@liberstudio/cloudflare-list 2.3.2 → 2.3.4

package/dist/attacks.service.d.ts

@@ -7,7 +7,7 @@ export declare class AttacksService {
     private readonly API_URL;
     private readonly ASN_LOOKUP_URL;
     constructor(httpService: HttpService, options: CloudflareAttacksOptions);
-    blockIp(rawIp: string): Promise<CloudflareResponse>;
+    blockIp(rawIp: string): Promise<CloudflareResponse | null>;
     private lookupAsnRange;
     updateIpList(cidr: string): Promise<CloudflareResponse>;
 }

package/dist/attacks.service.js

@@ -31,6 +31,10 @@ let AttacksService = class AttacksService {
         this.ASN_LOOKUP_URL = `https://api.hackertarget.com/aslookup`;
     }
     async blockIp(rawIp) {
+        if (await (0, utils_1.isCloudflareIp)(rawIp)) {
+            this.logger.log(`IP ${rawIp} appartiene al range Cloudflare — ban saltato`);
+            return null;
+        }
         const asnRange = await this.lookupAsnRange(rawIp);
         if (asnRange) {
             this.logger.log(`ASN range trovato per ${rawIp}: ${asnRange} — blocco intera subnet`);

package/dist/utils/cloudflare-ips.util.d.ts

@@ -0,0 +1 @@
+export declare function isCloudflareIp(ip: string): Promise<boolean>;

package/dist/utils/cloudflare-ips.util.js

@@ -0,0 +1,82 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isCloudflareIp = isCloudflareIp;
+const axios_1 = __importDefault(require("axios"));
+const net_1 = require("net");
+const CF_IPS_V4_URL = "https://www.cloudflare.com/ips-v4/";
+const CF_IPS_V6_URL = "https://www.cloudflare.com/ips-v6/";
+const TTL_MS = 24 * 60 * 60 * 1000;
+let cache = null;
+let inFlight = null;
+async function loadCloudflareIps() {
+    if (cache && Date.now() < cache.expiresAt)
+        return cache;
+    if (inFlight)
+        return inFlight;
+    inFlight = (async () => {
+        const [v4Res, v6Res] = await Promise.all([
+            axios_1.default.get(CF_IPS_V4_URL, { responseType: "text" }),
+            axios_1.default.get(CF_IPS_V6_URL, { responseType: "text" }),
+        ]);
+        const parse = (data) => data.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+        cache = {
+            v4: parse(v4Res.data),
+            v6: parse(v6Res.data),
+            expiresAt: Date.now() + TTL_MS,
+        };
+        return cache;
+    })().finally(() => {
+        inFlight = null;
+    });
+    return inFlight;
+}
+function ipv4ToInt(ip) {
+    return ip.split(".").reduce((acc, oct) => (acc << 8) + Number(oct), 0) >>> 0;
+}
+function ipv6ToBigInt(ip) {
+    const [headStr, tailStr] = ip.includes("::") ? ip.split("::") : [ip, ""];
+    const head = headStr ? headStr.split(":") : [];
+    const tail = tailStr ? tailStr.split(":") : [];
+    const missing = 8 - head.length - tail.length;
+    const groups = [...head, ...Array(missing).fill("0"), ...tail];
+    return groups.reduce((acc, g) => (acc << 16n) + BigInt(parseInt(g || "0", 16)), 0n);
+}
+function isInCidrV4(ip, cidr) {
+    const [range, bitsStr] = cidr.split("/");
+    const bits = bitsStr === undefined ? 32 : Number(bitsStr);
+    if (bits === 0)
+        return true;
+    const mask = (0xffffffff << (32 - bits)) >>> 0;
+    return (ipv4ToInt(ip) & mask) === (ipv4ToInt(range) & mask);
+}
+function isInCidrV6(ip, cidr) {
+    const [range, bitsStr] = cidr.split("/");
+    const prefix = bitsStr === undefined ? 128 : Number(bitsStr);
+    if (prefix === 0)
+        return true;
+    const mask = ((1n << 128n) - 1n) ^ ((1n << BigInt(128 - prefix)) - 1n);
+    return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
+}
+async function isCloudflareIp(ip) {
+    if (!ip)
+        return false;
+    let pure = ip.includes("/") ? ip.split("/")[0] : ip;
+    pure = pure.trim();
+    if (pure.startsWith("::ffff:"))
+        pure = pure.slice("::ffff:".length);
+    const version = (0, net_1.isIP)(pure);
+    if (!version)
+        return false;
+    try {
+        const { v4, v6 } = await loadCloudflareIps();
+        return version === 4
+            ? v4.some((cidr) => isInCidrV4(pure, cidr))
+            : v6.some((cidr) => isInCidrV6(pure, cidr));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/utils/index.d.ts

@@ -1,3 +1,4 @@
 export * from './cloudflare.constants';
+export * from './cloudflare-ips.util';
 export * from './get-client-ip.util';
 export * from './options.validator';

package/dist/utils/index.js

@@ -15,5 +15,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./cloudflare.constants"), exports);
+__exportStar(require("./cloudflare-ips.util"), exports);
 __exportStar(require("./get-client-ip.util"), exports);
 __exportStar(require("./options.validator"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liberstudio/cloudflare-list",
-  "version": "2.3.2",
+  "version": "2.3.4",
   "description": "Modulo NestJS per gestione IP List Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",