3 * Functions for dealing with proxies
7 if ( !defined( 'MEDIAWIKI' ) ) {
11 /** Work out the IP address based on various globals */
13 global $wgSquidServers, $wgSquidServersNoPurge, $wgIP;
15 # Return cached result
16 if ( !empty( $wgIP ) ) {
20 /* collect the originating ips */
21 # Client connecting to this webserver
22 if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
23 $ipchain = array( $_SERVER['REMOTE_ADDR'] );
26 $ipchain = array( '127.0.0.1' );
30 # Get list of trusted proxies
31 # Flipped for quicker access
32 $trustedProxies = array_flip( array_merge( $wgSquidServers, $wgSquidServersNoPurge ) );
33 if ( count( $trustedProxies ) ) {
34 # Append XFF on to $ipchain
35 if ( isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) {
36 $xff = array_map( 'trim', explode( ',', $_SERVER['HTTP_X_FORWARDED_FOR'] ) );
37 $xff = array_reverse( $xff );
38 $ipchain = array_merge( $ipchain, $xff );
40 # Step through XFF list and find the last address in the list which is a trusted server
41 # Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private)
42 foreach ( $ipchain as $i => $curIP ) {
43 if ( array_key_exists( $curIP, $trustedProxies ) ) {
44 if ( isset( $ipchain[$i +
1] ) && wfIsIPPublic( $ipchain[$i +
1] ) ) {
45 $ip = $ipchain[$i +
1];
53 wfDebug( "IP: $ip\n" );
59 function wfIP2Unsigned( $ip ) {
70 * Determine if an IP address really is an IP address, and if it is public,
71 * i.e. not RFC 1918 or similar
73 function wfIsIPPublic( $ip ) {
74 $n = wfIP2Unsigned( $ip );
79 static $privateRanges = false;
80 if ( !$privateRanges ) {
81 $privateRanges = array(
82 array( '10.0.0.0', '10.255.255.255' ), # RFC 1918 (private)
83 array( '172.16.0.0', '172.31.255.255' ), # "
84 array( '192.168.0.0', '192.168.255.255' ), # "
85 array( '0.0.0.0', '0.255.255.255' ), # this network
86 array( '127.0.0.0', '127.255.255.255' ), # loopback
90 foreach ( $privateRanges as $r ) {
91 $start = wfIP2Unsigned( $r[0] );
92 $end = wfIP2Unsigned( $r[1] );
93 if ( $n >= $start && $n <= $end ) {
101 * Forks processes to scan the originating IP for an open proxy server
102 * MemCached can be used to skip IPs that have already been scanned
104 function wfProxyCheck() {
105 global $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath;
106 global $wgUseMemCached, $wgMemc, $wgDBname, $wgProxyMemcExpiry;
108 if ( !$wgBlockOpenProxies ) {
116 if ( $wgUseMemCached ) {
117 $mcKey = "$wgDBname:proxy:ip:$ip";
118 $mcValue = $wgMemc->get( $mcKey );
126 $title = Title
::makeTitle( NS_SPECIAL
, 'Blockme' );
127 $iphash = md5( $ip . $wgProxyKey );
128 $url = $title->getFullURL( 'ip='.$iphash );
130 foreach ( $wgProxyPorts as $port ) {
131 $params = implode( ' ', array(
132 escapeshellarg( $wgProxyScriptPath ),
133 escapeshellarg( $ip ),
134 escapeshellarg( $port ),
135 escapeshellarg( $url )
137 exec( "php $params &>/dev/null &" );
140 if ( $wgUseMemCached ) {
141 $wgMemc->set( $mcKey, 1, $wgProxyMemcExpiry );