phpmyadmin/libraries/ip_allow_deny.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * This library is used with the server IP allow/deny host authentication
   5  * feature
   6  *
   7  * @package PhpMyAdmin
   8  */
   9 if (! defined('PHPMYADMIN')) {
  10     exit;
  11 }
  12
  13 /**
  14  * Gets the "true" IP address of the current user
  15  *
  16  * @return string   the ip of the user
  17  *
  18  * @access  private
  19  */
  20 function PMA_getIp()
  21 {
  22     /* Get the address of user */
  23     if (empty($_SERVER['REMOTE_ADDR'])) {
  24         /* We do not know remote IP */
  25         return false;
  26     }
  27
  28     $direct_ip = $_SERVER['REMOTE_ADDR'];
  29
  30     /* Do we trust this IP as a proxy? If yes we will use it's header. */
  31     if (!isset($GLOBALS['cfg']['TrustedProxies'][$direct_ip])) {
  32         /* Return true IP */
  33         return $direct_ip;
  34     }
  35
  36     $trusted_header_value
  37         = PMA_getenv($GLOBALS['cfg']['TrustedProxies'][$direct_ip]);
  38     $matches = array();
  39     // the $ checks that the header contains only one IP address,
  40     // ?: makes sure the () don't capture
  41     $is_ip = preg_match(
  42         '|^(?:[0-9]{1,3}\.){3,3}[0-9]{1,3}$|',
  43         $trusted_header_value, $matches
  44     );
  45
  46     if ($is_ip && (count($matches) == 1)) {
  47         // True IP behind a proxy
  48         return $matches[0];
  49     }
  50
  51     /* Return true IP */
  52     return $direct_ip;
  53 } // end of the 'PMA_getIp()' function
  54
  55
  56 /**
  57  * Matches for IPv4 or IPv6 addresses
  58  *
  59  * @param string $testRange string of IP range to match
  60  * @param string $ipToTest  string of IP to test against range
  61  *
  62  * @return boolean    whether the IP mask matches
  63  *
  64  * @access  public
  65  */
  66 function PMA_ipMaskTest($testRange, $ipToTest)
  67 {
  68     $result = true;
  69
  70     if (strpos($testRange, ':') > -1 || strpos($ipToTest, ':') > -1) {
  71         // assume IPv6
  72         $result = PMA_ipv6MaskTest($testRange, $ipToTest);
  73     } else {
  74         $result = PMA_ipv4MaskTest($testRange, $ipToTest);
  75     }
  76
  77     return $result;
  78 } // end of the "PMA_ipMaskTest()" function
  79
  80
  81 /**
  82  * Based on IP Pattern Matcher
  83  * Originally by J.Adams <jna@retina.net>
  84  * Found on <http://www.php.net/manual/en/function.ip2long.php>
  85  * Modified for phpMyAdmin
  86  *
  87  * Matches:
  88  * xxx.xxx.xxx.xxx        (exact)
  89  * xxx.xxx.xxx.[yyy-zzz]  (range)
  90  * xxx.xxx.xxx.xxx/nn     (CIDR)
  91  *
  92  * Does not match:
  93  * xxx.xxx.xxx.xx[yyy-zzz]  (range, partial octets not supported)
  94  *
  95  * @param string $testRange string of IP range to match
  96  * @param string $ipToTest  string of IP to test against range
  97  *
  98  * @return boolean    whether the IP mask matches
  99  *
 100  * @access  public
 101  */
 102 function PMA_ipv4MaskTest($testRange, $ipToTest)
