mirror of
https://github.com/tildeclub/site.git
synced 2026-10-23 03:27:14 +00:00
416 lines
9.6 KiB
PHP
416 lines
9.6 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* CSF deny list JSON API
|
|
* - Outputs only JSON
|
|
* - Locked down by IP allowlist and optional token
|
|
* - Supports IPv4, IPv6, IPv4-mapped IPv6, and CIDR ranges
|
|
* - Parses:
|
|
* - Single IP or CIDR, with optional trailing comment
|
|
* - Advanced rules: proto(s)|in/out|s/d=port(s)|s/d=ip
|
|
*/
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
header('X-Content-Type-Options: nosniff');
|
|
header('Referrer-Policy: no-referrer');
|
|
header('Cache-Control: no-store');
|
|
|
|
$env = loadEnv(__DIR__ . '/.env');
|
|
$env += [
|
|
'APP_ENV' => 'prod',
|
|
'DENY_FILE' => '/etc/csf/csf.deny',
|
|
'ALLOW_IPS' => '',
|
|
'TRUST_PROXY' => '0',
|
|
'TRUSTED_PROXIES' => '',
|
|
'API_TOKEN' => '',
|
|
];
|
|
|
|
if (($env['APP_ENV'] ?? 'prod') !== 'dev') {
|
|
ini_set('display_errors', '0');
|
|
ini_set('log_errors', '1');
|
|
}
|
|
|
|
$clientIp = resolveClientIp((bool) intval($env['TRUST_PROXY']), $env['TRUSTED_PROXIES']);
|
|
|
|
if (!ipAllowed($clientIp, $env['ALLOW_IPS'])) {
|
|
http_response_code(403);
|
|
echo json_encode([
|
|
'error' => 'forbidden',
|
|
'reason' => 'ip_not_allowed',
|
|
'client_ip' => canonicalIp($clientIp) ?? $clientIp,
|
|
], JSON_UNESCAPED_SLASHES);
|
|
exit;
|
|
}
|
|
|
|
if (($env['API_TOKEN'] ?? '') !== '' && !hash_equals($env['API_TOKEN'], $_SERVER['HTTP_X_API_TOKEN'] ?? '')) {
|
|
http_response_code(403);
|
|
echo json_encode(['error' => 'forbidden', 'reason' => 'bad_token'], JSON_UNESCAPED_SLASHES);
|
|
exit;
|
|
}
|
|
|
|
$file = $env['DENY_FILE'];
|
|
|
|
if (!is_readable($file)) {
|
|
http_response_code(500);
|
|
echo json_encode(['error' => 'unreadable_file', 'path' => $file], JSON_UNESCAPED_SLASHES);
|
|
exit;
|
|
}
|
|
|
|
$lines = file($file, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [];
|
|
$entries = [];
|
|
|
|
foreach ($lines as $rawLine) {
|
|
$line = trim($rawLine);
|
|
|
|
if ($line === '' || str_starts_with($line, '#')) {
|
|
continue;
|
|
}
|
|
|
|
$comment = null;
|
|
$hashPos = strpos($line, ' #');
|
|
|
|
if ($hashPos !== false) {
|
|
$comment = trim(substr($line, $hashPos + 2));
|
|
$line = trim(substr($line, 0, $hashPos));
|
|
}
|
|
|
|
$parsed = parseCsfLine($line);
|
|
|
|
if ($parsed !== null) {
|
|
$parsed['raw'] = $rawLine;
|
|
|
|
if ($comment !== null) {
|
|
$parsed['comment'] = $comment;
|
|
}
|
|
|
|
$entries[] = $parsed;
|
|
}
|
|
}
|
|
|
|
echo json_encode([
|
|
'generated_at' => gmdate('c'),
|
|
'source' => realpath($file) ?: $file,
|
|
'count' => count($entries),
|
|
'entries' => $entries,
|
|
], JSON_UNESCAPED_SLASHES);
|
|
|
|
/* -------------------- helpers -------------------- */
|
|
|
|
function loadEnv(string $path): array
|
|
{
|
|
$out = [];
|
|
|
|
if (!is_file($path) || !is_readable($path)) {
|
|
return $out;
|
|
}
|
|
|
|
foreach (file($path, FILE_IGNORE_NEW_LINES) ?: [] as $line) {
