anti
ffc275f051
Populates Attacker.country_code + country_source (MVP) using the five RIR delegated-stats files (ARIN/RIPE/APNIC/LACNIC/AFRINIC). Offline, license-free, no outbound traffic that could burn honeypot stealth. - decnet.geoip package with factory/base/lookup + rir/ subpackage (fetch/parse/provider) mirroring the db + bus factory convention - Profiler._build_record calls enrich_ip on every upsert - Idempotent ALTER TABLE migrations for both SQLite and MySQL - decnet geoip refresh/lookup CLI (master-only) - /var/lib/decnet/geoip seeded by decnet init - DECNET_GEOIP_ENABLED=false kill-switch; set in tests/conftest.py so unit tests never trigger the first-access fetch
10 lines
349 B
Python
10 lines
349 B
Python
"""RIR delegated-stats provider.
|
|
|
|
Free, offline, no license: each Regional Internet Registry publishes a
|
|
daily plaintext file mapping IPv4 allocations to countries. Together the
|
|
five RIR files cover the entire assigned IPv4 space.
|
|
|
|
Direct imports of :class:`RirProvider` are discouraged — go through
|
|
:func:`decnet.geoip.factory.get_provider`.
|
|
"""
|