya EOOD / 4Vendeta", located in BG, tampers with RIR data +country: BG + aut-num: AS209272 descr: Alviva Holding Limited remarks: bulletproof ISP operating from a war zone in eastern UA -- 2.26.2

1 2

2024

2023

2022

2021

2020

2019

2018

2017

Location