includes/ProxyTools.php

   1 <?php
   2 /**
   3  * Functions for dealing with proxies
   4  * @package MediaWiki
   5  */
   6
   7 class ProxyTools {
   8         function getForwardedFor() {
   9                 if( function_exists( 'apache_request_headers' ) ) {
  10                         // More reliable than $_SERVER due to case and -/_ folding
  11                         $set = apache_request_headers();
  12                         $index = 'X-Forwarded-For';
  13                 } else {
  14                         // Subject to spoofing with headers like X_Forwarded_For
  15                         $set = $_SERVER;
  16                         $index = 'HTTP_X_FORWARDED_FOR';
  17                 }
  18                 if( isset( $set[$index] ) ) {
  19                         return $set[$index];
  20                 } else {
  21                         return null;
  22                 }
  23         }
  24
  25         /** Work out the IP address based on various globals */
  26         function getIP() {
  27                 global $wgSquidServers, $wgSquidServersNoPurge, $wgIP;
  28
  29                 # Return cached result
  30                 if ( !empty( $wgIP ) ) {
  31                         return $wgIP;
  32                 }
  33
  34                 /* collect the originating ips */
  35                 # Client connecting to this webserver
  36                 if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
  37                         $ipchain = array( $_SERVER['REMOTE_ADDR'] );
  38                 } else {
  39                         # Running on CLI?
  40                         $ipchain = array( '127.0.0.1' );
  41                 }
  42                 $ip = $ipchain[0];
  43
  44                 # Get list of trusted proxies
  45                 # Flipped for quicker access
  46                 $trustedProxies = array_flip( array_merge( $wgSquidServers, $wgSquidServersNoPurge ) );
  47                 if ( count( $trustedProxies ) ) {
  48                         # Append XFF on to $ipchain
  49                         $forwardedFor = ProxyTools::getForwardedFor();
  50                         if ( isset( $forwardedFor ) ) {
  51                                 $xff = array_map( 'trim', explode( ',', $forwardedFor ) );
  52                                 $xff = array_reverse( $xff );
  53                                 $ipchain = array_merge( $ipchain, $xff );
  54                         }
  55                         # Step through XFF list and find the last address in the list which is a trusted server
  56                         # Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private)
  57                         foreach ( $ipchain as $i => $curIP ) {
  58                                 if ( array_key_exists( $curIP, $trustedProxies ) ) {
  59                                         if ( isset( $ipchain[$i + 1] ) && ProxyTools::isIPPublic( $ipchain[$i + 1] ) ) {
  60                                                 $ip = $ipchain[$i + 1];
  61                                         }
  62                                 } else {
  63                                         break;
  64                                 }
  65                         }
  66                 }
  67
  68                 wfDebug( "IP: $ip\n" );
  69                 $wgIP = $ip;
  70                 return $ip;
  71         }
  72
  73         /**
  74          * Given an IP address in dotted-quad notation, returns an unsigned integer.
  75          * Like ip2long() except that it actually works and has a consistent error return value.
  76          */
  77         function IP2Unsigned( $ip ) {
  78                 $n = ip2long( $ip );
  79                 if ( $n == -1 || $n === false ) { # Return value on error depends on PHP version
  80                         $n = false;
  81                 } elseif ( $n < 0 ) {
  82                         $n += pow( 2, 32 );
  83                 }
  84                 return $n;
  85         }
  86
  87         /**
  88          * Return a zero-padded hexadecimal representation of an IP address
  89          */
  90         function IP2Hex( $ip ) {
  91                 $n = ProxyTools::IP2Unsigned( $ip );
  92                 if ( $n !== false ) {
  93                         $n = sprintf( '%08X', $n );
  94                 }
  95                 return $n;
  96         }
  97
  98         /**
  99          * Determine if an IP address really is an IP address, and if it is public,
 100          * i.e. not RFC 1918 or similar
 101          */
 102         function isIPPublic( $ip ) {
 103                 $n = ProxyTools::IP2Unsigned( $ip );
 104                 if ( !$n ) {
 105                         return false;
 106                 }
 107
 108                 // ip2long accepts incomplete addresses, as well as some addresses
 109                 // followed by garbage characters. Check that it's really valid.
