includes/ProxyTools.php

   1 <?php
   2 /**
   3  * Functions for dealing with proxies
   4  * @package MediaWiki
   5  */
   6
   7 if ( !defined( 'MEDIAWIKI' ) ) {
   8         die();
   9 }
  10
  11 /** Work out the IP address based on various globals */
  12 function wfGetIP() {
  13         global $wgSquidServers, $wgSquidServersNoPurge, $wgIP;
  14
  15         # Return cached result
  16         if ( !empty( $wgIP ) ) {
  17                 return $wgIP;
  18         }
  19
  20         /* collect the originating ips */
  21         # Client connecting to this webserver
  22         if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
  23                 $ipchain = array( $_SERVER['REMOTE_ADDR'] );
  24         } else {
  25                 # Running on CLI?
  26                 $ipchain = array( '127.0.0.1' );
  27         }
  28         $ip = $ipchain[0];
  29
  30         # Get list of trusted proxies
  31         # Flipped for quicker access
  32         $trustedProxies = array_flip( array_merge( $wgSquidServers, $wgSquidServersNoPurge ) );
  33         if ( count( $trustedProxies ) ) {
  34                 # Append XFF on to $ipchain
  35                 if ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
  36                         $xff = array_map( 'trim', explode( ',', $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
  37                         $xff = array_reverse( $xff );
  38                         $ipchain = array_merge( $ipchain, $xff );
  39                 }
  40                 # Step through XFF list and find the last address in the list which is a trusted server
  41                 # Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private)
  42                 foreach ( $ipchain as $i => $curIP ) {
  43                         if ( array_key_exists( $curIP, $trustedProxies ) ) {
  44                                 if ( isset( $ipchain[$i + 1] ) && wfIsIPPublic( $ipchain[$i + 1] ) ) {
  45                                         $ip = $ipchain[$i + 1];
  46                                 }
  47                         } else {
  48                                 break;
  49                         }
  50                 }
  51         }
  52
  53         wfDebug( "IP: $ip\n" );
  54         $wgIP = $ip;
  55         return $ip;
  56 }
  57
  58 /** */
  59 function wfIP2Unsigned( $ip ) {
  60         $n = ip2long( $ip );
  61         if ( $n == -1 ) {
  62                 $n = false;
  63         } elseif ( $n < 0 ) {
  64                 $n += pow( 2, 32 );
  65         }
  66         return $n;
  67 }
  68
  69 /**
  70  * Determine if an IP address really is an IP address, and if it is public,
  71  * i.e. not RFC 1918 or similar
  72  */
  73 function wfIsIPPublic( $ip ) {
  74         $n = wfIP2Unsigned( $ip );
  75         if ( !$n ) {
  76                 return false;
  77         }
  78
  79         static $privateRanges = false;
  80         if ( !$privateRanges ) {
  81                 $privateRanges = array(
  82                         array( '10.0.0.0',    '10.255.255.255' ),   # RFC 1918 (private)
  83                         array( '172.16.0.0',  '172.31.255.255' ),   #     "
  84                         array( '192.168.0.0', '192.168.255.255' ),  #     "
  85                         array( '0.0.0.0',     '0.255.255.255' ),    # this network
  86                         array( '127.0.0.0',   '127.255.255.255' ),  # loopback
  87                 );
  88         }
  89
  90         foreach ( $privateRanges as $r ) {
  91                 $start = wfIP2Unsigned( $r[0] );
  92                 $end = wfIP2Unsigned( $r[1] );
  93                 if ( $n >= $start && $n <= $end ) {
  94                         return false;
  95                 }
  96         }
  97         return true;
  98 }
  99
 100 /**
 101  * Forks processes to scan the originating IP for an open proxy server
 102  * MemCached can be used to skip IPs that have already been scanned
 103  */
 104 function wfProxyCheck() {
 105         global $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath;
 106         global $wgUseMemCached, $wgMemc, $wgDBname, $wgProxyMemcExpiry;
 107
 108         if ( !$wgBlockOpenProxies ) {
 109                 return;
 110         }
 111
 112         $ip = wfGetIP();
 113
 114         # Get MemCached key
 115         $skip = false;
 116         if ( $wgUseMemCached ) {
 117                 $mcKey = "$wgDBname:proxy:ip:$ip";
 118                 $mcValue = $wgMemc->get( $mcKey );
 119                 if ( $mcValue ) {
 120                         $skip = true;
 121                 }
 122         }
 123
 124         # Fork the processes
 125         if ( !$skip ) {
 126                 $title = Title::makeTitle( NS_SPECIAL, 'Blockme' );
 127                 $iphash = md5( $ip . $wgProxyKey );
 128                 $url = $title->getFullURL( 'ip='.$iphash );
 129
 130                 foreach ( $wgProxyPorts as $port ) {
 131                         $params = implode( ' ', array(
 132                                                 escapeshellarg( $wgProxyScriptPath ),
 133                                                 escapeshellarg( $ip ),
 134                                                 escapeshellarg( $port ),
 135                                                 escapeshellarg( $url )
 136                                                 ));
 137                         exec( "php $params &>/dev/null &" );
 138                 }
 139                 # Set MemCached key
 140                 if ( $wgUseMemCached ) {
 141                         $wgMemc->set( $mcKey, 1, $wgProxyMemcExpiry );
 142                 }
 143         }
 144 }
 145
 146 ?>