flareguard 0.1.0

package/src/origin/cloudflare.rs

@@ -0,0 +1,170 @@
+use ipnet::{IpNet, Ipv4Net, Ipv6Net};
+use std::net::IpAddr;
+use std::str::FromStr;
+use std::sync::OnceLock;
+
+/// Official Cloudflare IPv4 IP ranges (https://www.cloudflare.com/ips-v4)
+pub const CLOUDFLARE_IPV4_CIDRS: &[&str] = &[
+    "173.245.48.0/20",
+    "103.21.244.0/22",
+    "103.22.200.0/22",
+    "103.31.4.0/22",
+    "141.101.64.0/18",
+    "108.162.192.0/18",
+    "190.93.240.0/20",
+    "188.114.96.0/20",
+    "197.234.240.0/22",
+    "198.41.128.0/17",
+    "162.158.0.0/15",
+    "104.16.0.0/13",
+    "104.24.0.0/14",
+    "172.64.0.0/13",
+    "131.0.72.0/22",
+];
+
+/// Official Cloudflare IPv6 IP ranges (https://www.cloudflare.com/ips-v6)
+pub const CLOUDFLARE_IPV6_CIDRS: &[&str] = &[
+    "2400:cb00::/32",
+    "2606:4700::/32",
+    "2803:f800::/32",
+    "2405:b500::/32",
+    "2405:8100::/32",
+    "2a06:98c0::/29",
+    "2c0f:f248::/32",
+];
+
+/// Cloudflare Autonomous System Numbers (ASN)
+pub const CLOUDFLARE_ASNS: &[&str] = &["AS13335", "AS209242", "CLOUDFLARENET", "CLOUDFLARE"];
+
+static CLOUDFLARE_NETWORKS: OnceLock<Vec<IpNet>> = OnceLock::new();
+
+fn get_cloudflare_networks() -> &'static Vec<IpNet> {
+    CLOUDFLARE_NETWORKS.get_or_init(|| {
+        let mut nets = Vec::new();
+        for cidr in CLOUDFLARE_IPV4_CIDRS {
+            if let Ok(net) = Ipv4Net::from_str(cidr) {
+                nets.push(IpNet::V4(net));
+            }
+        }
+        for cidr in CLOUDFLARE_IPV6_CIDRS {
+            if let Ok(net) = Ipv6Net::from_str(cidr) {
+                nets.push(IpNet::V6(net));
+            }
+        }
+        nets
+    })
+}
+
+/// Checks if an IP address belongs to Cloudflare's public proxy edge network
+pub fn is_cloudflare_ip(ip: &IpAddr) -> bool {
+    let networks = get_cloudflare_networks();
+    networks.iter().any(|net| net.contains(ip))
+}
+
+/// Checks if an ASN string represents Cloudflare
+pub fn is_cloudflare_asn(asn: &str) -> bool {
+    let upper = asn.to_uppercase();
+    CLOUDFLARE_ASNS.iter().any(|&cf_asn| upper.contains(cf_asn))
+}
+
+/// Checks if HTTP headers contain Cloudflare edge proxy signatures
+pub fn has_cloudflare_headers(headers: &std::collections::HashMap<String, String>) -> bool {
+    for (k, v) in headers {
+        let key = k.to_lowercase();
+        let val = v.to_lowercase();
+        if key == "server" && val.contains("cloudflare") {
+            return true;
+        }
+        if key == "cf-ray"
+            || key == "cf-cache-status"
+            || key == "cf-mitigated"
+            || key == "cf-request-id"
+        {
+            return true;
+        }
+    }
+    false
+}
+
+/// Filters a slice of IP addresses into Cloudflare edge IPs and non-Cloudflare candidate IPs
+pub fn partition_ips(ips: &[IpAddr]) -> (Vec<IpAddr>, Vec<IpAddr>) {
+    let mut cf_ips = Vec::new();
+    let mut non_cf_ips = Vec::new();
+
+    for &ip in ips {
+        if is_cloudflare_ip(&ip) {
+            cf_ips.push(ip);
+        } else {
+            non_cf_ips.push(ip);
+        }
+    }
+
+    (cf_ips, non_cf_ips)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_cloudflare_ipv4_detection() {
+        // Known Cloudflare IPs
+        let cf_ip1: IpAddr = "104.21.45.12".parse().unwrap();
+        let cf_ip2: IpAddr = "172.67.180.20".parse().unwrap();
+        let cf_ip3: IpAddr = "162.158.5.99".parse().unwrap();
+        let cf_ip4: IpAddr = "198.41.130.1".parse().unwrap();
+
+        assert!(is_cloudflare_ip(&cf_ip1));
+        assert!(is_cloudflare_ip(&cf_ip2));
+        assert!(is_cloudflare_ip(&cf_ip3));
+        assert!(is_cloudflare_ip(&cf_ip4));
+
+        // Non-Cloudflare IPs
+        let non_cf_ip1: IpAddr = "198.51.100.42".parse().unwrap();
+        let non_cf_ip2: IpAddr = "8.8.8.8".parse().unwrap();
+        let non_cf_ip3: IpAddr = "1.1.1.1".parse().unwrap(); // Note: 1.1.1.1 is CF DNS, but not in proxy CIDRs
+        let non_cf_ip4: IpAddr = "140.82.121.3".parse().unwrap(); // GitHub
+
+        assert!(!is_cloudflare_ip(&non_cf_ip1));
+        assert!(!is_cloudflare_ip(&non_cf_ip2));
+        assert!(!is_cloudflare_ip(&non_cf_ip3));
+        assert!(!is_cloudflare_ip(&non_cf_ip4));
+    }
+
+    #[test]
+    fn test_cloudflare_ipv6_detection() {
+        let cf_ipv6: IpAddr = "2606:4700:3037::ac43:d236".parse().unwrap();
+        assert!(is_cloudflare_ip(&cf_ipv6));
+
+        let non_cf_ipv6: IpAddr = "2001:4860:4860::8888".parse().unwrap();
