includes/ProxyTools.php

   1 <?php
   2 /**
   3  * Functions for dealing with proxies
   4  */
   5
   6 function wfGetForwardedFor() {
   7         if( function_exists( 'apache_request_headers' ) ) {
   8                 // More reliable than $_SERVER due to case and -/_ folding
   9                 $set = apache_request_headers();
  10                 $index = 'X-Forwarded-For';
  11                 $index2 = 'Client-ip';
  12         } else {
  13                 // Subject to spoofing with headers like X_Forwarded_For
  14                 $set = $_SERVER;
  15                 $index = 'HTTP_X_FORWARDED_FOR';
  16                 $index2 = 'CLIENT-IP';
  17         }
  18         #Try a couple of headers
  19         if( isset( $set[$index] ) ) {
  20                 return $set[$index];
  21         } else if( isset( $set[$index2] ) ) {
  22                 return $set[$index2];
  23         } else {
  24                 return null;
  25         }
  26 }
  27
  28 /**
  29  * Locates the client IP within a given XFF string
  30  * @param string $xff
  31  * @return string
  32  */
  33 function wfGetClientIPfromXFF( $xff ) {
  34         if ( !$xff ) return null;
  35         $xff = substr( $xff, 0, 511 );
  36         // Just look for the first IP match
  37         // We might have a mix of IPv4/IPv6
  38         if ( preg_match('#\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|:(:[0-9A-Fa-f]{1,4}){1,7}|[0-9A-Fa-f]{1,4}(:{1,2}[0-9A-Fa-f]{1,4}|::$){1,7}#', $xff, $ip) ) {
  39                 // Check if the numbers are valid
  40                 if ( IP::isIPAddress($ip) )
  41                    return $ip;
  42         }
  43
  44         return null;
  45 }
  46
  47 function wfGetAgent() {
  48         if( function_exists( 'apache_request_headers' ) ) {
  49                 // More reliable than $_SERVER due to case and -/_ folding
  50                 $set = apache_request_headers();
  51                 $index = 'User-Agent';
  52         } else {
  53                 // Subject to spoofing with headers like X_Forwarded_For
  54                 $set = $_SERVER;
  55                 $index = 'HTTP_USER_AGENT';
  56         }
  57         if( isset( $set[$index] ) ) {
  58                 return $set[$index];
  59         } else {
  60                 return '';
  61         }
  62 }
  63
  64 /** Work out the IP address based on various globals */
  65 function wfGetIP() {
  66         global $wgIP;
  67
  68         # Return cached result
  69         if ( !empty( $wgIP ) ) {
  70                 return $wgIP;
  71         }
  72
  73         /* collect the originating ips */
  74         # Client connecting to this webserver
  75         if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
  76                 $ipchain = array( IP::canonicalize( $_SERVER['REMOTE_ADDR'] ) );
  77         } else {
  78                 # Running on CLI?
  79                 $ipchain = array( '127.0.0.1' );
  80         }
  81         $ip = $ipchain[0];
  82
  83         # Append XFF on to $ipchain
  84         $forwardedFor = wfGetForwardedFor();
  85         if ( isset( $forwardedFor ) ) {
  86                 $xff = array_map( 'trim', explode( ',', $forwardedFor ) );
  87                 $xff = array_reverse( $xff );
  88                 $ipchain = array_merge( $ipchain, $xff );
  89         }
  90
  91         # Step through XFF list and find the last address in the list which is a trusted server
  92         # Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private)
  93         foreach ( $ipchain as $i => $curIP ) {
  94                 $curIP = IP::canonicalize( $curIP );
  95                 if ( wfIsTrustedProxy( $curIP ) ) {
  96                         if ( isset( $ipchain[$i + 1] ) && IP::isPublic( $ipchain[$i + 1] ) ) {
  97                                 $ip = $ipchain[$i + 1];
  98                         }
  99                 } else {
 100                         break;
 101                 }
 102         }
 103
 104         wfDebug( "IP: $ip\n" );
 105         $wgIP = $ip;
 106         return $ip;
 107 }
 108
 109 function wfIsTrustedProxy( $ip ) {
 110         global $wgSquidServers, $wgSquidServersNoPurge;
 111
 112         if ( in_array( $ip, $wgSquidServers ) ||
 113                 in_array( $ip, $wgSquidServersNoPurge ) ||
 114                 wfIsAOLProxy( $ip )
 115         ) {
 116                 $trusted = true;
 117         } else {
 118                 $trusted = false;
 119         }
 120         wfRunHooks( 'IsTrustedProxy', array( &$ip, &$trusted ) );
 121         return $trusted;
 122 }
 123
 124 /**
 125  * Forks processes to scan the originating IP for an open proxy server
