@liberstudio/cloudflare-list 2.4.0 → 2.4.1

package/dist/attacks.service.js

@@ -39,6 +39,10 @@ let AttacksService = class AttacksService {
             this.logger.log(`IP ${rawIp} appartiene al range Cloudflare — ban saltato`);
             return null;
         }
+        if (await (0, utils_1.isGoogleBotIp)(rawIp)) {
+            this.logger.log(`IP ${rawIp} è un crawler Google — ban saltato`);
+            return null;
+        }
         const asnRange = await this.lookupAsnRange(rawIp);
         if (asnRange) {
             this.logger.error(`ASN range trovato per ${rawIp}: ${asnRange} — blocco intera subnet`);

package/dist/utils/cidr.util.d.ts

@@ -0,0 +1,10 @@
+/** Rimuove il suffisso CIDR, fa trim e srotola gli IPv4-mapped IPv6 (`::ffff:`). */
+export declare function purifyIp(ip: string): string;
+export declare function ipv4ToInt(ip: string): number;
+export declare function ipv6ToBigInt(ip: string): bigint;
+export declare function isInCidrV4(ip: string, cidr: string): boolean;
+export declare function isInCidrV6(ip: string, cidr: string): boolean;
+/** Verifica se un IP "puro" appartiene a uno qualsiasi dei CIDR della sua versione. */
+export declare function isIpInAnyCidr(pureIp: string, cidrs: string[], version: 4 | 6): boolean;
+/** Ritorna la versione IP (4 | 6) di un valore già "purificato", oppure null. */
+export declare function ipVersion(pureIp: string): 4 | 6 | null;

package/dist/utils/cidr.util.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purifyIp = purifyIp;
+exports.ipv4ToInt = ipv4ToInt;
+exports.ipv6ToBigInt = ipv6ToBigInt;
+exports.isInCidrV4 = isInCidrV4;
+exports.isInCidrV6 = isInCidrV6;
+exports.isIpInAnyCidr = isIpInAnyCidr;
+exports.ipVersion = ipVersion;
+const net_1 = require("net");
+/** Rimuove il suffisso CIDR, fa trim e srotola gli IPv4-mapped IPv6 (`::ffff:`). */
+function purifyIp(ip) {
+    let pure = ip.includes("/") ? ip.split("/")[0] : ip;
+    pure = pure.trim();
+    if (pure.startsWith("::ffff:"))
+        pure = pure.slice("::ffff:".length);
+    return pure;
+}
+function ipv4ToInt(ip) {
+    return ip.split(".").reduce((acc, oct) => (acc << 8) + Number(oct), 0) >>> 0;
+}
+function ipv6ToBigInt(ip) {
+    const [headStr, tailStr] = ip.includes("::") ? ip.split("::") : [ip, ""];
+    const head = headStr ? headStr.split(":") : [];
+    const tail = tailStr ? tailStr.split(":") : [];
+    const missing = 8 - head.length - tail.length;
+    const groups = [...head, ...Array(missing).fill("0"), ...tail];
+    return groups.reduce((acc, g) => (acc << 16n) + BigInt(parseInt(g || "0", 16)), 0n);
+}
+function isInCidrV4(ip, cidr) {
+    const [range, bitsStr] = cidr.split("/");
+    const bits = bitsStr === undefined ? 32 : Number(bitsStr);
+    if (bits === 0)
+        return true;
+    const mask = (0xffffffff << (32 - bits)) >>> 0;
+    return (ipv4ToInt(ip) & mask) === (ipv4ToInt(range) & mask);
+}
+function isInCidrV6(ip, cidr) {
+    const [range, bitsStr] = cidr.split("/");
+    const prefix = bitsStr === undefined ? 128 : Number(bitsStr);
+    if (prefix === 0)
+        return true;
+    const mask = ((1n << 128n) - 1n) ^ ((1n << BigInt(128 - prefix)) - 1n);
+    return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
+}
+/** Verifica se un IP "puro" appartiene a uno qualsiasi dei CIDR della sua versione. */
+function isIpInAnyCidr(pureIp, cidrs, version) {
+    return version === 4
+        ? cidrs.some((cidr) => isInCidrV4(pureIp, cidr))
+        : cidrs.some((cidr) => isInCidrV6(pureIp, cidr));
+}
+/** Ritorna la versione IP (4 | 6) di un valore già "purificato", oppure null. */
+function ipVersion(pureIp) {
+    const version = (0, net_1.isIP)(pureIp);
+    return version === 0 ? null : version;
+}

