129 lines
3.8 KiB
Go
129 lines
3.8 KiB
Go
package clouddetect
|
||
|
||
import (
|
||
"context"
|
||
"fmt"
|
||
"net"
|
||
"net/http"
|
||
"strings"
|
||
"time"
|
||
)
|
||
|
||
// Result represents the outcome of a cloud proxy detection.
|
||
type Result struct {
|
||
IsProxy bool `json:"is_proxy"`
|
||
Provider string `json:"provider,omitempty"`
|
||
Details string `json:"details,omitempty"`
|
||
}
|
||
|
||
// knownCIDRs maps providers to a slice of CIDR strings that represent their IP ranges.
|
||
// In a production implementation these would be loaded from data files; for this prototype
|
||
// a small representative subset is hard‑coded.
|
||
var knownCIDRs = map[string][]string{
|
||
"Cloudflare": {
|
||
"103.21.244.0/22",
|
||
"104.16.0.0/12",
|
||
"2606:4700::/32",
|
||
},
|
||
"AWS CloudFront": {
|
||
"13.32.0.0/15",
|
||
"13.54.0.0/15",
|
||
"2600:9000::/28",
|
||
},
|
||
"Azure Front Door": {
|
||
"40.112.0.0/13",
|
||
"52.239.0.0/16",
|
||
"2603:1030::/32",
|
||
},
|
||
}
|
||
|
||
// Detect attempts to determine whether the target is behind a known cloud proxy.
|
||
// It performs DNS resolution, checks the resolved IPs against known CIDR ranges,
|
||
// and inspects HTTP response headers for provider signatures.
|
||
func Detect(target string) (*Result, error) {
|
||
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
|
||
defer cancel()
|
||
|
||
// Resolve IP addresses for the target.
|
||
// Strip any port component if present (e.g., "example.com:443").
|
||
host := target
|
||
if strings.Contains(target, ":") {
|
||
if h, _, err := net.SplitHostPort(target); err == nil {
|
||
host = h
|
||
}
|
||
}
|
||
var ips []net.IP
|
||
ips, err := net.DefaultResolver.LookupIP(ctx, "ip", host)
|
||
if err != nil {
|
||
// DNS lookup failed; continue without IPs.
|
||
ips = nil
|
||
}
|
||
// Duplicate error handling removed – the previous block already handles DNS failures.
|
||
|
||
// Prepare CIDR parsers.
|
||
parsedCIDRs := make(map[string][]*net.IPNet)
|
||
for prov, cidrs := range knownCIDRs {
|
||
for _, cidr := range cidrs {
|
||
_, ipnet, err := net.ParseCIDR(cidr)
|
||
if err != nil {
|
||
continue // skip malformed entries
|
||
}
|
||
parsedCIDRs[prov] = append(parsedCIDRs[prov], ipnet)
|
||
}
|
||
}
|
||
// Load additional CIDR ranges from external file (cloud_ranges.txt).
|
||
if extCIDRs, err := LoadCIDRs("internal/clouddetect/cloud_ranges.txt"); err == nil {
|
||
for prov, nets := range extCIDRs {
|
||
parsedCIDRs[prov] = append(parsedCIDRs[prov], nets...)
|
||
}
|
||
}
|
||
|
||
// Check each resolved IP against the CIDR tables.
|
||
for _, ip := range ips {
|
||
for prov, nets := range parsedCIDRs {
|
||
for _, net := range nets {
|
||
if net.Contains(ip) {
|
||
return &Result{
|
||
IsProxy: true,
|
||
Provider: prov,
|
||
Details: fmt.Sprintf("IP %s matches %s range", ip, prov),
|
||
}, nil
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
// If no CIDR match, attempt an HTTP HEAD request to look for provider headers.
|
||
// Use the original target (host) for the request to avoid port issues.
|
||
url := fmt.Sprintf("http://%s", host)
|
||
req, err := http.NewRequestWithContext(ctx, http.MethodHead, url, nil)
|
||
if err == nil {
|
||
client := &http.Client{
|
||
Timeout: 5 * time.Second,
|
||
}
|
||
resp, err := client.Do(req)
|
||
if err == nil {
|
||
defer resp.Body.Close()
|
||
serverHeader := resp.Header.Get("Server")
|
||
viaHeader := resp.Header.Get("Via")
|
||
|
||
// Simple heuristics based on common header values.
|
||
if strings.Contains(strings.ToLower(serverHeader), "cloudflare") ||
|
||
strings.Contains(strings.ToLower(viaHeader), "cloudflare") {
|
||
return &Result{IsProxy: true, Provider: "Cloudflare", Details: "Detected via HTTP headers"}, nil
|
||
}
|
||
if strings.Contains(strings.ToLower(serverHeader), "amazon") ||
|
||
strings.Contains(strings.ToLower(viaHeader), "aws") {
|
||
return &Result{IsProxy: true, Provider: "AWS CloudFront", Details: "Detected via HTTP headers"}, nil
|
||
}
|
||
if strings.Contains(strings.ToLower(serverHeader), "azure") ||
|
||
strings.Contains(strings.ToLower(viaHeader), "azure") {
|
||
return &Result{IsProxy: true, Provider: "Azure Front Door", Details: "Detected via HTTP headers"}, nil
|
||
}
|
||
}
|
||
}
|
||
|
||
// No proxy indicators found.
|
||
return &Result{IsProxy: false}, nil
|
||
}
|