Created a little infrastructure to help maintain the bogons file.

Submissions gratefully accepted to improve my dodgy Makefile (at the
moment, it runs the ./getreserved and the cat every time).


git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2241 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
paulgear 2005-07-02 10:03:07 +00:00
parent 115d1929b9
commit 70443f3589
7 changed files with 630 additions and 0 deletions

View File

@ -0,0 +1,10 @@
all: bogons
wget:
wget --timestamping http://www.iana.org/assignments/ipv4-address-space
bogons: bogons.head bogons.body bogons.tail
cat $^ > $@
bogons.body: wget ipv4-address-space getreserved.py Makefile
./getreserved.py < ipv4-address-space > $@

View File

@ -0,0 +1,67 @@
#
# Shorewall 2.4 -- Bogons File
#
# /etc/shorewall/bogons
#
# Lists the subnetworks that are blocked by the 'nobogons' interface option.
#
# The default list includes those those ip ADDRESSES listed
# as 'reserved' by the IANA, the DHCP Autoconfig class B, and the class C
# reserved for use in documentation and examples.
#
# DO NOT MODIFY THIS FILE. IF YOU NEED TO MAKE CHANGES, COPY THE FILE
# TO /etc/shorewall AND MODIFY THE COPY.
#
# Columns are:
#
# SUBNET The subnet (host addresses also allowed as are IP
# address ranges provided that your kernel and iptables
# include iprange match support).
# TARGET Where to send packets to/from this subnet
# RETURN - let the packet be processed normally
# DROP - silently drop the packet
# logdrop - log then drop
#
###############################################################################
#SUBNET TARGET
0.0.0.0 RETURN # Stop the DHCP whining
255.255.255.255 RETURN # We need to allow limited broadcast
169.254.0.0/16 DROP # DHCP autoconfig
192.0.2.0/24 logdrop # Example addresses (RFC 3330)
#
# The following are generated with the help of the Python program found at:
#
# http://www.shorewall.net/pub/shorewall/contrib/iana_reserved/
#
# The program was contributed by Andy Wiggin
#
0.0.0.0/7 logdrop # Reserved
2.0.0.0/8 logdrop # Reserved
5.0.0.0/8 logdrop # Reserved
7.0.0.0/8 logdrop # Reserved
10.0.0.0/8 logdrop # Reserved
23.0.0.0/8 logdrop # Reserved
27.0.0.0/8 logdrop # Reserved
31.0.0.0/8 logdrop # Reserved
36.0.0.0/7 logdrop # Reserved
39.0.0.0/8 logdrop # Reserved
42.0.0.0/8 logdrop # Reserved
77.0.0.0/8 logdrop # Reserved
78.0.0.0/7 logdrop # Reserved
92.0.0.0/6 logdrop # Reserved
96.0.0.0/4 logdrop # Reserved
112.0.0.0/5 logdrop # Reserved
120.0.0.0/6 logdrop # Reserved
127.0.0.0/8 logdrop # Reserved
173.0.0.0/8 logdrop # Reserved
174.0.0.0/7 logdrop # Reserved
176.0.0.0/5 logdrop # Reserved
184.0.0.0/6 logdrop # Reserved
197.0.0.0/8 logdrop # Reserved
223.0.0.0/8 logdrop # Reserved
240.0.0.0/4 logdrop # Reserved
#
# End of generated entries
#
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

View File

@ -0,0 +1,25 @@
0.0.0.0/7 logdrop # Reserved
2.0.0.0/8 logdrop # Reserved
5.0.0.0/8 logdrop # Reserved
7.0.0.0/8 logdrop # Reserved
10.0.0.0/8 logdrop # Reserved
23.0.0.0/8 logdrop # Reserved
27.0.0.0/8 logdrop # Reserved
31.0.0.0/8 logdrop # Reserved
36.0.0.0/7 logdrop # Reserved
39.0.0.0/8 logdrop # Reserved
42.0.0.0/8 logdrop # Reserved
77.0.0.0/8 logdrop # Reserved
78.0.0.0/7 logdrop # Reserved
92.0.0.0/6 logdrop # Reserved
96.0.0.0/4 logdrop # Reserved
112.0.0.0/5 logdrop # Reserved
120.0.0.0/6 logdrop # Reserved
127.0.0.0/8 logdrop # Reserved
173.0.0.0/8 logdrop # Reserved
174.0.0.0/7 logdrop # Reserved
176.0.0.0/5 logdrop # Reserved
184.0.0.0/6 logdrop # Reserved
197.0.0.0/8 logdrop # Reserved
223.0.0.0/8 logdrop # Reserved
240.0.0.0/4 logdrop # Reserved

