(bug 19441) Updated date formatting for Lithuanian
[mediawiki.git] / includes / ProxyTools.php
blobbb5c85ab74fe5ca400ffdd717f3368969d61fda2
1 <?php
2 /**
3 * Functions for dealing with proxies
4 * @file
5 */
7 /**
8 * Extracts the XFF string from the request header
9 * Checks first for "X-Forwarded-For", then "Client-ip"
10 * Note: headers are spoofable
11 * @return string
13 function wfGetForwardedFor() {
14 if( function_exists( 'apache_request_headers' ) ) {
15 // More reliable than $_SERVER due to case and -/_ folding
16 $set = array ();
17 foreach ( apache_request_headers() as $tempName => $tempValue ) {
18 $set[ strtoupper( $tempName ) ] = $tempValue;
20 $index = strtoupper ( 'X-Forwarded-For' );
21 $index2 = strtoupper ( 'Client-ip' );
22 } else {
23 // Subject to spoofing with headers like X_Forwarded_For
24 $set = $_SERVER;
25 $index = 'HTTP_X_FORWARDED_FOR';
26 $index2 = 'CLIENT-IP';
29 #Try a couple of headers
30 if( isset( $set[$index] ) ) {
31 return $set[$index];
32 } else if( isset( $set[$index2] ) ) {
33 return $set[$index2];
34 } else {
35 return null;
39 /**
40 * Returns the browser/OS data from the request header
41 * Note: headers are spoofable
42 * @return string
44 function wfGetAgent() {
45 if( function_exists( 'apache_request_headers' ) ) {
46 // More reliable than $_SERVER due to case and -/_ folding
47 $set = array ();
48 foreach ( apache_request_headers() as $tempName => $tempValue ) {
49 $set[ strtoupper( $tempName ) ] = $tempValue;
51 $index = strtoupper ( 'User-Agent' );
52 } else {
53 // Subject to spoofing with headers like X_Forwarded_For
54 $set = $_SERVER;
55 $index = 'HTTP_USER_AGENT';
57 if( isset( $set[$index] ) ) {
58 return $set[$index];
59 } else {
60 return '';
64 /**
65 * Work out the IP address based on various globals
66 * For trusted proxies, use the XFF client IP (first of the chain)
67 * @return string
69 function wfGetIP() {
70 global $wgIP, $wgUsePrivateIPs, $wgCommandLineMode;
72 # Return cached result
73 if ( !empty( $wgIP ) ) {
74 return $wgIP;
77 $ipchain = array();
78 $ip = false;
80 /* collect the originating ips */
81 # Client connecting to this webserver
82 if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
83 $ip = IP::canonicalize( $_SERVER['REMOTE_ADDR'] );
84 } elseif( $wgCommandLineMode ) {
85 $ip = '127.0.0.1';
87 if( $ip ) {
88 $ipchain[] = $ip;
91 # Append XFF on to $ipchain
92 $forwardedFor = wfGetForwardedFor();
93 if ( isset( $forwardedFor ) ) {
94 $xff = array_map( 'trim', explode( ',', $forwardedFor ) );
95 $xff = array_reverse( $xff );
96 $ipchain = array_merge( $ipchain, $xff );
99 # Step through XFF list and find the last address in the list which is a trusted server
100 # Set $ip to the IP address given by that trusted server, unless the address is not sensible (e.g. private)
101 foreach ( $ipchain as $i => $curIP ) {
102 $curIP = IP::canonicalize( $curIP );
103 if ( wfIsTrustedProxy( $curIP ) ) {
104 if ( isset( $ipchain[$i + 1] ) ) {
105 if( $wgUsePrivateIPs || IP::isPublic( $ipchain[$i + 1 ] ) ) {
106 $ip = $ipchain[$i + 1];
109 } else {
110 break;
114 if( !$ip ) {
115 throw new MWException( "Unable to determine IP" );
118 wfDebug( "IP: $ip\n" );
119 $wgIP = $ip;
120 return $ip;
124 * Checks if an IP is a trusted proxy providor
125 * Useful to tell if X-Fowarded-For data is possibly bogus
126 * Squid cache servers for the site and AOL are whitelisted
127 * @param string $ip
128 * @return bool
130 function wfIsTrustedProxy( $ip ) {
131 global $wgSquidServers, $wgSquidServersNoPurge;
133 if ( in_array( $ip, $wgSquidServers ) ||
134 in_array( $ip, $wgSquidServersNoPurge )
136 $trusted = true;
137 } else {
138 $trusted = false;
140 wfRunHooks( 'IsTrustedProxy', array( &$ip, &$trusted ) );
141 return $trusted;
145 * Forks processes to scan the originating IP for an open proxy server
146 * MemCached can be used to skip IPs that have already been scanned
148 function wfProxyCheck() {
149 global $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath;
150 global $wgMemc, $wgProxyMemcExpiry;
151 global $wgProxyKey;
153 if ( !$wgBlockOpenProxies ) {
154 return;
157 $ip = wfGetIP();
159 # Get MemCached key
160 $mcKey = wfMemcKey( 'proxy', 'ip', $ip );
161 $mcValue = $wgMemc->get( $mcKey );
162 $skip = (bool)$mcValue;
164 # Fork the processes
165 if ( !$skip ) {
166 $title = SpecialPage::getTitleFor( 'Blockme' );
167 $iphash = md5( $ip . $wgProxyKey );
168 $url = $title->getFullURL( 'ip='.$iphash );
170 foreach ( $wgProxyPorts as $port ) {
171 $params = implode( ' ', array(
172 escapeshellarg( $wgProxyScriptPath ),
173 escapeshellarg( $ip ),
174 escapeshellarg( $port ),
175 escapeshellarg( $url )
177 exec( "php $params &>/dev/null &" );
179 # Set MemCached key
180 $wgMemc->set( $mcKey, 1, $wgProxyMemcExpiry );
185 * Convert a network specification in CIDR notation to an integer network and a number of bits
186 * @return array(string, int)
188 function wfParseCIDR( $range ) {
189 return IP::parseCIDR( $range );
193 * Check if an IP address is in the local proxy list
194 * @return bool
196 function wfIsLocallyBlockedProxy( $ip ) {
197 global $wgProxyList;
198 $fname = 'wfIsLocallyBlockedProxy';
200 if ( !$wgProxyList ) {
201 return false;
203 wfProfileIn( $fname );
205 if ( !is_array( $wgProxyList ) ) {
206 # Load from the specified file
207 $wgProxyList = array_map( 'trim', file( $wgProxyList ) );
210 if ( !is_array( $wgProxyList ) ) {
211 $ret = false;
212 } elseif ( array_search( $ip, $wgProxyList ) !== false ) {
213 $ret = true;
214 } elseif ( array_key_exists( $ip, $wgProxyList ) ) {
215 # Old-style flipped proxy list
216 $ret = true;
217 } else {
218 $ret = false;
220 wfProfileOut( $fname );
221 return $ret;