+        assert!(!is_cloudflare_ip(&non_cf_ipv6));
+    }
+
+    #[test]
+    fn test_partition_ips() {
+        let ips = vec![
+            "104.21.1.1".parse().unwrap(),
+            "198.51.100.5".parse().unwrap(),
+            "172.67.2.2".parse().unwrap(),
+            "203.0.113.10".parse().unwrap(),
+        ];
+        let (cf, non_cf) = partition_ips(&ips);
+        assert_eq!(cf.len(), 2);
+        assert_eq!(non_cf.len(), 2);
+        assert!(non_cf.contains(&"198.51.100.5".parse().unwrap()));
+        assert!(non_cf.contains(&"203.0.113.10".parse().unwrap()));
+    }
+
+    #[test]
+    fn test_has_cloudflare_headers() {
+        let mut headers = std::collections::HashMap::new();
+        headers.insert("server".to_string(), "cloudflare".to_string());
+        headers.insert("cf-ray".to_string(), "8abc1234def-ORD".to_string());
+        assert!(has_cloudflare_headers(&headers));
+
+        let mut origin_headers = std::collections::HashMap::new();
+        origin_headers.insert("server".to_string(), "nginx/1.24.0".to_string());
+        origin_headers.insert("x-powered-by".to_string(), "PHP/8.2".to_string());
+        assert!(!has_cloudflare_headers(&origin_headers));
+    }
+}

package/src/origin/confidence.rs

@@ -0,0 +1,320 @@
+use crate::origin::models::{ConfidenceLevel, DiscoverySource, ProbeResult, TargetBaseline};
+
+/// Calculates the overall confidence score (0-100) and confidence level for a candidate IP
+pub fn calculate_confidence(
+    baseline: &TargetBaseline,
+    source: &DiscoverySource,
+    successful_probes: &[ProbeResult],
+    _failed_probes: &[ProbeResult],
+) -> (ConfidenceLevel, u8, String) {
+    // 1. Check for exact probe match (CONFIRMED - 100%)
+    for probe in successful_probes {
+        if let Some(ref match_details) = probe.match_details
+            && match_details.exact_body_hash_match {
+                return (
+                    ConfidenceLevel::Confirmed,
+                    100,
+                    format!(
+                        "Exact SHA-256 body hash match on direct HTTP/HTTPS probe (port {}). Backend returned identical payload bypassing Cloudflare edge.",
+                        probe.port
+                    ),
+                );
+            }
+    }
+
+    // 2. Check for title match and header similarities (HIGH - 85%)
+    for probe in successful_probes {
+        if let Some(ref match_details) = probe.match_details
+            && match_details.title_match && !match_details.cf_ray_present {
+                let baseline_title = baseline.html_title.as_deref().unwrap_or("N/A");
+                return (
+                    ConfidenceLevel::High,
+                    85,
+                    format!(
+                        "HTML title matches target baseline ('{}') without Cloudflare proxy headers on port {}.",
+                        baseline_title, probe.port
+                    ),
+                );
+            }
+    }
+
+    // 3. Check for direct subdomain origin bypass (HIGH - 80-85%)
+    match source {
+        DiscoverySource::Subdomain(sub) if is_high_value_subdomain(sub) => {
+            if !successful_probes.is_empty() {
+                return (
+                    ConfidenceLevel::High,
+                    80,
+                    format!(
+                        "High-value origin subdomain ('{}') points directly to unmasked IP and responds to HTTP requests.",
+                        sub
+                    ),
+                );
+            }
+        }
+        DiscoverySource::CertificateTransparency(san) if is_high_value_subdomain(san)
+            && !successful_probes.is_empty() => {
+                return (
+                    ConfidenceLevel::High,
+                    80,
+                    format!(
+                        "Certificate Transparency SAN ('{}') points to unmasked IP with active web service.",
+                        san
+                    ),
+                );
+            }
+        _ => {}
+    }
+
+    // 4. Check for SPF direct IP declaration or MX server (MEDIUM - 60-70%)
+    match source {
+        DiscoverySource::SpfRecord(spf) => {
+            if !successful_probes.is_empty() {
+                return (
+                    ConfidenceLevel::Medium,
+                    70,
+                    format!(
+                        "IP explicitly authorized in target SPF record ('{}') and hosts active web service.",
+                        spf
+                    ),
+                );
