anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(model): add bgp_prefix, rpki_status, rpki_source to Attacker

Browse Source 
bgp_prefix (max 43 chars, indexed) holds the covering CIDR from
the ASN lookup. rpki_status / rpki_source hold RIPE STAT validation
outcome. All nullable — null means enrichment was skipped or ASN
did not resolve.
This commit is contained in:
anti
2026-05-21 16:13:31 -04:00
parent b799ade816
commit 49b4996956
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
decnet/web/db/models/attackers.py
View File

@@ -76,7 +76,13 @@ class Attacker(SQLModel, table=True):
# announced in the global BGP table (e.g. CGNAT, dark space).
asn: Optional[int] = Field(default=None, index=True)
as_name: Optional[str] = Field(default=None, max_length=128)
bgp_prefix: Optional[str] = Field(default=None, max_length=43, index=True)
asn_source: Optional[str] = Field(default=None, max_length=16)
# RPKI validity (populated by the profiler from decnet.rpki.enrich_rpki).
# Values: "valid" / "invalid" / "not-found" / "unknown" / null.
# Null means enrichment was skipped (no ASN resolved, or RPKI disabled).
rpki_status: Optional[str] = Field(default=None, max_length=16)
rpki_source: Optional[str] = Field(default=None, max_length=16)
# Reverse-DNS (PTR) name, one-shot resolved by the profiler at first
# sighting. Nullable — many attackers run infra with no rDNS, and
# private/loopback addresses never resolve. 256 chars matches