Add a Cymru Annotator

[phillip-stephens]

Cymru offers IP Prefix and ASN information as a free API service. They recommend their DNS endpoints for efficient querying for multiple IPs.

While I used zdns as the dns resolve library for the UDP socket reuse, its caching functionality excludes records like TXT since they might pollute the iterative cache. The Cymru module will commonly need to query the same IP for common peers/origin ASes (On 10k random IPs, Hurricane Electric's ASN was queried over 3k times), so I added a simple, thread-safe LRU cache.

Example of typical usage:

printf "4.195.166.168" | ./zannotate --cymru   
```json
{
  "ip": "4.195.166.168",
  "cymru": {
    "origin_asns": [
      8075
    ],
    "peer_asns": [
      6939,
      6461
    ],
    "asn_details": {
      "8075": {
        "asn": 8075,
        "country_code": "US",
        "registry": "arin",
        "asn_allocation_date": "1997-03-31",
        "asn_description": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US"
      },
      "6939": {
        "asn": 6939,
        "country_code": "US",
        "registry": "arin",
        "asn_allocation_date": "1996-06-28",
        "asn_description": "HURRICANE - Hurricane Electric LLC, US"
      },
      "6461": {
        "asn": 6461,
        "country_code": "US",
        "registry": "arin",
        "asn_allocation_date": "1996-04-22",
        "asn_description": "ZAYO-6461 - Zayo Bandwidth, US"
      }
    },
    "prefix_details": {
      "4.192.0.0/12": {
        "prefix": "4.192.0.0/12",
        "origin_asns": [
          8075
        ],
        "peer_asns": [
          6461,
          6939
        ],
        "country_code": "US",
        "registry": "arin",
        "allocation_date": "2020-07-07"
      }
    }
  }
}

Performance

10k Random IPs annotated

• On Macbook w/ 20 ms ping to 1.1.1.1 - 1 min 10 sec
• On Ubuntu server - 40 sec

Related Issues

Closes #3

[zakird]

JSON record IDs should generally be static for easier downstream processing. Would change into list.

We should also probably allow configuration of which Cymru DNS servers to check against instead of checking all of them. In some ases, people may not want ASN details or care about the peers.

Does origin ever provide multiple answers? That seems a bit odd offhand, but i suppose could happen

[phillip-stephens]

Sounds good, I'll fix the JSON record IDs and add the ability to specify what Cymru endpoints to query.

Yeah, it surprised me too. Was doing final testing and realized some IPs had multiple origin ASNs depending on the prefix advertised and had to redo part of the parser.
Example

$ dig +short -t TXT 0.149.167.220.origin.asn.cymru.com

"140061 | 220.167.148.0/22 | CN | apnic | 2002-10-30"
"4134 | 220.167.128.0/17 | CN | apnic | 2002-10-30"
"140061 | 220.167.128.0/18 | CN | apnic | 2002-10-30"

[phillip-stephens]

Alright, updated!