 110                 if( $ip != long2ip( $n ) ) {
 111                         return false;
 112                 }
 113
 114                 static $privateRanges = false;
 115                 if ( !$privateRanges ) {
 116                         $privateRanges = array(
 117                                 array( '10.0.0.0',    '10.255.255.255' ),   # RFC 1918 (private)
 118                                 array( '172.16.0.0',  '172.31.255.255' ),   #     "
 119                                 array( '192.168.0.0', '192.168.255.255' ),  #     "
 120                                 array( '0.0.0.0',     '0.255.255.255' ),    # this network
 121                                 array( '127.0.0.0',   '127.255.255.255' ),  # loopback
 122                         );
 123                 }
 124
 125                 foreach ( $privateRanges as $r ) {
 126                         $start = ProxyTools::IP2Unsigned( $r[0] );
 127                         $end = ProxyTools::IP2Unsigned( $r[1] );
 128                         if ( $n >= $start && $n <= $end ) {
 129                                 return false;
 130                         }
 131                 }
 132                 return true;
 133         }
 134
 135         /**
 136          * Forks processes to scan the originating IP for an open proxy server
 137          * MemCached can be used to skip IPs that have already been scanned
 138          */
 139         function proxyCheck() {
 140                 global $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath;
 141                 global $wgUseMemCached, $wgMemc, $wgDBname, $wgProxyMemcExpiry;
 142                 global $wgProxyKey;
 143
 144                 if ( !$wgBlockOpenProxies ) {
 145                         return;
 146                 }
 147
 148                 $ip = ProxyTools::getIP();
 149
 150                 # Get MemCached key
 151                 $skip = false;
 152                 if ( $wgUseMemCached ) {
 153                         $mcKey = "$wgDBname:proxy:ip:$ip";
 154                         $mcValue = $wgMemc->get( $mcKey );
 155                         if ( $mcValue ) {
 156                                 $skip = true;
 157                         }
 158                 }
 159
 160                 # Fork the processes
 161                 if ( !$skip ) {
 162                         $title = Title::makeTitle( NS_SPECIAL, 'Blockme' );
 163                         $iphash = md5( $ip . $wgProxyKey );
 164                         $url = $title->getFullURL( 'ip='.$iphash );
 165
 166                         foreach ( $wgProxyPorts as $port ) {
 167                                 $params = implode( ' ', array(
 168                                                         escapeshellarg( $wgProxyScriptPath ),
 169                                                         escapeshellarg( $ip ),
 170                                                         escapeshellarg( $port ),
 171                                                         escapeshellarg( $url )
 172                                                         ));
 173                                 exec( "php $params &>/dev/null &" );
 174                         }
 175                         # Set MemCached key
 176                         if ( $wgUseMemCached ) {
 177                                 $wgMemc->set( $mcKey, 1, $wgProxyMemcExpiry );
 178                         }
 179                 }
 180         }
 181
 182         /**
 183          * Convert a network specification in CIDR notation to an integer network and a number of bits
 184          */
 185         function parseCIDR( $range ) {
 186                 $parts = explode( '/', $range, 2 );
 187                 if ( count( $parts ) != 2 ) {
 188                         return array( false, false );
 189                 }
 190                 $network = ProxyTools::IP2Unsigned( $parts[0] );
 191                 if ( $network !== false && is_numeric( $parts[1] ) && $parts[1] >= 0 && $parts[1] <= 32 ) {
 192                         $bits = $parts[1];
 193                 } else {
 194                         $network = false;
 195                         $bits = false;
 196                 }
 197                 return array( $network, $bits );
 198         }
 199
 200         /**
 201          * Check if an IP address is in the local proxy list
 202          */
 203         function isLocallyBlockedProxy( $ip ) {
 204                 global $wgProxyList;
 205                 $fname = 'ProxyTools::isLocallyBlockedProxy';
 206
 207                 if ( !$wgProxyList ) {
 208                         return false;
 209                 }
 210                 wfProfileIn( $fname );
 211
 212                 if ( !is_array( $wgProxyList ) ) {
 213                         # Load from the specified file
 214                         $wgProxyList = array_map( 'trim', file( $wgProxyList ) );
 215                 }
 216
 217                 if ( !is_array( $wgProxyList ) ) {
 218                         $ret = false;
 219                 } elseif ( array_search( $ip, $wgProxyList ) !== false ) {
 220                         $ret = true;
 221                 } elseif ( array_key_exists( $ip, $wgProxyList ) ) {
 222                         # Old-style flipped proxy list
 223                         $ret = true;
 224                 } else {
 225                         $ret = false;
 226                 }
 227                 wfProfileOut( $fname );
 228                 return $ret;
 229         }
 230 }
 231 ?>