package/dist/utils/cloudflare-ips.util.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAllowedIp = isAllowedIp;
 exports.isCloudflareIp = isCloudflareIp;
 const axios_1 = __importDefault(require("axios"));
-const net_1 = require("net");
+const cidr_util_1 = require("./cidr.util");
 const CF_IPS_V4_URL = "https://www.cloudflare.com/ips-v4/";
 const CF_IPS_V6_URL = "https://www.cloudflare.com/ips-v6/";
 const TTL_MS = 24 * 60 * 60 * 1000;
@@ -34,71 +34,30 @@ async function loadCloudflareIps() {
     });
     return inFlight;
 }
-function ipv4ToInt(ip) {
-    return ip.split(".").reduce((acc, oct) => (acc << 8) + Number(oct), 0) >>> 0;
-}
-function ipv6ToBigInt(ip) {
-    const [headStr, tailStr] = ip.includes("::") ? ip.split("::") : [ip, ""];
-    const head = headStr ? headStr.split(":") : [];
-    const tail = tailStr ? tailStr.split(":") : [];
-    const missing = 8 - head.length - tail.length;
-    const groups = [...head, ...Array(missing).fill("0"), ...tail];
-    return groups.reduce((acc, g) => (acc << 16n) + BigInt(parseInt(g || "0", 16)), 0n);
-}
-function isInCidrV4(ip, cidr) {
-    const [range, bitsStr] = cidr.split("/");
-    const bits = bitsStr === undefined ? 32 : Number(bitsStr);
-    if (bits === 0)
-        return true;
-    const mask = (0xffffffff << (32 - bits)) >>> 0;
-    return (ipv4ToInt(ip) & mask) === (ipv4ToInt(range) & mask);
-}
-function isInCidrV6(ip, cidr) {
-    const [range, bitsStr] = cidr.split("/");
-    const prefix = bitsStr === undefined ? 128 : Number(bitsStr);
-    if (prefix === 0)
-        return true;
-    const mask = ((1n << 128n) - 1n) ^ ((1n << BigInt(128 - prefix)) - 1n);
-    return (ipv6ToBigInt(ip) & mask) === (ipv6ToBigInt(range) & mask);
-}
 function isAllowedIp(ip, allowedIps) {
     if (!ip || !allowedIps.length)
         return false;
-    let pure = ip.includes("/") ? ip.split("/")[0] : ip;
-    pure = pure.trim();
-    if (pure.startsWith("::ffff:"))
-        pure = pure.slice("::ffff:".length);
-    const version = (0, net_1.isIP)(pure);
+    const pure = (0, cidr_util_1.purifyIp)(ip);
+    const version = (0, cidr_util_1.ipVersion)(pure);
     if (!version)
         return false;
     return allowedIps.some((entry) => {
-        let entryPure = entry.includes("/") ? entry.split("/")[0] : entry;
-        entryPure = entryPure.trim();
-        if (entryPure.startsWith("::ffff:"))
-            entryPure = entryPure.slice("::ffff:".length);
-        const entryVersion = (0, net_1.isIP)(entryPure);
+        const entryVersion = (0, cidr_util_1.ipVersion)((0, cidr_util_1.purifyIp)(entry));
         if (!entryVersion || entryVersion !== version)
             return false;
-        return version === 4
-            ? isInCidrV4(pure, entry)
-            : isInCidrV6(pure, entry);
+        return (0, cidr_util_1.isIpInAnyCidr)(pure, [entry], version);
     });
 }
 async function isCloudflareIp(ip) {
     if (!ip)
         return false;
-    let pure = ip.includes("/") ? ip.split("/")[0] : ip;
-    pure = pure.trim();
-    if (pure.startsWith("::ffff:"))
-        pure = pure.slice("::ffff:".length);
-    const version = (0, net_1.isIP)(pure);
+    const pure = (0, cidr_util_1.purifyIp)(ip);
+    const version = (0, cidr_util_1.ipVersion)(pure);
     if (!version)
         return false;
     try {
         const { v4, v6 } = await loadCloudflareIps();
-        return version === 4
-            ? v4.some((cidr) => isInCidrV4(pure, cidr))
-            : v6.some((cidr) => isInCidrV6(pure, cidr));
+        return (0, cidr_util_1.isIpInAnyCidr)(pure, version === 4 ? v4 : v6, version);
     }
     catch {
         return false;

package/dist/utils/googlebot.util.d.ts

@@ -0,0 +1,11 @@
+/**
+ * True se l'IP appartiene ai crawler Google (Googlebot, special crawlers, fetcher).
+ *
+ * Strategia hybrid:
+ *  1. match veloce sulle liste IP ufficiali (cache 24h, auto-aggiornate);
+ *  2. fallback reverse DNS anti-spoofing se non presente nelle liste.
+ *
+ * Fail-open: se né le liste né il DNS riescono a verificare, ritorna `true`
+ * (non bannare) per non rischiare di bloccare Googlebot durante un disservizio.
+ */
+export declare function isGoogleBotIp(ip: string): Promise<boolean>;

