65 lines
2.3 KiB
JavaScript
65 lines
2.3 KiB
JavaScript
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const PAYLOAD = require('./generateFirewallQuery.js');
|
|
const { axiosCloudflare } = require('../axios.js');
|
|
const logger = require('../../logger.js');
|
|
const { MAIN } = require('../../../config.js');
|
|
|
|
const ensureFile = filePath => {
|
|
if (fs.existsSync(filePath)) return;
|
|
fs.mkdirSync(path.dirname(filePath), { recursive: true });
|
|
fs.writeFileSync(filePath, '');
|
|
};
|
|
|
|
const fetchCloudflareEvents = async () => {
|
|
const rawZoneIds = MAIN.CLOUDFLARE_ZONE_IDS || MAIN.CLOUDFLARE_ZONE_ID;
|
|
const zoneIds = Array.isArray(rawZoneIds) ? rawZoneIds : [rawZoneIds];
|
|
const allEvents = [];
|
|
|
|
for (const zoneId of zoneIds) {
|
|
try {
|
|
const { data, status } = await axiosCloudflare.post('/graphql', PAYLOAD(zoneId));
|
|
|
|
const events = data?.data?.viewer?.zones?.[0]?.firewallEventsAdaptive;
|
|
if (!events) throw new Error(`Failed to retrieve data from Cloudflare (status ${status}): ${JSON.stringify(data?.errors)}`);
|
|
|
|
const l7ddosEvents = events.filter(e => e.source === 'l7ddos');
|
|
logger.success(`Zone ${zoneId}: ${events.length} events fetched (${l7ddosEvents.length} L7 DDoS)`);
|
|
allEvents.push(...l7ddosEvents);
|
|
} catch (err) {
|
|
logger.error(err.response?.data ? `${err.response.status} HTTP ERROR for zone ${zoneId}: ${JSON.stringify(err.response.data, null, 2)}` : `Unknown error for zone ${zoneId}: ${err.message}`);
|
|
}
|
|
}
|
|
|
|
return allEvents;
|
|
};
|
|
|
|
const saveToCSV = (events, filePath = 'report.csv') => {
|
|
const map = new Map();
|
|
for (const { clientIP, datetime } of events) {
|
|
if (!map.has(clientIP)) map.set(clientIP, `${clientIP},4,${new Date(datetime).toISOString()},Detected L7 DDoS via Cloudflare`);
|
|
}
|
|
|
|
ensureFile(filePath);
|
|
if (!fs.statSync(filePath).size) fs.appendFileSync(filePath, 'IP,Categories,ReportDate,Comment\n');
|
|
|
|
fs.appendFileSync(filePath, [...map.values()].join('\n') + '\n');
|
|
};
|
|
|
|
const saveToTXT = (events, filePath = 'report.txt') => {
|
|
const uniqueIPs = new Set(events.map(e => e.clientIP));
|
|
ensureFile(filePath);
|
|
fs.appendFileSync(filePath, [...uniqueIPs].join('\n') + '\n');
|
|
};
|
|
|
|
(async () => {
|
|
const events = await fetchCloudflareEvents();
|
|
if (events.length) {
|
|
saveToCSV(events);
|
|
saveToTXT(events);
|
|
logger.success(`Saved ${events.length} L7 DDoS events to CSV and TXT`);
|
|
} else {
|
|
logger.info('No L7 DDoS events found');
|
|
}
|
|
})();
|