includes/ProxyLookup.php

   1 <?php
   2
   3 /**
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License as published by
   6  * the Free Software Foundation; either version 2 of the License, or
   7  * (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License along
  15  * with this program; if not, write to the Free Software Foundation, Inc.,
  16  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  17  * http://www.gnu.org/copyleft/gpl.html
  18  *
  19  * @file
  20  */
  21
  22 use Wikimedia\IPSet;
  23
  24 /**
  25  * @since 1.28
  26  */
  27 class ProxyLookup {
  28
  29         /**
  30          * @var string[]
  31          */
  32         private $proxyServers;
  33
  34         /**
  35          * @var string[]
  36          */
  37         private $proxyServersComplex;
  38
  39         /**
  40          * @var IPSet|null
  41          */
  42         private $proxyIPSet;
  43
  44         /**
  45          * @param string[] $proxyServers Simple list of IPs
  46          * @param string[] $proxyServersComplex Complex list of IPs/ranges
  47          */
  48         public function __construct( $proxyServers, $proxyServersComplex ) {
  49                 $this->proxyServers = $proxyServers;
  50                 $this->proxyServersComplex = $proxyServersComplex;
  51         }
  52
  53         /**
  54          * Checks if an IP matches a proxy we've configured
  55          *
  56          * @param string $ip
  57          * @return bool
  58          */
  59         public function isConfiguredProxy( $ip ) {
  60                 // Quick check of known singular proxy servers
  61                 if ( in_array( $ip, $this->proxyServers ) ) {
  62                         return true;
  63                 }
  64
  65                 // Check against addresses and CIDR nets in the complex list
  66                 if ( !$this->proxyIPSet ) {
  67                         $this->proxyIPSet = new IPSet( $this->proxyServersComplex );
  68                 }
  69                 return $this->proxyIPSet->match( $ip );
  70         }
  71
  72         /**
  73          * Checks if an IP is a trusted proxy provider.
  74          * Useful to tell if X-Forwarded-For data is possibly bogus.
  75          * CDN cache servers for the site are whitelisted.
  76          *
  77          * @param string $ip
  78          * @return bool
  79          */
  80         public function isTrustedProxy( $ip ) {
  81                 $trusted = $this->isConfiguredProxy( $ip );
  82                 Hooks::run( 'IsTrustedProxy', [ &$ip, &$trusted ] );
  83                 return $trusted;
  84         }
  85 }