View File

@ -0,0 +1,38 @@
#
# Shorewall 2.4 -- Bogons File
#
# /etc/shorewall/bogons
#
# Lists the subnetworks that are blocked by the 'nobogons' interface option.
#
# The default list includes those those ip ADDRESSES listed
# as 'reserved' by the IANA, the DHCP Autoconfig class B, and the class C
# reserved for use in documentation and examples.
#
# DO NOT MODIFY THIS FILE. IF YOU NEED TO MAKE CHANGES, COPY THE FILE
# TO /etc/shorewall AND MODIFY THE COPY.
#
# Columns are:
#
# SUBNET The subnet (host addresses also allowed as are IP
# address ranges provided that your kernel and iptables
# include iprange match support).
# TARGET Where to send packets to/from this subnet
# RETURN - let the packet be processed normally
# DROP - silently drop the packet
# logdrop - log then drop
#
###############################################################################
#SUBNET TARGET
0.0.0.0 RETURN # Stop the DHCP whining
255.255.255.255 RETURN # We need to allow limited broadcast
169.254.0.0/16 DROP # DHCP autoconfig
192.0.2.0/24 logdrop # Example addresses (RFC 3330)
#
# The following are generated with the help of the Python program found at:
#
# http://www.shorewall.net/pub/shorewall/contrib/iana_reserved/
#
# The program was contributed by Andy Wiggin
#

View File

@ -0,0 +1,4 @@
#
# End of generated entries
#
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