 103 {
 104     $result = true;
 105     $match = preg_match(
 106         '|([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+)/([0-9]+)|',
 107         $testRange,
 108         $regs
 109     );
 110     if ($match) {
 111         // performs a mask match
 112         $ipl    = ip2long($ipToTest);
 113         $rangel = ip2long(
 114             $regs[1] . '.' . $regs[2] . '.' . $regs[3] . '.' . $regs[4]
 115         );
 116
 117         $maskl  = 0;
 118
 119         for ($i = 0; $i < 31; $i++) {
 120             if ($i < $regs[5] - 1) {
 121                 $maskl = $maskl + PMA_Util::pow(2, (30 - $i));
 122             } // end if
 123         } // end for
 124
 125         if (($maskl & $rangel) == ($maskl & $ipl)) {
 126             return true;
 127         }
 128
 129         return false;
 130     }
 131
 132     // range based
 133     $maskocts = explode('.', $testRange);
 134     $ipocts   = explode('.', $ipToTest);
 135
 136     // perform a range match
 137     for ($i = 0; $i < 4; $i++) {
 138         if (preg_match('|\[([0-9]+)\-([0-9]+)\]|', $maskocts[$i], $regs)) {
 139             if (($ipocts[$i] > $regs[2]) || ($ipocts[$i] < $regs[1])) {
 140                 $result = false;
 141             } // end if
 142         } else {
 143             if ($maskocts[$i] <> $ipocts[$i]) {
 144                 $result = false;
 145             } // end if
 146         } // end if/else
 147     } //end for
 148
 149     return $result;
 150 } // end of the "PMA_ipv4MaskTest()" function
 151
 152
 153 /**
 154  * IPv6 matcher
 155  * CIDR section taken from http://stackoverflow.com/a/10086404
 156  * Modified for phpMyAdmin
 157  *
 158  * Matches:
 159  * xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx
 160  * (exact)
 161  * xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:[yyyy-zzzz]
 162  * (range, only at end of IP - no subnets)
 163  * xxxx:xxxx:xxxx:xxxx/nn
 164  * (CIDR)
 165  *
 166  * Does not match:
 167  * xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xx[yyy-zzz]
 168  * (range, partial octets not supported)
 169  *
 170  * @param string $test_range string of IP range to match
 171  * @param string $ip_to_test string of IP to test against range
 172  *
 173  * @return boolean    whether the IP mask matches
 174  *
 175  * @access  public
 176  */
 177 function PMA_ipv6MaskTest($test_range, $ip_to_test)
 178 {
 179     $result = true;
 180
 181     // convert to lowercase for easier comparison
 182     $test_range = strtolower($test_range);
 183     $ip_to_test = strtolower($ip_to_test);
 184
 185     $is_cidr = strpos($test_range, '/') > -1;
 186     $is_range = strpos($test_range, '[') > -1;
 187     $is_single = ! $is_cidr && ! $is_range;
 188
 189     $ip_hex = bin2hex(inet_pton($ip_to_test));
 190
 191     if ($is_single) {
 192         $range_hex = bin2hex(inet_pton($test_range));
 193         $result = $ip_hex === $range_hex;
 194         return $result;
 195     }
 196
 197     if ($is_range) {
 198         // what range do we operate on?
