loveandcoding / checkpoint-ip Goto Github PK

The behavior for how non-IP values over the socket should be handled could probably use some tweaks. Sending a value of foo is not a valid bit of data for the system and should be handled in a common, sensible way that reports that information.

The local fallback file is currently hard coded into the repository. Keeping that up to date regularly is quite the pain, and should be ideally done automatically.

To keep issues down with it overloading the repo, it would probably be smart to update once a day or once a week. Since it should be a last resort fallback if both of the other methods are unavailable, such a slow update should be ok.

Theoretically we should have information about the confidence of an IP being blocked.

For example, if something appears on multiple lists, it's more likely to be an accurate result. Similarly, if an IP address is newly added to a trusted list, it is probably more likely to be a current active malicious IP.

On the flipside, an IP address may appear on a list we are less confident in that we still want to report. And if an IP address has been on a single list for a long time, even while that list has had a lot of churn, that's also good information to know. An IP address on a blocklist with less confidence may be flagged, and if there are other issues, it could be blocked as part of a broader system check.

Right now we're spinning up 1 master process for each instance we use. Ideally, we could split this out and use 1 master process for all of the processes and simply use a command socket to route the data to it. This would mean new systems getting spun up could do so by simply connecting to the existing master process and receive the latest updates. It would also mean we're not spamming those download every 3 minutes from every machine we have to spin up.

e:\Projects\checkpoint-brave\src\load.js
92:3 error Move function declaration to function body root no-inner-declarations

ESLint doesn't like having the function body inside the if statement. Which is perfectly reasonable and should be addressed. However, because variables are scoped to that if it does make more sense (and is more readable) with it there.

This function block could use a refactor that will address this issue and also break it up a bit more.

The Firehol list used doesn't have any IPv6 addresses on it, and the IP library we're using is specifically geared towards IPv4. Ideally, though, IPv6 address should work on roughly the same principle and should be able to be queried as well. That is not, however, how it works.

Only Firehol Level 1 blocklist is used and loaded at the moment which is very limiting. We should support multiple lists and have it be configurable. We should be able to at least use the other Firehol list levels so that IPs can be more selectively restricted