View File

@ -0,0 +1,206 @@
#!/usr/bin/env python2
"""
getreserved.py - Copyright (c) 2002 by Andy Wiggin
Licenced under the GPL
Script to write a stream of reserved addresses
from an IANA address allocation file. This list
is apparently similiar to RFC 1466.
The file can be obtained at
http://www.iana.org/assignments/ipv4-address-space
Download this file to a local file, then run the following:
cat local_file | ./getreserved.py
to produce a list of reserved subnets which can be used
in a shell script.
"""
import sys
__script_debug = 0
__output_style = 'rfc1918'
class IpNet:
def __init__(self):
self.netnum = 0
self.maskind = 0
def __str__(self):
return "%u.%u.%u.%u/%d"%\
(self.GetNetByte(3), self.GetNetByte(2),
self.GetNetByte(1), self.GetNetByte(0), self.maskind)
def Set(self, netnum, maskind):
self.netnum = int(netnum)
self.maskind = int(maskind)
def GetNetNum(self): return self.netnum
def GetMaskIndex(self): return self.maskind
def GetMaskBits(self):
numbits = 32 - self.maskind
retmask = 0
for i in range(numbits):
retmask = (retmask << 1) + 0x1
return retmask
def GetNetByte(self, byteind):
if byteind < 0 or byteind > 3:
raise RuntimeError, "bad byte index"
shiftcount = 8 * byteind
mask = 0xff << shiftcount
byte = self.netnum & mask
return (byte >> shiftcount) & 0xff
def GetIpNetList(fd):
ipnets = []
for l in fd.xreadlines():
if l.find('IANA - Reserved') > 0 or \
l.find('IANA - Private Use') > 0:
# Get the range and net size from the first field
fields = l.split()
(ip_range, mask_size) = fields[0].split('/')
if __script_debug:
print '\t\t', ip_range, mask_size
# Convert the range to numbers
ip_range = ip_range.split('-')
ip_min = int(ip_range[0])
if len(ip_range) > 1:
ip_max = int(ip_range[1])
else:
ip_max = ip_min
# For each number in the range, add an ip net string to the output
# list
for ip_num in range(ip_min, ip_max+1):
#ipel = "%d.0.0.0/%s"%(ip_num, mask_size)
ipel = IpNet()
ipel.Set(ip_num << 24, int(mask_size))
if __script_debug:
print str(ipel)
ipnets.append(ipel)
return ipnets
def CompactIpNetList(ipnets):
"""
Combine an many nets as possible.
"""
done = 0
ipnets.sort(IpCmpFunc)
oldlist = ipnets
while not done:
done = 1
newlist = []
head = None
while len(oldlist) > 0:
if not head:
# Consume one item from the list
head = oldlist.pop(0)
else:
# Consume head, and maybe an item from the list
next = oldlist.pop(0)
# Determine of head and next can be merged
# The merge condition is that two element have the same netmask,
# their net numbers are different by just one bit, and that
# bit is the least significant bit after the mask bits.
canmerge = 0
if head.GetMaskIndex() == next.GetMaskIndex():
# Get the net numbers
nnxor = head.GetNetNum() ^ next.GetNetNum()
# Calculate what the XOR would have to be for a merge
mask = head.GetMaskBits()
nextbit = (mask << 1) & ~mask
if nnxor == nextbit:
canmerge = 1
if canmerge:
# Because the list is sorted and we know that the xor was
# different by just one bit, the element occuring earier
# in the list (head) already has the correct net number,
# since it must have a 0 in the bit being merged. Therefore
# we can just use head, and decrease the mask index by one
nn = head.GetNetNum()
mindex = head.GetMaskIndex()
head.Set(nn, mindex-1)
newlist.append(head)
head = None
next = None # This element is just abandoned
# We'll need to loop again
done = 0
else:
newlist.append(head)
head = next
# There might be a valid head element sitting around at the end
if head:
newlist.append(head)
# Make newlist the current list
oldlist = newlist
return oldlist
def IpCmpFunc(el1, el2):
n1 = el1.GetNetNum()
n2 = el2.GetNetNum()
# Not sure how to do unsigned comparisons in python, so
# if the 32'nd bit is set, create a long out of it, add
# twice the value of the 32 bit (the 33rd bit), and compare.
if n1 < 0:
n1 = long(n1) + 0x100000000L
if n2 < 0:
n2 = long(n2) + 0x100000000L
v = n1 - n2
if v < 0:
return -1
elif v > 0:
return 1
else:
return 0
def main():
infd = sys.stdin
outfd = sys.stdout
# Get the list
iplist = GetIpNetList(infd)
iplist = CompactIpNetList(iplist)
if __output_style == 'shlist':
# Write a list of strings, compatible with a shell script list.
# Fomats four on each line, indented by one TAB.
numperline = 4
numinline = 0
for ip in iplist:
if numinline == 0:
outfd.write( '\t\t' )
outfd.write("'%s' "%ip)
numinline += 1
if numinline == numperline:
outfd.write( "\\\n" )
numinline = 0
if numinline > 0:
outfd.write( "\n" )
elif __output_style == 'rfc1918':
for ip in iplist:
outfd.write("%s\t\tlogdrop\t\t# Reserved\n"%ip)
if __name__ == '__main__':
main()