package/dist/utils/googlebot.util.js

@@ -0,0 +1,95 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isGoogleBotIp = isGoogleBotIp;
+const axios_1 = __importDefault(require("axios"));
+const dns_1 = require("dns");
+const cidr_util_1 = require("./cidr.util");
+// Liste IP ufficiali pubblicate (e aggiornate) da Google.
+const GOOGLE_IP_LIST_URLS = [
+    "https://developers.google.com/static/search/apis/ipranges/googlebot.json",
+    "https://developers.google.com/static/search/apis/ipranges/special-crawlers.json",
+    "https://developers.google.com/static/search/apis/ipranges/user-triggered-fetchers.json",
+];
+// Domini dei crawler verificati da Google (per il fallback reverse DNS).
+const GOOGLE_HOSTS = [".googlebot.com", ".google.com", ".googleusercontent.com"];
+const TTL_MS = 24 * 60 * 60 * 1000;
+let cache = null;
+let inFlight = null;
+async function loadGoogleIps() {
+    if (cache && Date.now() < cache.expiresAt)
+        return cache;
+    if (inFlight)
+        return inFlight;
+    inFlight = (async () => {
+        const responses = await Promise.all(GOOGLE_IP_LIST_URLS.map((url) => axios_1.default.get(url)));
+        const v4 = [];
+        const v6 = [];
+        for (const res of responses) {
+            for (const prefix of res.data?.prefixes ?? []) {
+                if (prefix.ipv4Prefix)
+                    v4.push(prefix.ipv4Prefix);
+                if (prefix.ipv6Prefix)
+                    v6.push(prefix.ipv6Prefix);
+            }
+        }
+        cache = { v4, v6, expiresAt: Date.now() + TTL_MS };
+        return cache;
+    })().finally(() => {
+        inFlight = null;
+    });
+    return inFlight;
+}
+/**
+ * Verifica anti-spoofing via reverse + forward DNS (metodo raccomandato da Google).
+ * Ritorna `true`/`false` se determinabile, `null` se la risoluzione DNS fallisce.
+ */
+async function verifyByReverseDns(pureIp, version) {
+    try {
+        const hostnames = await dns_1.promises.reverse(pureIp);
+        const host = hostnames.find((h) => GOOGLE_HOSTS.some((d) => h.endsWith(d)));
+        if (!host)
+            return false; // reverse DNS risolto ma non è un dominio Google
+        const resolved = version === 4 ? await dns_1.promises.resolve4(host) : await dns_1.promises.resolve6(host);
+        return resolved.some((addr) => (0, cidr_util_1.purifyIp)(addr) === pureIp);
+    }
+    catch {
+        return null; // nessun PTR / errore DNS: non determinabile
+    }
+}
+/**
+ * True se l'IP appartiene ai crawler Google (Googlebot, special crawlers, fetcher).
+ *
+ * Strategia hybrid:
+ *  1. match veloce sulle liste IP ufficiali (cache 24h, auto-aggiornate);
+ *  2. fallback reverse DNS anti-spoofing se non presente nelle liste.
+ *
+ * Fail-open: se né le liste né il DNS riescono a verificare, ritorna `true`
+ * (non bannare) per non rischiare di bloccare Googlebot durante un disservizio.
+ */
+async function isGoogleBotIp(ip) {
+    if (!ip)
+        return false;
+    const pure = (0, cidr_util_1.purifyIp)(ip);
+    const version = (0, cidr_util_1.ipVersion)(pure);
+    if (!version)
+        return false;
+    let listAvailable = false;
+    try {
+        const { v4, v6 } = await loadGoogleIps();
+        listAvailable = true;
+        if ((0, cidr_util_1.isIpInAnyCidr)(pure, version === 4 ? v4 : v6, version))
+            return true;
+    }
+    catch {
+        listAvailable = false;
+    }
+    const dnsResult = await verifyByReverseDns(pure, version);
+    if (dnsResult !== null)
+        return dnsResult;
+    // DNS non determinabile: se la lista era disponibile e l'IP non c'era → non è Google;
+    // se nemmeno la lista era raggiungibile → fail-open.
+    return !listAvailable;
+}

package/dist/utils/index.d.ts

@@ -1,4 +1,6 @@
+export * from './cidr.util';
 export * from './cloudflare.constants';
 export * from './cloudflare-ips.util';
 export * from './get-client-ip.util';
+export * from './googlebot.util';
 export * from './options.validator';

package/dist/utils/index.js

@@ -14,7 +14,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./cidr.util"), exports);
 __exportStar(require("./cloudflare.constants"), exports);
 __exportStar(require("./cloudflare-ips.util"), exports);
 __exportStar(require("./get-client-ip.util"), exports);
+__exportStar(require("./googlebot.util"), exports);
 __exportStar(require("./options.validator"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liberstudio/cloudflare-list",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Modulo NestJS per gestione IP List Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,14 +32,17 @@
     "rxjs": ">=7.0.0"
   },
   "devDependencies": {
-    "@nestjs/axios": "^4.0.0",
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.1.14",
+    "@nestjs/axios": "^4.0.1",
+    "@nestjs/common": "^11.1.26",
+    "@nestjs/core": "^11.1.26",
     "@types/express": "^5.0.6",
-    "@types/node": "^20.9.0",
-    "axios": "^1.0.0",
-    "rxjs": "^7.8.0",
+    "@types/node": "^20.19.43",
+    "axios": "^1.18.0",
+    "rxjs": "^7.8.2",
     "simple-git-hooks": "^2.13.1",
     "typescript": "^5.0.0"
+  },
+  "allowScripts": {
+    "simple-git-hooks@2.13.1": true
   }
 }