shohei 2.4.1

Infrastructure diagnostics library: DNS, DNSSEC, TLS certificate inspection, email security, DNS propagation, and MCP-integrated AI agent support
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145

//! Shodan InternetDB IP reputation — query open ports, CPEs, tags, and CVE associations.

use serde::{Deserialize, Serialize};
use crate::error::Result;

/// Request to query Shodan InternetDB.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ShodanInternetDbRequest {
    pub ip: String,
    #[serde(default = "default_timeout")]
    pub timeout_secs: u64,
}

fn default_timeout() -> u64 { 10 }

/// Result from Shodan InternetDB.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ShodanInternetDbResult {
    pub ip: String,
    pub open_ports: Vec<u16>,
    pub hostnames: Vec<String>,
    pub cpes: Vec<String>,
    pub tags: Vec<String>,
    pub vulns: Vec<String>,
    pub error: Option<String>,
}

#[derive(Debug, Deserialize)]
struct ShodanApiResponse {
    pub ip: Option<String>,
    pub ports: Option<Vec<u16>>,
    pub hostnames: Option<Vec<String>>,
    pub cpes: Option<Vec<String>>,
    pub tags: Option<Vec<String>>,
    pub vulns: Option<Vec<String>>,
    pub detail: Option<String>,
}

/// Query Shodan InternetDB for IP information.
pub async fn check_shodan_ip(req: &ShodanInternetDbRequest) -> Result<ShodanInternetDbResult> {
    let client = reqwest::Client::builder()
        .timeout(std::time::Duration::from_secs(req.timeout_secs))
        .build()
        .map_err(|e| crate::error::ShoheError::Transport(format!("Client build failed: {}", e)))?;

    let url = format!("https://internetdb.shodan.io/{}", req.ip);

    let response = match client.get(&url).send().await {
        Ok(r) => r,
        Err(e) => {
            return Ok(ShodanInternetDbResult {
                ip: req.ip.clone(),
                open_ports: vec![],
                hostnames: vec![],
                cpes: vec![],
                tags: vec![],
                vulns: vec![],
                error: Some(e.to_string()),
            });
        }
    };

    let status = response.status();

    if status.is_client_error() || status.is_server_error() {
        return Ok(ShodanInternetDbResult {
            ip: req.ip.clone(),
            open_ports: vec![],
            hostnames: vec![],
            cpes: vec![],
            tags: vec![],
            vulns: vec![],
            error: Some(format!("Shodan HTTP {}", status)),
        });
    }

    // Check content length to prevent OOM on malicious responses
    const MAX_RESPONSE_SIZE: u64 = 1024 * 100;  // 100 KB limit
    if let Some(len) = response.content_length() {
        if len > MAX_RESPONSE_SIZE {
            return Ok(ShodanInternetDbResult {
                ip: req.ip.clone(),
                open_ports: vec![],
                hostnames: vec![],
                cpes: vec![],
                tags: vec![],
                vulns: vec![],
                error: Some("Response exceeds size limit".to_string()),
            });
        }
    }

    let body = match response.text().await {
        Ok(b) => b,
        Err(e) => {
            return Ok(ShodanInternetDbResult {
                ip: req.ip.clone(),
                open_ports: vec![],
                hostnames: vec![],
                cpes: vec![],
                tags: vec![],
                vulns: vec![],
                error: Some(e.to_string()),
            });
        }
    };

    let api_response: ShodanApiResponse = match serde_json::from_str(&body) {
        Ok(r) => r,
        Err(e) => {
            return Ok(ShodanInternetDbResult {
                ip: req.ip.clone(),
                open_ports: vec![],
                hostnames: vec![],
                cpes: vec![],
                tags: vec![],
                vulns: vec![],
                error: Some(e.to_string()),
            });
        }
    };

    // If "detail" field exists, IP not in database
    if api_response.detail.is_some() {
        return Ok(ShodanInternetDbResult {
            ip: req.ip.clone(),
            open_ports: vec![],
            hostnames: vec![],
            cpes: vec![],
            tags: vec![],
            vulns: vec![],
            error: Some("IP not found in Shodan database".to_string()),
        });
    }

    Ok(ShodanInternetDbResult {
        ip: req.ip.clone(),
        open_ports: api_response.ports.unwrap_or_default(),
        hostnames: api_response.hostnames.unwrap_or_default(),
        cpes: api_response.cpes.unwrap_or_default(),
        tags: api_response.tags.unwrap_or_default(),
        vulns: api_response.vulns.unwrap_or_default(),
        error: None,
    })
}