|
|
$line = trim($line);
|
|
|
|
if ($line === '' || str_starts_with($line, '#')) {
|
|
continue;
|
|
}
|
|
|
|
if (!str_contains($line, '=')) {
|
|
continue;
|
|
}
|
|
|
|
[$key, $value] = array_map('trim', explode('=', $line, 2));
|
|
$out[$key] = trim($value, " \t\n\r\0\x0B\"'");
|
|
}
|
|
|
|
return $out;
|
|
}
|
|
|
|
function resolveClientIp(bool $trustProxy, string $trustedProxiesCsv): string
|
|
{
|
|
$remote = $_SERVER['REMOTE_ADDR'] ?? '';
|
|
|
|
if (!$trustProxy) {
|
|
return canonicalIp($remote) ?? $remote;
|
|
}
|
|
|
|
if (!ipAllowed($remote, $trustedProxiesCsv)) {
|
|
return canonicalIp($remote) ?? $remote;
|
|
}
|
|
|
|
$xff = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '';
|
|
|
|
if ($xff === '') {
|
|
return canonicalIp($remote) ?? $remote;
|
|
}
|
|
|
|
$first = trim(explode(',', $xff)[0]);
|
|
|
|
return canonicalIp($first) ?? canonicalIp($remote) ?? $remote;
|
|
}
|
|
|
|
function ipAllowed(string $ip, string $allowCsv): bool
|
|
{
|
|
if (trim($allowCsv) === '') {
|
|
return false;
|
|
}
|
|
|
|
$client = parseIpOrCidr($ip);
|
|
|
|
if ($client === null || $client['cidr'] !== null) {
|
|
return false;
|
|
}
|
|
|
|
foreach (array_filter(array_map('trim', explode(',', $allowCsv))) as $allowed) {
|
|
$entry = parseIpOrCidr($allowed);
|
|
|
|
if ($entry === null) {
|
|
continue;
|
|
}
|
|
|
|
if ($entry['cidr'] !== null) {
|
|
if (ipInCidr($client['ip'], $entry['ip'] . '/' . $entry['cidr'])) {
|
|
return true;
|
|
}
|
|
|
|
continue;
|
|
}
|
|
|
|
if ($client['family'] === $entry['family'] && hash_equals($entry['ip'], $client['ip'])) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
function parseCsfLine(string $line): ?array
|
|
{
|
|
if (str_contains($line, '|')) {
|
|
$parts = array_map('trim', explode('|', $line));
|
|
|
|
if (count($parts) < 2) {
|
|
return null;
|
|
}
|
|
|
|
$protocols = array_values(array_filter(array_map(
|
|
static fn (string $proto): string => strtolower(trim($proto)),
|
|
explode('/', $parts[0])
|
|
)));
|
|
|
|
$direction = strtolower($parts[1] ?? '');
|
|
$srcIp = null;
|
|
$dstIp = null;
|
|
$srcPorts = [];
|
|
$dstPorts = [];
|
|
|
|
for ($i = 2; $i < count($parts); $i++) {
|
|
$kv = explode('=', $parts[$i], 2);
|
|
|
|
if (count($kv) !== 2) {
|
|
continue;
|
|
}
|
|
|
|
[$key, $value] = [strtolower(trim($kv[0])), trim($kv[1])];
|
|
$ipOrCidr = parseIpOrCidr($value);
|
|
|
|
if ($key === 's' || $key === 'src') {
|
|
if ($ipOrCidr !== null) {
|
|
$srcIp = formatIpOrCidr($ipOrCidr);
|
|
} else {
|
|
$srcPorts = parsePortList($value);
|
|
}
|
|
} elseif ($key === 'd' || $key === 'dst') {
|
|
if ($ipOrCidr !== null) {
|
|
$dstIp = formatIpOrCidr($ipOrCidr);
|
|
} else {
|
|
$dstPorts = parsePortList($value);
|
|
}
|
|
}
|
|
}
|
|
|
|
return [
|
|
'type' => 'rule',
|
|
'protocols' => $protocols ?: ['tcp'],
|
|
'direction' => in_array($direction, ['in', 'out'], true) ? $direction : 'in',
|
|
'ports' => ['source' => $srcPorts, 'dest' => $dstPorts],
|
|
