zwitschi/intrusion-detection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: update whitelists to replace Openfactory with Init7 and adjust related configurations

Browse Source
This commit is contained in:
zwitschi committed 2026-09-08 19:54:10 +02:00
1 parent c2eba88ac8
commit 55dad05652
5 files changed
+26 -30
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

app/utils/whitelists.py
+19 -19
View File
@@ -23,8 +23,6 @@ from .constants import (
CLOUDFLARE_URL_V6,
CLOUDFLARE_V4_FILE,
CLOUDFLARE_V6_FILE,
OPENFACTORY_FILE,
OPENFACTORY_URL,
PALOALTO_FILE,
PALOALTO_URL,
)
@@ -40,15 +38,26 @@ CIDR_RE = re.compile(
# Local file paths (checked first, before remote download)
# ---------------------------------------------------------------------------
# (paths live in app/constants.py as OPENFACTORY_FILE, CLOUDFLARE_V4_FILE,
# CLOUDFLARE_V6_FILE, PALOALTO_FILE; URLs as OPENFACTORY_URL, ...)
# (paths live in app/constants.py as CLOUDFLARE_V4_FILE,
# CLOUDFLARE_V6_FILE, PALOALTO_FILE; URLs as CLOUDFLARE_URL_V4, ...)
# ---------------------------------------------------------------------------
# Built-in fallback CIDR lists
# ---------------------------------------------------------------------------
#: Openfactory AS58299 colocation IP range (https://openfactory.net/geofeed.csv)
OPENFACTORY_IPV4 = ["5.226.144.0/21"]
#: Init7 (Switzerland) Ltd. ranges — AS13030, verified via RIPE RDAP 2026-09-08.
#: Includes the Hybrid7 WAN /24 (router WAN 77.74.80.159), init7 DNS
#: infrastructure, and the PPPoE gateway. init7 publishes no geofeed, so
#: these are maintained here rather than downloaded.
INIT7_IPV4 = [
"77.74.80.0/24", # Hybrid7 WAN /24
"77.109.128.0/18", # init7 DNS / infrastructure
"213.144.128.0/19", # init7 DNS / infrastructure
"5.180.132.0/22", # init7 PPPoE gateway
]
#: init7 IPv6 allocation (contains delegated /48 2001:1620:549f::/48)
INIT7_IPV6 = ["2001:1620::/30"]
#: https://www.cloudflare.com/ips-v4
CLOUDFLARE_IPV4 = [
@@ -85,7 +94,7 @@ PALOALTO_IPV6 = [
#: address-list name -> CIDR ranges (v4 + v6 mixed, split at render time)
WHITELISTS: dict[str, list[str]] = {
"Openfactory": OPENFACTORY_IPV4,
"Init7": INIT7_IPV4 + INIT7_IPV6,
"Cloudflare": CLOUDFLARE_IPV4 + CLOUDFLARE_IPV6,
"PaloAlto": PALOALTO_IPV4 + PALOALTO_IPV6,
}
@@ -141,9 +150,7 @@ def _load_local_whitelists() -> dict[str, list[str]]:
successfully parsed CIDRs are included.
"""
out: dict[str, list[str]] = {}
cidrs = _read_local_file(OPENFACTORY_FILE)
if cidrs:
out["Openfactory"] = cidrs
# Init7 has no published geofeed; its ranges are built-in (INIT7_IPV4/6).
cf_v4 = _read_local_file(CLOUDFLARE_V4_FILE)
cf_v6 = _read_local_file(CLOUDFLARE_V6_FILE)
if cf_v4 or cf_v6:
@@ -190,14 +197,7 @@ def _download_whitelists() -> dict[str, list[str]]:
Saves each download to the corresponding local file on success.
"""
out: dict[str, list[str]] = {}
try:
text = _download_text(OPENFACTORY_URL)
cidrs = extract_cidrs(text)
if cidrs:
out["Openfactory"] = cidrs
_save_local_file(OPENFACTORY_FILE, text)
except Exception as e:
print(f"Error downloading Openfactory whitelist: {e}")
# Init7 has no published geofeed; its ranges are built-in (INIT7_IPV4/6).
try:
text_v4 = _download_text(CLOUDFLARE_URL_V4)
text_v6 = _download_text(CLOUDFLARE_URL_V6)
@@ -242,7 +242,7 @@ def update_whitelists() -> None:
# Start from built-in fallbacks, then layer local, then remote
WHITELISTS = {
"Openfactory": OPENFACTORY_IPV4,
"Init7": INIT7_IPV4 + INIT7_IPV6,
"Cloudflare": CLOUDFLARE_IPV4 + CLOUDFLARE_IPV6,
"PaloAlto": PALOALTO_IPV4 + PALOALTO_IPV6,
}