+            } else {
+                return (
+                    ConfidenceLevel::Medium,
+                    55,
+                    format!(
+                        "IP explicitly declared in SPF record ('{}'); server did not respond on standard HTTP/HTTPS ports.",
+                        spf
+                    ),
+                );
+            }
+        }
+        DiscoverySource::MxRecord(mx) => {
+            if !successful_probes.is_empty() {
+                return (
+                    ConfidenceLevel::Medium,
+                    65,
+                    format!(
+                        "Target MX server ('{}') resolves to unmasked IP and accepts HTTP traffic.",
+                        mx
+                    ),
+                );
+            } else {
+                return (
+                    ConfidenceLevel::Medium,
+                    50,
+                    format!(
+                        "Target MX server ('{}') resolves to non-Cloudflare IP address.",
+                        mx
+                    ),
+                );
+            }
+        }
+        DiscoverySource::Subdomain(sub) => {
+            if !successful_probes.is_empty() {
+                return (
+                    ConfidenceLevel::Medium,
+                    60,
+                    format!(
+                        "Subdomain ('{}') resolves to non-Cloudflare IP with responsive HTTP port.",
+                        sub
+                    ),
+                );
+            }
+        }
+        DiscoverySource::CertificateTransparency(san) => {
+            if !successful_probes.is_empty() {
+                return (
+                    ConfidenceLevel::Medium,
+                    60,
+                    format!(
+                        "Historical crt.sh SAN ('{}') resolves to non-Cloudflare IP with responsive HTTP port.",
+                        san
+                    ),
+                );
+            }
+        }
+        DiscoverySource::HistoricalDns(src)
+            if !successful_probes.is_empty() => {
+                return (
+                    ConfidenceLevel::Medium,
+                    65,
+                    format!(
+                        "Historical DNS record ('{}') resolves to active HTTP server.",
+                        src
+                    ),
+                );
+            }
+        _ => {}
+    }
+
+    // 5. Fallback for non-responsive candidate IPs (LOW - 25-35%)
+    let reason = match source {
+        DiscoverySource::Subdomain(sub) => {
+            format!(
+                "Subdomain ('{}') points to non-Cloudflare IP, but HTTP probes failed or timed out.",
+                sub
+            )
+        }
+        DiscoverySource::CertificateTransparency(san) => {
+            format!(
+                "Certificate SAN ('{}') points to non-Cloudflare IP, but HTTP probes failed or timed out.",
+                san
+            )
+        }
+        DiscoverySource::HistoricalDns(src) => {
+            format!(
+                "Historical record ('{}') points to non-Cloudflare IP, but host is currently unresponsive.",
+                src
+            )
+        }
+        _ => {
+            format!(
+                "Candidate discovered via {}, but no direct HTTP verification succeeded.",
+                source
+            )
+        }
+    };
+
+    (ConfidenceLevel::Low, 30, reason)
+}
+
+fn is_high_value_subdomain(name: &str) -> bool {
+    let lower = name.to_lowercase();
+    let keywords = [
+        "origin",
+        "direct",
+        "cpanel",
+        "dev",
+        "staging",
+        "api-origin",
+        "backend",
+        "internal",
+        "vps",
+        "server",
+        "admin",
+        "portal",
+        "ssh",
+    ];
+    keywords.iter().any(|&k| lower.contains(k))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::origin::models::ProbeMatchDetails;
+    use std::collections::HashMap;
+
+    fn mock_baseline() -> TargetBaseline {
+        TargetBaseline {
+            domain: "example.com".to_string(),
+            resolved_ips: vec!["104.21.1.1".parse().unwrap()],
+            is_behind_cloudflare: true,
+            cloudflare_ips: vec!["104.21.1.1".parse().unwrap()],
+            non_cloudflare_ips: vec![],
+            http_status: Some(200),
+            html_title: Some("Welcome to Example".to_string()),
+            body_sha256: Some("abcdef1234567890".to_string()),
+            body_length: 1200,