View File

@ -0,0 +1,280 @@
INTERNET PROTOCOL V4 ADDRESS SPACE
(last updated 30 June 2005)
The allocation of Internet Protocol version 4 (IPv4) address space to
various registries is listed here. Originally, all the IPv4 address
spaces was managed directly by the IANA. Later parts of the address
space were allocated to various other registries to manage for
particular purposes or regional areas of the world. RFC 1466 [RFC1466]
documents most of these allocations.
Address
Block Date Registry - Purpose Notes or Reference
----- ------ --------------------------- ------------------
000/8 Sep 81 IANA - Reserved
001/8 Sep 81 IANA - Reserved
002/8 Sep 81 IANA - Reserved
003/8 May 94 General Electric Company
004/8 Dec 92 Bolt Beranek and Newman Inc.
005/8 Jul 95 IANA - Reserved
006/8 Feb 94 Army Information Systems Center
007/8 Apr 95 IANA - Reserved
008/8 Dec 92 Bolt Beranek and Newman Inc.
009/8 Aug 92 IBM
010/8 Jun 95 IANA - Private Use See [RFC1918]
011/8 May 93 DoD Intel Information Systems
012/8 Jun 95 AT&T Bell Laboratories
013/8 Sep 91 Xerox Corporation
014/8 Jun 91 IANA - Public Data Network
015/8 Jul 94 Hewlett-Packard Company
016/8 Nov 94 Digital Equipment Corporation
017/8 Jul 92 Apple Computer Inc.
018/8 Jan 94 MIT
019/8 May 95 Ford Motor Company
020/8 Oct 94 Computer Sciences Corporation
021/8 Jul 91 DDN-RVN
022/8 May 93 Defense Information Systems Agency
023/8 Jul 95 IANA - Reserved
024/8 May 01 ARIN - Cable Block (Formerly IANA - Jul 95)
025/8 Jan 95 Royal Signals and Radar Establishment
026/8 May 95 Defense Information Systems Agency
027/8 Apr 95 IANA - Reserved
028/8 Jul 92 DSI-North
029/8 Jul 91 Defense Information Systems Agency
030/8 Jul 91 Defense Information Systems Agency
031/8 Apr 99 IANA - Reserved
032/8 Jun 94 Norsk Informasjonsteknology
033/8 Jan 91 DLA Systems Automation Center
034/8 Mar 93 Halliburton Company
035/8 Apr 94 MERIT Computer Network
036/8 Jul 00 IANA - Reserved (Formerly Stanford University - Apr 93)
037/8 Apr 95 IANA - Reserved
038/8 Sep 94 Performance Systems International
039/8 Apr 95 IANA - Reserved
040/8 Jun 94 Eli Lily and Company
041/8 Apr 05 AfriNIC (whois.afrinic.net)
042/8 Jul 95 IANA - Reserved
043/8 Jan 91 Japan Inet
044/8 Jul 92 Amateur Radio Digital Communications
045/8 Jan 95 Interop Show Network
046/8 Dec 92 Bolt Beranek and Newman Inc.
047/8 Jan 91 Bell-Northern Research
048/8 May 95 Prudential Securities Inc.
049/8 May 94 Joint Technical Command (Returned to IANA Mar 98)
050/8 May 94 Joint Technical Command (Returned to IANA Mar 98)
051/8 Aug 94 Deparment of Social Security of UK
052/8 Dec 91 E.I. duPont de Nemours and Co., Inc.
053/8 Oct 93 Cap Debis CCS
054/8 Mar 92 Merck and Co., Inc.
055/8 Apr 95 Boeing Computer Services
056/8 Jun 94 U.S. Postal Service
057/8 May 95 SITA
058/8 Apr 04 APNIC (whois.apnic.net)
059/8 Apr 04 APNIC (whois.apnic.net)
060/8 Apr 03 APNIC (whois.apnic.net)
061/8 Apr 97 APNIC (whois.apnic.net)
062/8 Apr 97 RIPE NCC (whois.ripe.net)
063/8 Apr 97 ARIN (whois.arin.net)
064/8 Jul 99 ARIN (whois.arin.net)
065/8 Jul 00 ARIN (whois.arin.net)
