@profullstack/fleet 0.1.0 → 0.1.1

package/README.md

@@ -60,7 +60,7 @@ matchAgents(inv, threatcrushServers);   // { devices: [{ device, agents: [...] }
 
 ### Observation rules
 
-Only what anyone could see without the device's credentials, and only for devices you run. Private addresses (RFC 1918, CGNAT, link-local, ULA) are never probed. Client profiles (desktop, phone, tablet) are not network-probed.
+Only what anyone could see without the device's credentials, and only for devices you run.  A device the observer runs on is marked `from_self` and not port-scanned: from inside, loopback skips the firewall. Observe each box from another one. Private addresses (RFC 1918, CGNAT, link-local, ULA) are never probed. Client profiles (desktop, phone, tablet) are not network-probed.
 
 ## License
 

package/observe.d.ts

@@ -1,5 +1,6 @@
 import type { Device, Inventory } from './index.js';
 export const PORTS: number[];
 export const WELLKNOWN: string[];
+export function localAddresses(): Set<string>;
 export function observe(device: Device, opts?: { timeoutMs?: number; ports?: number[]; now?: () => Date }): Promise<Record<string, unknown> & { at: string }>;
 export function observeInventory(inv: Inventory, opts?: { concurrency?: number; timeoutMs?: number; ports?: number[] }): Promise<Inventory>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/fleet",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "Read an OpenDevice inventory (servers, desktops, phones, tablets), add up what the fleet costs a month, observe each box's public metadata, and export the costs for CoinPay. Used by ThreatCrush and w3bs.org/fleet.",
   "keywords": ["fleet", "opendevice", "openserver", "inventory", "hosting", "cost", "coinpay", "threatcrush", "w3bs"],

package/src/observe.js

@@ -7,6 +7,7 @@
 // Only observe devices you run. Node-only.
 import { promises as dns } from 'node:dns';
 import net from 'node:net';
+import { networkInterfaces } from 'node:os';
 import tls from 'node:tls';
 
 export const PORTS = [22, 25, 53, 80, 443, 465, 587, 993, 2202, 3000, 5432, 6379, 8080, 8443];
@@ -26,6 +27,13 @@ function timeout(ms) {
 
 const race = (p, ms) => Promise.race([p, timeout(ms)]);
 
+// Addresses of the machine running the observer. Probing one of these goes over
+// loopback and skips the firewall, so open ports would be reported that the
+// internet cannot reach.
+export function localAddresses() {
+  return new Set(Object.values(networkInterfaces()).flat().filter(Boolean).map((i) => i.address.toLowerCase()));
+}
+
 function isPrivate(ip) {
   if (net.isIPv4(ip)) {
     const [a, b] = ip.split('.').map(Number);
@@ -128,10 +136,14 @@ export async function observe(device, { timeoutMs = 4000, ports = PORTS, now = (
   if (!publicIps.length) return out;
   const target = [...a].find((ip) => !isPrivate(ip)) ?? publicIps[0];
 
+  const self = publicIps.some((ip) => localAddresses().has(ip.toLowerCase()));
+  if (self) out.from_self = true;
+
   out.ptr = [];
   for (const ip of publicIps) for (const n of (await settle(race(dns.reverse(ip), timeoutMs), [])) ?? []) out.ptr.includes(n) || out.ptr.push(n);
   out.asn = await settle(race(asnOf(target), timeoutMs));
 
+  if (self) return out; // ports, banners and TLS would be seen from inside; observe from another box
   const open = await Promise.all(ports.map((p) => portOpen(target, p, timeoutMs).then((ok) => (ok ? p : null))));
   out.ports = open.filter((p) => p != null);