@hackthedev/dsync-ipsec 1.0.0

package/.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

package/README.md

@@ -0,0 +1,2 @@
+# dSyncIPSec
+ IP Based Security Library against Abuse

package/index.mjs

@@ -0,0 +1,150 @@
+import ArrayTools from "@hackthedev/arraytools"
+
+export default class dSyncIPSec {
+    constructor({
+                    blockBogon = true,
+                    blockDatacenter = true,
+                    blockSatelite = true,
+                    blockCrawler = true,
+                    blockProxy = true,
+                    blockVPN = true,
+                    blockTor = true,
+                    blockAbuser = true,
+                    // some arrays
+                    whitelistedUrls = [],
+                    whitelistedIps = [],
+                    blockedCountryCodes = [],
+                    whitelistedCompanyDomains = [],
+                    blacklistedIps = [
+                        "::1",
+                        "127.0.0.1",
+                        "localhost"
+                    ]
+                } = {}) {
+
+        this.blockBogon = blockBogon;
+        this.blockDatacenter = blockDatacenter;
+        this.blockSatelite = blockSatelite;
+        this.blockCrawler = blockCrawler;
+        this.blockProxy = blockProxy;
+        this.blockVPN = blockVPN;
+        this.blockTor = blockTor;
+        this.blockAbuser = blockAbuser;
+        this.blockedCountryCodes = blockedCountryCodes;
+
+        this.urlWhitelist = new ArrayTools(whitelistedUrls)
+        this.ipWhitelist = new ArrayTools(whitelistedIps)
+        this.ipBlacklist = new ArrayTools(blacklistedIps)
+        this.companyDomainWhitelist = new ArrayTools(whitelistedCompanyDomains)
+        this.blockedCountriesByCode = new ArrayTools(blockedCountryCodes)
+    }
+
+    updateRule({
+                    blockBogon = null,
+                    blockDatacenter = null,
+                    blockSatelite = null,
+                    blockCrawler = null,
+                    blockProxy = null,
+                    blockVPN = null,
+                    blockTor = null,
+                    blockAbuser = null,
+                }){
+
+        if(blockBogon !== null) this.blockBogon = blockBogon
+        if(blockDatacenter !== null) this.blockDatacenter = blockDatacenter
+        if(blockSatelite !== null) this.blockSatelite =blockSatelite
+        if(blockCrawler !== null) this.blockCrawler = blockCrawler
+        if(blockProxy !== null) this.blockProxy = blockProxy
+        if(blockVPN !== null) this.blockVPN = blockVPN
+        if(blockTor !== null) this.blockTor = blockTor
+        if(blockAbuser !== null) this.blockAbuser = blockAbuser
+    }
+
+    whitelistIP(ip, allowDuplicates = false){
+        if(!ip) throw new Error("Unable to whitelist ip as no ip was provided.");
+        if(!this.ipWhitelist.matches(ip) && !allowDuplicates) this.ipWhitelist.addEntry(ip);
+        if(this.ipBlacklist.matches(ip)) this.ipBlacklist.removeEntry(ip);
+    }
+
+    blacklistIp(ip, allowDuplicates = false){
+        if(!ip) throw new Error("Unable to blacklist ip as no ip was provided.");
+        if(!this.ipBlacklist.matches(ip) && !allowDuplicates) this.ipBlacklist.addEntry(ip);
+        if(this.ipWhitelist.matches(ip)) this.ipWhitelist.removeEntry(ip);
+    }
+
+    isBlacklistedIp(ip){
+        if(!ip) throw new Error("Coudlnt check ip blacklist as no ip was provided.")
+        return this.ipBlacklist.matches(ip);
+    }
+
+    isWhitelistedIp(ip){
+        if(!ip) throw new Error("Coudlnt check ip blacklist as no ip was provided.")
+        return this.ipWhitelist.matches(ip);
+    }
+
+    async filterExpressTraffic(app){
+        if(!app) throw new Error("Unable to filter express traffic as no express app was provided.");
+
+        app.use(async (req, res, next) => {
+            const ipInfo = await this.lookupIP(this.getClientIp(req));
+            if (!ipInfo) return next();
+
+            // whitelist some urls for functionality
+            let reqPath = req.path;
+            if(!reqPath) throw new Error("Unable to get request path from req parameter as it wasnt specified or null");
+
+            // first check for ip blacklist
+            if(this.ipBlacklist.matches(ipInfo?.ip)) return res.sendStatus(403);
+
+            // then we can check for whitelisted urls as these bypass normal checks
+            // url whitelist
+            if(this.urlWhitelist.matches(reqPath)) return next();
+            // let whitelisted ips pass
+            if(this.ipWhitelist.matches(ipInfo?.ip)) return next();
+            // company domain whitelist
+            if(this.companyDomainWhitelist.matches(ipInfo?.company?.domain)) return next();
+
+            // looking kinda beautiful
+            if (ipInfo?.is_bogon && this.blockBogon) return res.sendStatus(403);
+            if (ipInfo?.is_datacenter && this.blockDatacenter) return res.sendStatus(403);
+            if (ipInfo?.is_satelite && this.blockSatelite) return res.sendStatus(403);
+            if (ipInfo?.is_crawler && this.blockCrawler) return res.sendStatus(403);
+            if (ipInfo?.is_proxy && this.blockProxy) return res.sendStatus(403);
+            if (ipInfo?.is_vpn && this.blockVPN) return res.sendStatus(403);
+            if (ipInfo?.is_tor && this.blockTor) return res.sendStatus(403);
+            if (ipInfo?.is_abuser && this.blockAbuser) return res.sendStatus(403);
+
+            if (
+                ipInfo.location?.country_code &&
+                this.blockedCountriesByCode.matches(ipInfo?.location?.country_code?.toLowerCase())
+            ) return res.sendStatus(403);
+
+            // continue
+            next();
+        });
+    }
+
+    getClientIp(req) {
+        if(!req) throw new Error("Unable to get client ip from req parameter as it wasnt specified or null");
+        const xf = req.headers["x-forwarded-for"];
+        if (xf) return xf.split(",")[0].trim();
+        return req.socket?.remoteAddress || req.connection?.remoteAddress;
+    }
+
+    async lookupIP(ip){
+        if(!ip) throw new Error("Unable to lookup ip as it wasnt provided.")
+
+        // if an ip is blacklisted we return with an error "reponse"
+        if(this.isBlacklistedIp(ip)) return {error: `IP ${ip} was local.`};
+
+        // make request to get ip info
+        let ipRequest = await fetch(`https://api.ipapi.is/?q=${ip}`);
+        if(ipRequest.status === 200){
+            let ipData = await ipRequest.json();
+            return ipData;
+        }
+        else{
+            return {error: "Failed to fetch IP data"};
+        }
+    }
+}

package/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@hackthedev/dsync-ipsec",
+  "version": "1.0.0",
+  "description": "IP Based Security Library against Abuse",
+  "license": "ISC",
+  "author": "",
+  "main": "index.mjs",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  }
+}