066/8 Jul 00 ARIN (whois.arin.net)
067/8 May 01 ARIN (whois.arin.net)
068/8 Jun 01 ARIN (whois.arin.net)
069/8 Aug 02 ARIN (whois.arin.net)
070/8 Jan 04 ARIN (whois.arin.net)
071/8 Aug 04 ARIN (whois.arin.net)
072/8 Aug 04 ARIN (whois.arin.net)
073/8 Mar 05 ARIN (whois.arin.net)
074/8 Jun 05 ARIN (whois.arin.net)
075/8 Jun 05 ARIN (whois.arin.net)
076/8 Jun 05 ARIN (whois.arin.net)
077/8 Sep 81 IANA - Reserved
078/8 Sep 81 IANA - Reserved
079/8 Sep 81 IANA - Reserved
080/8 Apr 01 RIPE NCC (whois.ripe.net)
081/8 Apr 01 RIPE NCC (whois.ripe.net)
082/8 Nov 02 RIPE NCC (whois.ripe.net)
083/8 Nov 03 RIPE NCC (whois.ripe.net)
084/8 Nov 03 RIPE NCC (whois.ripe.net)
085/8 Apr 04 RIPE NCC (whois.ripe.net)
086/8 Apr 04 RIPE NCC (whois.ripe.net)
087/8 Apr 04 RIPE NCC (whois.ripe.net)
088/8 Apr 04 RIPE NCC (whois.ripe.net)
089/8 Jun 05 RIPE NCC (whois.ripe.net)
090/8 Jun 05 RIPE NCC (whois.ripe.net)
091/8 Jun 05 RIPE NCC (whois.ripe.net)
092/8 Sep 81 IANA - Reserved
093/8 Sep 81 IANA - Reserved
094/8 Sep 81 IANA - Reserved
095/8 Sep 81 IANA - Reserved
096/8 Sep 81 IANA - Reserved
097/8 Sep 81 IANA - Reserved
098/8 Sep 81 IANA - Reserved
099/8 Sep 81 IANA - Reserved
100/8 Sep 81 IANA - Reserved
101/8 Sep 81 IANA - Reserved
102/8 Sep 81 IANA - Reserved
103/8 Sep 81 IANA - Reserved
104/8 Sep 81 IANA - Reserved
105/8 Sep 81 IANA - Reserved
106/8 Sep 81 IANA - Reserved
107/8 Sep 81 IANA - Reserved
108/8 Sep 81 IANA - Reserved
109/8 Sep 81 IANA - Reserved
110/8 Sep 81 IANA - Reserved
111/8 Sep 81 IANA - Reserved
112/8 Sep 81 IANA - Reserved
113/8 Sep 81 IANA - Reserved
114/8 Sep 81 IANA - Reserved
115/8 Sep 81 IANA - Reserved
116/8 Sep 81 IANA - Reserved
117/8 Sep 81 IANA - Reserved
118/8 Sep 81 IANA - Reserved
119/8 Sep 81 IANA - Reserved
120/8 Sep 81 IANA - Reserved
121/8 Sep 81 IANA - Reserved
122/8 Sep 81 IANA - Reserved
123/8 Sep 81 IANA - Reserved
124/8 Jan 05 APNIC (whois.apnic.net)
125/8 Jan 05 APNIC (whois.apnic.net)
126/8 Jan 05 APNIC (whois.apnic.net)
127/8 Sep 81 IANA - Reserved See [RFC3330]
128/8 May 93 Various Registries
129/8 May 93 Various Registries
130/8 May 93 Various Registries
131/8 May 93 Various Registries
132/8 May 93 Various Registries
133/8 May 93 Various Registries
134/8 May 93 Various Registries
135/8 May 93 Various Registries
136/8 May 93 Various Registries
137/8 May 93 Various Registries
138/8 May 93 Various Registries
139/8 May 93 Various Registries
140/8 May 93 Various Registries
141/8 May 93 Various Registries
142/8 May 93 Various Registries
143/8 May 93 Various Registries
144/8 May 93 Various Registries
145/8 May 93 Various Registries
146/8 May 93 Various Registries
147/8 May 93 Various Registries
148/8 May 93 Various Registries
149/8 May 93 Various Registries
150/8 May 93 Various Registries
151/8 May 93 Various Registries
152/8 May 93 Various Registries
153/8 May 93 Various Registries
154/8 May 93 Various Registries
155/8 May 93 Various Registries
156/8 May 93 Various Registries
157/8 May 93 Various Registries
158/8 May 93 Various Registries
159/8 May 93 Various Registries
160/8 May 93 Various Registries
