honeyweb-core 2.0.4 → 2.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "honeyweb-core",
-  "version": "2.0.4",
+  "version": "2.0.5",
   "description": "Production-ready honeypot middleware with behavioral analysis, bot fingerprinting, and AI threat intelligence",
   "main": "index.js",
   "scripts": {

package/utils/dns-verify.js

@@ -2,10 +2,102 @@
 
 const dns = require('dns').promises;
 const LRUCache = require('./cache');
+const https = require('https');
+
+// Known bot IP ranges (fallback when DNS fails on Windows)
+const BOT_IP_RANGES = {
+    'googlebot.com': null,  // Will be fetched dynamically
+    'google.com': null,
+    'search.msn.com': null,
+    'slack.com': null,
+    'facebook.com': null,
+    'twitter.com': null,
+    'linkedin.com': null,
+    'apple.com': null,
+    'duckduckgo.com': null
+};
 
 class DNSVerifier {
     constructor(cacheTTL = 86400000) {
         this.cache = new LRUCache(500, cacheTTL);
+        this.ipRangesCache = null;
+        this.ipRangesCacheTime = 0;
+        this.ipRangesCacheTTL = 86400000; // 24 hours
+    }
+
+    // Fetch Googlebot IP ranges from Google's official API
+    async fetchGooglebotRanges() {
+        const now = Date.now();
+        if (this.ipRangesCache && (now - this.ipRangesCacheTime) < this.ipRangesCacheTTL) {
+            return this.ipRangesCache;
+        }
+
+        return new Promise((resolve, reject) => {
+            https.get('https://developers.google.com/search/apis/ipranges/googlebot.json', (res) => {
+                let data = '';
+                res.on('data', chunk => data += chunk);
+                res.on('end', () => {
+                    try {
+                        const json = JSON.parse(data);
+                        const ranges = json.prefixes
+                            .filter(p => p.ipv4Prefix)
+                            .map(p => p.ipv4Prefix);
+                        this.ipRangesCache = ranges;
+                        this.ipRangesCacheTime = now;
+                        resolve(ranges);
+                    } catch (err) {
+                        reject(err);
+                    }
+                });
+            }).on('error', reject);
+        });
+    }
+
+    // Check if IP is in CIDR range
+    ipInRange(ip, cidr) {
+        const [range, bits] = cidr.split('/');
+        const mask = ~(2 ** (32 - parseInt(bits)) - 1);
+
+        const ipNum = ip.split('.').reduce((acc, octet) => (acc << 8) + parseInt(octet), 0) >>> 0;
+        const rangeNum = range.split('.').reduce((acc, octet) => (acc << 8) + parseInt(octet), 0) >>> 0;
+
+        return (ipNum & mask) === (rangeNum & mask);
+    }
+
+    // Fallback verification using IP ranges
+    async verifyByIpRange(ip, expectedDomain) {
+        // Only support Googlebot for now
+        if (!expectedDomain.includes('google')) {
+            return { verified: false, hostname: null, error: 'IP range verification only available for Google' };
+        }
+
+        try {
+            const ranges = await this.fetchGooglebotRanges();
+            const inRange = ranges.some(cidr => this.ipInRange(ip, cidr));
+
+            if (inRange) {
+                return {
+                    verified: true,
+                    hostname: 'googlebot.com (verified by IP range)',
+                    error: null,
+                    method: 'ip-range'
+                };
+            } else {
+                return {
+                    verified: false,
+                    hostname: null,
+                    error: 'IP not in Googlebot ranges',
+                    method: 'ip-range'
+                };
+            }
+        } catch (err) {
+            return {
+                verified: false,
+                hostname: null,
+                error: `IP range check failed: ${err.message}`,
+                method: 'ip-range'
+            };
+        }
     }
 
     async verify(ip, expectedDomain) {
@@ -13,10 +105,17 @@ class DNSVerifier {
         if (this.cache.has(cacheKey)) return this.cache.get(cacheKey);
 
         try {
-            // Reverse DNS: IP -> hostname
+            // Try DNS verification first
             const hostnames = await dns.reverse(ip);
 
             if (!hostnames || hostnames.length === 0) {
+                // DNS failed - try IP range fallback for Google
+                if (expectedDomain.includes('google')) {
+                    const rangeResult = await this.verifyByIpRange(ip, expectedDomain);
+                    this.cache.set(cacheKey, rangeResult);
+                    return rangeResult;
+                }
+
                 const result = { verified: false, hostname: null, error: 'No reverse DNS record found' };
                 this.cache.set(cacheKey, result);
                 return result;
@@ -39,11 +138,18 @@ class DNSVerifier {
                 return result;
             }
 
-            const result = { verified: true, hostname, error: null };
+            const result = { verified: true, hostname, error: null, method: 'dns' };
             this.cache.set(cacheKey, result);
             return result;
 
         } catch (err) {
+            // DNS lookup failed - try IP range fallback for Google
+            if (expectedDomain.includes('google')) {
+                const rangeResult = await this.verifyByIpRange(ip, expectedDomain);
+                this.cache.set(cacheKey, rangeResult, 300000);
+                return rangeResult;
+            }
+
             const result = { verified: false, hostname: null, error: err.message };
             this.cache.set(cacheKey, result, 300000);
             return result;
@@ -52,6 +158,7 @@ class DNSVerifier {
 
     clearCache() {
         this.cache.clear();
+        this.ipRangesCache = null;
     }
 }