+            server_header: Some("cloudflare".to_string()),
+            headers: HashMap::new(),
+        }
+    }
+
+    #[test]
+    fn test_confidence_confirmed_on_hash_match() {
+        let baseline = mock_baseline();
+        let probe = ProbeResult {
+            ip: "198.51.100.42".parse().unwrap(),
+            port: 80,
+            protocol: "http".to_string(),
+            url: "http://198.51.100.42/".to_string(),
+            success: true,
+            status_code: Some(200),
+            html_title: Some("Welcome to Example".to_string()),
+            body_sha256: Some("abcdef1234567890".to_string()),
+            body_length: 1200,
+            server_header: Some("nginx".to_string()),
+            headers: HashMap::new(),
+            response_time_ms: 45,
+            error: None,
+            match_details: Some(ProbeMatchDetails {
+                exact_body_hash_match: true,
+                title_match: true,
+                status_code_match: true,
+                body_length_delta: 0,
+                header_similarity_score: 0.9,
+                cf_ray_present: false,
+                direct_server_header: Some("nginx".to_string()),
+                baseline_server_header: Some("cloudflare".to_string()),
+            }),
+        };
+
+        let (level, score, reason) = calculate_confidence(
+            &baseline,
+            &DiscoverySource::Subdomain("origin.example.com".into()),
+            &[probe],
+            &[],
+        );
+
+        assert_eq!(level, ConfidenceLevel::Confirmed);
+        assert_eq!(score, 100);
+        assert!(reason.contains("Exact SHA-256"));
+    }
+
+    #[test]
+    fn test_confidence_high_on_title_match() {
+        let baseline = mock_baseline();
+        let probe = ProbeResult {
+            ip: "198.51.100.42".parse().unwrap(),
+            port: 443,
+            protocol: "https".to_string(),
+            url: "https://198.51.100.42/".to_string(),
+            success: true,
+            status_code: Some(200),
+            html_title: Some("Welcome to Example".to_string()),
+            body_sha256: Some("different_hash".to_string()),
+            body_length: 1250,
+            server_header: Some("Apache/2.4".to_string()),
+            headers: HashMap::new(),
+            response_time_ms: 50,
+            error: None,
+            match_details: Some(ProbeMatchDetails {
+                exact_body_hash_match: false,
+                title_match: true,
+                status_code_match: true,
+                body_length_delta: 50,
+                header_similarity_score: 0.8,
+                cf_ray_present: false,
+                direct_server_header: Some("Apache/2.4".to_string()),
+                baseline_server_header: Some("cloudflare".to_string()),
+            }),
+        };
+
+        let (level, score, reason) = calculate_confidence(
+            &baseline,
+            &DiscoverySource::Subdomain("dev.example.com".into()),
+            &[probe],
+            &[],
+        );
+
+        assert_eq!(level, ConfidenceLevel::High);
+        assert_eq!(score, 85);
+        assert!(reason.contains("HTML title matches"));
+    }
+
+    #[test]
+    fn test_confidence_medium_on_spf() {
+        let baseline = mock_baseline();
+        let (level, score, reason) = calculate_confidence(
+            &baseline,
+            &DiscoverySource::SpfRecord("ip4:198.51.100.42".into()),
+            &[],
+            &[],
+        );
+
+        assert_eq!(level, ConfidenceLevel::Medium);
+        assert_eq!(score, 55);
+        assert!(reason.contains("SPF record"));
+    }
+}

package/src/origin/crtsh.rs

@@ -0,0 +1,144 @@
+use crate::origin::error::Result;
+use reqwest::Client;
+use serde::Deserialize;
+use std::collections::HashSet;
+use std::time::Duration;
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct CrtShEntry {
+    pub issuer_ca_id: Option<i64>,
+    pub issuer_name: Option<String>,
+    pub common_name: Option<String>,
+    pub name_value: Option<String>,
+    pub id: Option<i64>,
+    pub entry_timestamp: Option<String>,
+    pub not_before: Option<String>,
+    pub not_after: Option<String>,
+    pub serial_number: Option<String>,
+}
+
+/// Parses certificate transparency log entries to extract unique subdomains
+pub fn extract_subdomains_from_crtsh(entries: &[CrtShEntry], root_domain: &str) -> Vec<String> {
+    let mut subdomains = HashSet::new();
+    let root_lower = root_domain
+        .to_lowercase()
+        .trim_start_matches('.')