 126  * MemCached can be used to skip IPs that have already been scanned
 127  */
 128 function wfProxyCheck() {
 129         global $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath;
 130         global $wgUseMemCached, $wgMemc, $wgProxyMemcExpiry;
 131         global $wgProxyKey;
 132
 133         if ( !$wgBlockOpenProxies ) {
 134                 return;
 135         }
 136
 137         $ip = wfGetIP();
 138
 139         # Get MemCached key
 140         $skip = false;
 141         if ( $wgUseMemCached ) {
 142                 $mcKey = wfMemcKey( 'proxy', 'ip', $ip );
 143                 $mcValue = $wgMemc->get( $mcKey );
 144                 if ( $mcValue ) {
 145                         $skip = true;
 146                 }
 147         }
 148
 149         # Fork the processes
 150         if ( !$skip ) {
 151                 $title = SpecialPage::getTitleFor( 'Blockme' );
 152                 $iphash = md5( $ip . $wgProxyKey );
 153                 $url = $title->getFullURL( 'ip='.$iphash );
 154
 155                 foreach ( $wgProxyPorts as $port ) {
 156                         $params = implode( ' ', array(
 157                                                 escapeshellarg( $wgProxyScriptPath ),
 158                                                 escapeshellarg( $ip ),
 159                                                 escapeshellarg( $port ),
 160                                                 escapeshellarg( $url )
 161                                                 ));
 162                         exec( "php $params &>/dev/null &" );
 163                 }
 164                 # Set MemCached key
 165                 if ( $wgUseMemCached ) {
 166                         $wgMemc->set( $mcKey, 1, $wgProxyMemcExpiry );
 167                 }
 168         }
 169 }
 170
 171 /**
 172  * Convert a network specification in CIDR notation to an integer network and a number of bits
 173  */
 174 function wfParseCIDR( $range ) {
 175         return IP::parseCIDR( $range );
 176 }
 177
 178 /**
 179  * Check if an IP address is in the local proxy list
 180  */
 181 function wfIsLocallyBlockedProxy( $ip ) {
 182         global $wgProxyList;
 183         $fname = 'wfIsLocallyBlockedProxy';
 184
 185         if ( !$wgProxyList ) {
 186                 return false;
 187         }
 188         wfProfileIn( $fname );
 189
 190         if ( !is_array( $wgProxyList ) ) {
 191                 # Load from the specified file
 192                 $wgProxyList = array_map( 'trim', file( $wgProxyList ) );
 193         }
 194
 195         if ( !is_array( $wgProxyList ) ) {
 196                 $ret = false;
 197         } elseif ( array_search( $ip, $wgProxyList ) !== false ) {
 198                 $ret = true;
 199         } elseif ( array_key_exists( $ip, $wgProxyList ) ) {
 200                 # Old-style flipped proxy list
 201                 $ret = true;
 202         } else {
 203                 $ret = false;
 204         }
 205         wfProfileOut( $fname );
 206         return $ret;
 207 }
 208
 209 /**
 210  * TODO: move this list to the database in a global IP info table incorporating
 211  * trusted ISP proxies, blocked IP addresses and open proxies.
 212  */
 213 function wfIsAOLProxy( $ip ) {
 214         $ranges = array(
 215                 '64.12.96.0/19',
 216                 '149.174.160.0/20',
 217                 '152.163.240.0/21',
 218                 '152.163.248.0/22',
 219                 '152.163.252.0/23',
 220                 '152.163.96.0/22',
 221                 '152.163.100.0/23',
 222                 '195.93.32.0/22',
 223                 '195.93.48.0/22',
 224                 '195.93.64.0/19',
 225                 '195.93.96.0/19',
 226                 '195.93.16.0/20',
 227                 '198.81.0.0/22',
 228                 '198.81.16.0/20',
 229                 '198.81.8.0/23',
 230                 '202.67.64.128/25',
 231                 '205.188.192.0/20',
 232                 '205.188.208.0/23',
 233                 '205.188.112.0/20',
 234                 '205.188.146.144/30',
 235                 '207.200.112.0/21',
 236         );
 237
 238         static $parsedRanges;
 239         if ( is_null( $parsedRanges ) ) {
 240                 $parsedRanges = array();
 241                 foreach ( $ranges as $range ) {
 242                         $parsedRanges[] =  IP::parseRange( $range );
 243                 }
 244         }
 245
 246         $hex = IP::toHex( $ip );
 247         foreach ( $parsedRanges as $range ) {
 248                 if ( $hex >= $range[0] && $hex <= $range[1] ) {
 249                         return true;
 250                 }
 251         }
 252         return false;
 253 }
 254
 255
 256
 257 ?>