Changeset 706 for trunk/lib

Timestamp:

Oct 27, 2019 12:22:59 AM (5 years ago)

Author:

anonymous

Message:

Add IPIntelligenceBadIP function. Fix PHP notice for invlid IP in canonicalIPAddr(). Use CF-Connecting-IP header in getRemoteIP().

Location:

trunk/lib

Files:

• Auth_SQL.inc.php (modified) (1 diff)
• Utilities.inc.php (modified) (4 diffs)

trunk/lib/Auth_SQL.inc.php

@@ -705 +705 @@
             if (mysql_affected_rows($db->getDBH()) > 0) {
                 // User record still exists in DB. Do this to ensure user was not delete from DB between accesses. Notice "+ 1" in SQL above to ensure record is modified.
+                $app->logMsg(sprintf('Session authenticated for user_id %s (%s).', $this->get('user_id'), $this->get('username')), LOG_DEBUG, __FILE__, __LINE__);
+                // TODO: This auth check doesn't match parity when calling isLoggedIn($user_id) with a user_id, because the latter checks last_login_datetime in DB, and the former only checks SESSION. These two can be out-of-sync after loading DB via sdbdown.
                 return true;
             } else {

trunk/lib/Utilities.inc.php

@@ -1294 +1294 @@
     if ($trust_all_proxies || isset($cfg['trusted_proxies']) && is_array($cfg['trusted_proxies']) && in_array($_SERVER['REMOTE_ADDR'], $cfg['trusted_proxies'], true)) {
         // Then it's probably safe to use an IP address value set in an HTTP header.
-        // Loop through possible IP address headers.
-        foreach (array('HTTP_CLIENT_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED') as $key) {
+        // Loop through possible IP address headers from those most likely to contain the correct value first.
+        // HTTP_CLIENT_IP: set by Apache Module mod_remoteip
+        // HTTP_REAL_IP: set by Nginx Module ngx_http_realip_module
+        // HTTP_CF_CONNECTING_IP: set by Cloudflare proxy
+        // HTTP_X_FORWARDED_FOR: defacto standard for web proxies
+        foreach (array('HTTP_CLIENT_IP', 'HTTP_REAL_IP', 'HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_FORWARDED', 'HTTP_X_CLUSTER_CLIENT_IP', 'HTTP_FORWARDED_FOR', 'HTTP_FORWARDED') as $key) {
             // Loop through and if
             if (array_key_exists($key, $_SERVER)) {
@@ -1302 +1306 @@
                     $addr = preg_replace('/[^=]=/', '', $addr);
                     $addr = canonicalIPAddr(trim($addr));
-                    if (false !== filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+                    if (false !== filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 | FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
                         return $dolookup && '' != $addr ? gethostbyaddr($addr) : $addr;
                     }
@@ -1327 +1331 @@
 function canonicalIPAddr($addr)
 {
+    if (!preg_match('/^([0-9a-f:]+|[0-9.])$/', $addr)) {
+        // Definitely not an IPv6 or IPv4 address.
+        return $addr;
+    }
+
     // Known prefix
     $v4mapped_prefix_bin = pack('H*', '00000000000000000000ffff');
@@ -1527 +1536 @@
     return $data;
 }
+
+/*
+* Get IP address status from IP Intelligence. https://getipintel.net/free-proxy-vpn-tor-detection-api/#expected_output
+*
+* @access   public
+* @param    string  $ip         IP address to check.
+* @param    float   $threshold  Return true if the IP score is above this threshold (0-1).
+* @param    string  $email      Requester email address.
+* @return
+* @author   Quinn Comendant <quinn@strangecode.com>
+* @since    26 Oct 2019 15:39:17
+*/
+function IPIntelligenceBadIP($ip, $threshold=0.95, $email='hello@strangecode.com')
+{
+    $app =& App::getInstance();
+
+    $ch = curl_init(sprintf('http://check.getipintel.net/check.php?ip=%s&contact=%s', urlencode($ip), urlencode($email)));
+    curl_setopt($ch, CURLOPT_TIMEOUT, 2);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    $response = curl_exec($ch);
+    $errorno = curl_errno($ch);
+    $error = curl_error($ch);
+    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    curl_close($ch);
+
+    if ($errorno == CURLE_OPERATION_TIMEOUTED) {
+        $http_code = 408;
+    }
+
+    switch ($http_code) {
+    case 200:
+    case 400:
+        // Check response value, below.
+        break;
+
+    case 408:
+        $app->logMsg(sprintf('IP Intelligence timeout', null), LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    case 429:
+        $app->logMsg(sprintf('IP Intelligence number of allowed queries exceeded (rate limit 15 requests/minute)', null), LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    default:
+        $app->logMsg(sprintf('IP Intelligence unexpected response (%s): %s: %s', $http_code, $error, $response), LOG_ERR, __FILE__, __LINE__);
+        return false;
+    }
+
+    switch ($response) {
+    case -1:
+        $app->logMsg('IP Intelligence: Invalid no input', LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    case -2:
+        $app->logMsg('IP Intelligence: Invalid IP address', LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    case -3:
+        $app->logMsg('IP Intelligence: Unroutable or private address', LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    case -4:
+        $app->logMsg('IP Intelligence: Unable to reach database', LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    case -5:
+        $app->logMsg('IP Intelligence: Banned: no permission or invalid email address', LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    case -6:
+        $app->logMsg('IP Intelligence: Invalid contact information', LOG_WARNING, __FILE__, __LINE__);
+        return false;
+    default:
+        if (!is_numeric($response) || $response < 0 || $response >= $threshold) {
+            $app->logMsg(sprintf('IP Intelligence: Bad IP (%s): %s', $response, $ip), LOG_NOTICE, __FILE__, __LINE__);
+            return true;
+        }
+        $app->logMsg(sprintf('IP Intelligence: Good IP (%s): %s', $response, $ip), LOG_NOTICE, __FILE__, __LINE__);
+        return false;
+    }
+}