+        .to_string();
+
+    for entry in entries {
+        if let Some(ref common_name) = entry.common_name {
+            for line in common_name.lines() {
+                clean_and_insert_domain(line, &root_lower, &mut subdomains);
+            }
+        }
+        if let Some(ref name_value) = entry.name_value {
+            for line in name_value.lines() {
+                clean_and_insert_domain(line, &root_lower, &mut subdomains);
+            }
+        }
+    }
+
+    let mut result: Vec<String> = subdomains.into_iter().collect();
+    result.sort();
+    result
+}
+
+fn clean_and_insert_domain(raw: &str, root_domain: &str, set: &mut HashSet<String>) {
+    let trimmed = raw
+        .trim()
+        .to_lowercase()
+        .trim_start_matches("*.")
+        .trim_start_matches('.')
+        .to_string();
+
+    if trimmed.is_empty() {
+        return;
+    }
+
+    // Must end with root domain or equal root domain
+    if trimmed == root_domain || trimmed.ends_with(&format!(".{}", root_domain)) {
+        set.insert(trimmed);
+    }
+}
+
+/// Fetches Certificate Transparency logs for a domain from crt.sh
+pub async fn query_crtsh(client: &Client, domain: &str, timeout_secs: u64) -> Result<Vec<String>> {
+    let root = domain.trim_start_matches('.').to_lowercase();
+    let url = format!("https://crt.sh/?q=%25.{}&output=json", root);
+
+    let response = client
+        .get(&url)
+        .header("User-Agent", "cf-origin-hunter/0.1.0")
+        .timeout(Duration::from_secs(timeout_secs))
+        .send()
+        .await;
+
+    match response {
+        Ok(resp) => {
+            if !resp.status().is_success() {
+                return Ok(Vec::new());
+            }
+
+            let text = resp.text().await.unwrap_or_default();
+            if text.trim().is_empty() || text.starts_with('<') {
+                return Ok(Vec::new());
+            }
+
+            match serde_json::from_str::<Vec<CrtShEntry>>(&text) {
+                Ok(entries) => Ok(extract_subdomains_from_crtsh(&entries, &root)),
+                Err(_) => Ok(Vec::new()),
+            }
+        }
+        Err(e) => {
+            // crt.sh can be intermittently slow or rate-limited; gracefully return empty list
+            log_or_ignore(&format!("crt.sh query failed: {}", e));
+            Ok(Vec::new())
+        }
+    }
+}
+
+fn log_or_ignore(_msg: &str) {
+    // Debug logging if enabled
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_extract_subdomains_from_crtsh() {
+        let entries = vec![
+            CrtShEntry {
+                issuer_ca_id: Some(1),
+                issuer_name: Some("Let's Encrypt".into()),
+                common_name: Some("origin.example.com".into()),
+                name_value: Some(
+                    "origin.example.com\n*.dev.example.com\napi-origin.example.com".into(),
+                ),
+                id: Some(100),
+                entry_timestamp: None,
+                not_before: None,
+                not_after: None,
+                serial_number: None,
+            },
+            CrtShEntry {
+                issuer_ca_id: Some(2),
+                issuer_name: Some("DigiCert".into()),
+                common_name: Some("example.com".into()),
+                name_value: Some("example.com\notherdomain.com".into()),
+                id: Some(101),
+                entry_timestamp: None,
+                not_before: None,
+                not_after: None,
+                serial_number: None,
+            },
+        ];
+
+        let subs = extract_subdomains_from_crtsh(&entries, "example.com");
+        assert!(subs.contains(&"origin.example.com".to_string()));
+        assert!(subs.contains(&"dev.example.com".to_string()));
+        assert!(subs.contains(&"api-origin.example.com".to_string()));
+        assert!(subs.contains(&"example.com".to_string()));
+        assert!(!subs.contains(&"otherdomain.com".to_string()));
+    }
+}