<?php
+/**
+ * Functions for dealing with proxies
+ * @package MediaWiki
+ */
if ( !defined( 'MEDIAWIKI' ) ) {
die();
}
-/**
- * Functions for dealing with proxies
- */
-
+/** Work out the IP address based on various globals */
+function wfGetIP() {
+ global $wgSquidServers, $wgSquidServersNoPurge, $wgIP;
-/**
- * Work out the IP address based on various globals
- */
-function wfGetIP()
-{
- global $wgSquidServers, $wgSquidServersNoPurge;
+ # Return cached result
+ if ( !empty( $wgIP ) ) {
+ return $wgIP;
+ }
/* collect the originating ips */
# Client connecting to this webserver
if ( count( $trustedProxies ) ) {
# Append XFF on to $ipchain
if ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
- $xff = explode( ',', $_SERVER['HTTP_X_FORWARDED_FOR'] );
- for ( $i = 1; $i <= count( $xff ); $i++ ) {
- $ipchain[$i] = trim( $xff[count($xff) - $i );
- }
+ $xff = array_map( 'trim', explode( ',', $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
+ $xff = array_reverse( $xff );
+ $ipchain = array_merge( $ipchain, $xff );
}
- var_dump( $ipchain );
# Step through XFF list and find the last address in the list which is a trusted server
# Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private)
foreach ( $ipchain as $i => $curIP ) {
}
}
+ wfDebug( "IP: $ip\n" );
+ $wgIP = $ip;
return $ip;
}
-function wfIP2Unsigned( $ip )
-{
+/** */
+function wfIP2Unsigned( $ip ) {
$n = ip2long( $ip );
- if ( $n == -1 ) {
+ if ( $n == -1 || $n === false ) { # Return value on error depends on PHP version
$n = false;
} elseif ( $n < 0 ) {
$n += pow( 2, 32 );
* Determine if an IP address really is an IP address, and if it is public,
* i.e. not RFC 1918 or similar
*/
-function wfIsIPPublic( $ip )
-{
+function wfIsIPPublic( $ip ) {
$n = wfIP2Unsigned( $ip );
if ( !$n ) {
return false;
}
return true;
}
+
+/**
+ * Forks processes to scan the originating IP for an open proxy server
+ * MemCached can be used to skip IPs that have already been scanned
+ */
+function wfProxyCheck() {
+ global $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath;
+ global $wgUseMemCached, $wgMemc, $wgDBname, $wgProxyMemcExpiry;
+
+ if ( !$wgBlockOpenProxies ) {
+ return;
+ }
+
+ $ip = wfGetIP();
+ # Get MemCached key
+ $skip = false;
+ if ( $wgUseMemCached ) {
+ $mcKey = "$wgDBname:proxy:ip:$ip";
+ $mcValue = $wgMemc->get( $mcKey );
+ if ( $mcValue ) {
+ $skip = true;
+ }
+ }
+
+ # Fork the processes
+ if ( !$skip ) {
+ $title = Title::makeTitle( NS_SPECIAL, 'Blockme' );
+ $iphash = md5( $ip . $wgProxyKey );
+ $url = $title->getFullURL( 'ip='.$iphash );
+
+ foreach ( $wgProxyPorts as $port ) {
+ $params = implode( ' ', array(
+ escapeshellarg( $wgProxyScriptPath ),
+ escapeshellarg( $ip ),
+ escapeshellarg( $port ),
+ escapeshellarg( $url )
+ ));
+ exec( "php $params &>/dev/null &" );
+ }
+ # Set MemCached key
+ if ( $wgUseMemCached ) {
+ $wgMemc->set( $mcKey, 1, $wgProxyMemcExpiry );
+ }
+ }
+}
+
?>