Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Improve treatment of bogons in analysis (not all bogons are made equal)

Aperta
  • Qualcosa non va?
#107 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@hellais ci sta già lavorando.

Dal 14/1/2025.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

research

In doing some work on the new analysis pipeline I came across an interesting case which we should probably think about how to handle properly.

The case is this one: https://explorer.ooni.org/m/20241203074026.659796_IT_webconnectivity_714c5108998baea8.

Currently the analysis logic scores measurements where the DNS answer was a bogon and there was no successful TLS as a strong signal for blocking. However this case highlights how we should not be treating all bogons equally.

This particular IPv6 bogon (64:ff9b:1:fffe::68f4:2a01), is in the prefix that's allocated as per RFC 6052 (https://datatracker.ietf.org/doc/html/rfc6052) for use in IPv6 to IPv4 mappings.

Basically inside of this bogon address the last 32 bits are used to encode the target IP address such that if there is an IPv6 translator on the network it's able to route traffic towards the target IPs.
In this example the last 32 bits are 68f4:2a01 which using this one-liner:

python -c 'x="68f4:2a01".split(":");print(f"{int(x[0], 16) >> 8}.{int(x[0], 16) & 0xFF}.{int(x[1], 16) >> 8}.{int(x[1], 16) & 0xFF}")'

map to:
104.244.42.1
That checks out with what we see in the measurement.

I don't understand so well how and in which circumstances this would be happening.

That is is it the operator of the site (which doesn't natively support V6) that configures their DNS zone to return these addresses such that IPv6 only networks that have a v6-to-v4 translator service deployed are able to route traffic to their v4 address?

I did a quick search in measurements from the last month to see how prevalent this is and found it appears in DNS resolutions for 565 unique domains and for those which are very tested, this appears on 15+ distinct resolvers, so I am excluding this is a behavior of the resolver.

Moreover in the case of twitter, we observe that there are instances in which we get an answer that contains a V6 address that isn't in this special prefix, which makes we wonder why this is happening.

Lingua principale
Python
Stelle
11
Fork
6
Merge medio
2g 7h
PR unite (30g)
9

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ooni/data

Tutte le issue di ooni/data

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.