 199         $range_match = array();
 200         $match = preg_match(
 201             '/\[([0-9a-f]+)\-([0-9a-f]+)\]/', $test_range, $range_match
 202         );
 203         if ($match) {
 204             $range_start = $range_match[1];
 205             $range_end   = $range_match[2];
 206
 207             // get the first and last allowed IPs
 208             $first_ip  = str_replace($range_match[0], $range_start, $test_range);
 209             $first_hex = bin2hex(inet_pton($first_ip));
 210             $last_ip   = str_replace($range_match[0], $range_end, $test_range);
 211             $last_hex  = bin2hex(inet_pton($last_ip));
 212
 213             // check if the IP to test is within the range
 214             $result = ($ip_hex >= $first_hex && $ip_hex <= $last_hex);
 215         }
 216         return $result;
 217     }
 218
 219     if ($is_cidr) {
 220         // Split in address and prefix length
 221         list($first_ip, $subnet) = explode('/', $test_range);
 222
 223         // Parse the address into a binary string
 224         $first_bin = inet_pton($first_ip);
 225         $first_hex = bin2hex($first_bin);
 226
 227         // Overwriting first address string to make sure notation is optimal
 228         $first_ip = inet_ntop($first_bin);
 229
 230         $flexbits = 128 - $subnet;
 231
 232         // Build the hexadecimal string of the last address
 233         $last_hex = $first_hex;
 234
 235         $pos = 31;
 236         while ($flexbits > 0) {
 237             // Get the character at this position
 238             $orig = substr($last_hex, $pos, 1);
 239
 240             // Convert it to an integer
 241             $origval = hexdec($orig);
 242
 243             // OR it with (2^flexbits)-1, with flexbits limited to 4 at a time
 244             $newval = $origval | (pow(2, min(4, $flexbits)) - 1);
 245
 246             // Convert it back to a hexadecimal character
 247             $new = dechex($newval);
 248
 249             // And put that character back in the string
 250             $last_hex = substr_replace($last_hex, $new, $pos, 1);
 251
 252             // We processed one nibble, move to previous position
 253             $flexbits -= 4;
 254             $pos -= 1;
 255         }
 256
 257         // check if the IP to test is within the range
 258         $result = ($ip_hex >= $first_hex && $ip_hex <= $last_hex);
 259     }
 260
 261     return $result;
 262 } // end of the "PMA_ipv6MaskTest()" function
 263
 264
 265 /**
 266  * Runs through IP Allow/Deny rules the use of it below for more information
 267  *
 268  * @param string $type 'allow' | 'deny' type of rule to match
 269  *
 270  * @return bool   Matched a rule ?
 271  *
 272  * @access  public
 273  *
 274  * @see     PMA_getIp()
 275  */
 276 function PMA_allowDeny($type)
 277 {
 278     global $cfg;
 279
 280     // Grabs true IP of the user and returns if it can't be found
 281     $remote_ip = PMA_getIp();
 282     if (empty($remote_ip)) {
 283         return false;
 284     }
 285
 286     // copy username
 287     $username  = $cfg['Server']['user'];
 288
 289     // copy rule database
 290     $rules     = $cfg['Server']['AllowDeny']['rules'];
 291
 292     // lookup table for some name shortcuts
 293     $shortcuts = array(
 294         'all'       => '0.0.0.0/0',
 295         'localhost' => '127.0.0.1/8'
 296     );
 297
 298     // Provide some useful shortcuts if server gives us address:
 299     if (PMA_getenv('SERVER_ADDR')) {
 300         $shortcuts['localnetA'] = PMA_getenv('SERVER_ADDR') . '/8';
 301         $shortcuts['localnetB'] = PMA_getenv('SERVER_ADDR') . '/16';
 302         $shortcuts['localnetC'] = PMA_getenv('SERVER_ADDR') . '/24';
 303     }
 304
 305     foreach ($rules as $rule) {
 306         // extract rule data
 307         $rule_data = explode(' ', $rule);
 308
 309         // check for rule type
 310         if ($rule_data[0] != $type) {
 311             continue;
 312         }
 313
 314         // check for username
 315         if (($rule_data[1] != '%') //wildcarded first
 316             && ($rule_data[1] != $username)
 317         ) {
 318             continue;
 319         }
 320
 321         // check if the config file has the full string with an extra
 322         // 'from' in it and if it does, just discard it
 323         if ($rule_data[2] == 'from') {
 324             $rule_data[2] = $rule_data[3];
 325         }
 326
 327         // Handle shortcuts with above array
 328         if (isset($shortcuts[$rule_data[2]])) {
 329             $rule_data[2] = $shortcuts[$rule_data[2]];
 330         }
 331
 332         // Add code for host lookups here
 333         // Excluded for the moment
 334
 335         // Do the actual matching now
 336         if (PMA_ipMaskTest($rule_data[2], $remote_ip)) {
 337             return true;
 338         }
 339     } // end while
 340
 341     return false;
 342 } // end of the "PMA_AllowDeny()" function
 343
 344 ?>