From 622bd3510e3e544d024718dc44bf84386a9438ac Mon Sep 17 00:00:00 2001 From: Jean-Louis Huynen Date: Thu, 12 Sep 2019 11:09:16 +0200 Subject: [PATCH] add: [wikimedia] adds a warning list for wikimedia infrastructure. --- lists/wikimedia/list.json | 1 + tools/generate-wikimedia.py | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 lists/wikimedia/list.json create mode 100755 tools/generate-wikimedia.py diff --git a/lists/wikimedia/list.json b/lists/wikimedia/list.json new file mode 100644 index 0000000..1c74f0e --- /dev/null +++ b/lists/wikimedia/list.json @@ -0,0 +1 @@ +{"name": "List of known Wikimedia address ranges", "version": 20190912, "description": "Wikimedia address ranges (http://noc.wikimedia.org/conf/reverse-proxy.php.txt)", "type": "cidr", "list": ["208.80.153.0/27", "208.80.153.32/27", "208.80.153.64/27", "208.80.153.96/27", "208.80.154.0/26", "208.80.154.128/26", "208.80.154.64/26", "208.80.155.96/27", "2620:0:860:1::/64", "2620:0:860:2::/64", "2620:0:860:3::/64", "2620:0:860:4::/64", "2620:0:861:1::/64", "2620:0:861:2::/64", "2620:0:861:3::/64", "2620:0:861:4::/64", "2620:0:862:1::/64", "91.198.174.0/25"], "matching_attributes": ["ip-src", "ip-dst", "domain|ip"]} diff --git a/tools/generate-wikimedia.py b/tools/generate-wikimedia.py new file mode 100755 index 0000000..18a2b95 --- /dev/null +++ b/tools/generate-wikimedia.py @@ -0,0 +1,34 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +import json +import datetime +import urllib.request +import re +import ipaddress + +res = urllib.request.urlopen('http://noc.wikimedia.org/conf/reverse-proxy.php.txt') + +res_body = res.read() +decoded = res_body.decode("unicode_escape", "utf-8") + +l = [] +for line in decoded.split('\n'): + if re.search("public", line): + matched = re.findall(r'\'(.*?)\'', line) + if matched: + try: + ipaddress.ip_network(matched[0]) + l.append(matched[0]) + except ValueError: + pass + +warninglist = {} +warninglist['name'] = 'List of known Wikimedia address ranges' +warninglist['version'] = int(datetime.date.today().strftime('%Y%m%d')) +warninglist['description'] = 'Wikimedia address ranges (http://noc.wikimedia.org/conf/reverse-proxy.php.txt)' +warninglist['type'] = 'cidr' +warninglist['list'] = sorted(set(l)) +warninglist['matching_attributes'] = ["ip-src", "ip-dst", "domain|ip"] + +print(json.dumps(warninglist))