161/8 May 93 Various Registries
162/8 May 93 Various Registries
163/8 May 93 Various Registries
164/8 May 93 Various Registries
165/8 May 93 Various Registries
166/8 May 93 Various Registries
167/8 May 93 Various Registries
168/8 May 93 Various Registries
169/8 May 93 Various Registries
170/8 May 93 Various Registries
171/8 May 93 Various Registries
172/8 May 93 Various Registries
173/8 Apr 03 IANA - Reserved
174/8 Apr 03 IANA - Reserved
175/8 Apr 03 IANA - Reserved
176/8 Apr 03 IANA - Reserved
177/8 Apr 03 IANA - Reserved
178/8 Apr 03 IANA - Reserved
179/8 Apr 03 IANA - Reserved
180/8 Apr 03 IANA - Reserved
181/8 Apr 03 IANA - Reserved
182/8 Apr 03 IANA - Reserved
183/8 Apr 03 IANA - Reserved
184/8 Apr 03 IANA - Reserved
185/8 Apr 03 IANA - Reserved
186/8 Apr 03 IANA - Reserved
187/8 Apr 03 IANA - Reserved
188/8 May 93 Various Registries
189/8 Jun 05 LACNIC (whois.lacnic.net)
190/8 Jun 05 LACNIC (whois.lacnic.net)
191/8 May 93 Various Registries
192/8 May 93 Various Registries
193/8 May 93 RIPE NCC (whois.ripe.net)
194/8 May 93 RIPE NCC (whois.ripe.net)
195/8 May 93 RIPE NCC (whois.ripe.net)
196/8 May 93 Various Registries
197/8 May 93 IANA - Reserved
198/8 May 93 Various Registries
199/8 May 93 ARIN (whois.arin.net)
200/8 Nov 02 LACNIC (whois.lacnic.net)
201/8 Apr 03 LACNIC (whois.lacnic.net)
202/8 May 93 APNIC (whois.apnic.net)
203/8 May 93 APNIC (whois.apnic.net)
204/8 Mar 94 ARIN (whois.arin.net)
205/8 Mar 94 ARIN (whois.arin.net)
206/8 Apr 95 ARIN (whois.arin.net)
207/8 Nov 95 ARIN (whois.arin.net)
208/8 Apr 96 ARIN (whois.arin.net)
209/8 Jun 96 ARIN (whois.arin.net)
210/8 Jun 96 APNIC (whois.apnic.net)
211/8 Jun 96 APNIC (whois.apnic.net)
212/8 Oct 97 RIPE NCC (whois.ripe.net)
213/8 Mar 99 RIPE NCC (whois.ripe.net)
214/8 Mar 98 US-DOD
215/8 Mar 98 US-DOD
216/8 Apr 98 ARIN (whois.arin.net)
217/8 Jun 00 RIPE NCC (whois.ripe.net)
218/8 Dec 00 APNIC (whois.apnic.net)
219/8 Sep 01 APNIC (whois.apnic.net)
220/8 Dec 01 APNIC (whois.apnic.net)
221/8 Jul 02 APNIC (whois.apnic.net)
222/8 Feb 03 APNIC (whois.apnic.net)
223/8 Apr 03 IANA - Reserved
224/8 Sep 81 IANA - Multicast
225/8 Sep 81 IANA - Multicast
226/8 Sep 81 IANA - Multicast
227/8 Sep 81 IANA - Multicast
228/8 Sep 81 IANA - Multicast
229/8 Sep 81 IANA - Multicast
230/8 Sep 81 IANA - Multicast
231/8 Sep 81 IANA - Multicast
232/8 Sep 81 IANA - Multicast
233/8 Sep 81 IANA - Multicast
234/8 Sep 81 IANA - Multicast
235/8 Sep 81 IANA - Multicast
236/8 Sep 81 IANA - Multicast
237/8 Sep 81 IANA - Multicast
238/8 Sep 81 IANA - Multicast
239/8 Sep 81 IANA - Multicast
240/8 Sep 81 IANA - Reserved
241/8 Sep 81 IANA - Reserved
242/8 Sep 81 IANA - Reserved
243/8 Sep 81 IANA - Reserved
244/8 Sep 81 IANA - Reserved
245/8 Sep 81 IANA - Reserved
246/8 Sep 81 IANA - Reserved
247/8 Sep 81 IANA - Reserved
248/8 Sep 81 IANA - Reserved
249/8 Sep 81 IANA - Reserved
250/8 Sep 81 IANA - Reserved
251/8 Sep 81 IANA - Reserved
252/8 Sep 81 IANA - Reserved
253/8 Sep 81 IANA - Reserved
254/8 Sep 81 IANA - Reserved
255/8 Sep 81 IANA - Reserved
Reference
---------
[RFC1466]
[RFC1918]
[RFC3330]
[]