Classify special IP ranges before private IPs

Author: whatisproblem

src/iocraft/extractors.py

@@ -85,16 +85,16 @@ def dedupe(indicators: list[Indicator]) -> list[Indicator]:
 
 def classify_ip(address: ipaddress._BaseAddress) -> tuple[str, ...]:
     tags = ["network"]
-    if address.is_private:
-        tags.append("private-ip")
-    elif address.is_loopback:
+    if address.is_loopback:
         tags.append("loopback-ip")
     elif address.is_multicast:
         tags.append("multicast-ip")
     elif address.is_reserved:
         tags.append("reserved-ip")
     elif address.is_unspecified:
         tags.append("unspecified-ip")
+    elif address.is_private:
+        tags.append("private-ip")
     else:
         tags.append("public-ip")
     return tuple(tags)

tests/test_extractors.py

@@ -3,7 +3,8 @@
 import unittest
 from pathlib import Path
 
-from iocraft.extractors import extract_from_paths, extract_from_text
+from iocraft.extractors import classify_ip, extract_from_paths, extract_from_text
+import ipaddress
 
 
 ROOT = Path(__file__).resolve().parents[1]
@@ -37,6 +38,19 @@ def test_dedupe(self) -> None:
         domains = [indicator for indicator in indicators if indicator.type == "domain"]
         self.assertEqual(len(domains), 1)
 
+    def test_ip_classification_prefers_specific_tags(self) -> None:
+        cases = {
+            "127.0.0.1": "loopback-ip",
+            "0.0.0.0": "unspecified-ip",
+            "224.0.0.1": "multicast-ip",
+            "240.0.0.1": "reserved-ip",
+            "10.0.0.1": "private-ip",
+            "8.8.8.8": "public-ip",
+        }
+        for value, expected_tag in cases.items():
+            with self.subTest(value=value):
+                self.assertIn(expected_tag, classify_ip(ipaddress.ip_address(value)))
+
 
 if __name__ == "__main__":
     unittest.main()