'source_ip' => $srcIp,
|
|
'dest_ip' => $dstIp,
|
|
];
|
|
}
|
|
|
|
$parsed = parseIpOrCidr($line);
|
|
|
|
if ($parsed === null) {
|
|
return null;
|
|
}
|
|
|
|
return [
|
|
'type' => $parsed['cidr'] !== null ? 'cidr' : 'ip',
|
|
'family' => $parsed['family'],
|
|
'ip' => $parsed['ip'],
|
|
'cidr' => $parsed['cidr'],
|
|
];
|
|
}
|
|
|
|
function parseIpOrCidr(string $value): ?array
|
|
{
|
|
$value = trim($value);
|
|
|
|
if ($value === '') {
|
|
return null;
|
|
}
|
|
|
|
$cidr = null;
|
|
$ip = $value;
|
|
|
|
if (str_contains($value, '/')) {
|
|
[$ip, $mask] = explode('/', $value, 2);
|
|
$ip = trim($ip);
|
|
$mask = trim($mask);
|
|
|
|
if ($mask === '' || !ctype_digit($mask)) {
|
|
return null;
|
|
}
|
|
|
|
$cidr = (int) $mask;
|
|
}
|
|
|
|
$ip = trim($ip);
|
|
|
|
if (str_starts_with($ip, '[') && str_ends_with($ip, ']')) {
|
|
$ip = substr($ip, 1, -1);
|
|
}
|
|
|
|
$packed = @inet_pton($ip);
|
|
|
|
if ($packed === false) {
|
|
return null;
|
|
}
|
|
|
|
$isMappedIpv4 = isIpv4MappedIpv6($packed);
|
|
|
|
if ($isMappedIpv4) {
|
|
$ip = inet_ntop(substr($packed, 12));
|
|
$family = 'ipv4';
|
|
$maxMask = 32;
|
|
|
|
if ($cidr !== null) {
|
|
if ($cidr < 96 || $cidr > 128) {
|
|
return null;
|
|
}
|
|
|
|
$cidr -= 96;
|
|
}
|
|
} else {
|
|
$ip = inet_ntop($packed);
|
|
$family = strlen($packed) === 4 ? 'ipv4' : 'ipv6';
|
|
$maxMask = $family === 'ipv4' ? 32 : 128;
|
|
}
|
|
|
|
if ($ip === false) {
|
|
return null;
|
|
}
|
|
|
|
if ($cidr !== null && ($cidr < 0 || $cidr > $maxMask)) {
|
|
return null;
|
|
}
|
|
|
|
return [
|
|
'ip' => $ip,
|
|
'cidr' => $cidr !== null ? (string) $cidr : null,
|
|
'family' => $family,
|
|
];
|
|
}
|
|
|
|
function canonicalIp(string $ip): ?string
|
|
{
|
|
$parsed = parseIpOrCidr($ip);
|
|
|
|
if ($parsed === null || $parsed['cidr'] !== null) {
|
|
return null;
|
|
}
|
|
|
|
return $parsed['ip'];
|
|
}
|
|
|
|
function formatIpOrCidr(array $parsed): string
|
|
{
|
|
return $parsed['cidr'] === null
|
|
? $parsed['ip']
|
|
: $parsed['ip'] . '/' . $parsed['cidr'];
|
|
}
|
|
|
|
function isIpv4MappedIpv6(string $packed): bool
|
|
{
|
|
return strlen($packed) === 16
|
|
&& substr($packed, 0, 10) === str_repeat("\x00", 10)
|
|
&& substr($packed, 10, 2) === "\xff\xff";
|
|
}
|
|
|
|
function looksLikeIpOrCidr(string $value): bool
|
|
{
|
|
return parseIpOrCidr($value) !== null;
|
|
}
|
|
|
|
function parsePortList(string $value): array
|
|
{
|
|
$out = [];
|
|
|
|
foreach (explode(',', $value) as $port) {
|
|
$port = trim($port);
|
|
|
|
if ($port === '') {
|
|
continue;
|
|
}
|
|
|
|
if (preg_match('/^\d+(:\d+)?$/', $port) === 1) {
|
|
$out[] = $port;
|
|
}
|
|
}
|
|
|
|
return $out;
|
|
}
|
|
|
|
function ipInCidr(string $ip, string $cidr): bool
|
|
{
|
|
$client = parseIpOrCidr($ip);
|
|
$range = parseIpOrCidr($cidr);
|
|
|
|
if ($client === null || $range === null || $range['cidr'] === null) {
|
|
return false;
|
|
}
|
|
|
|
if ($client['family'] !== $range['family']) {
|
|
return false;
|
|
}
|
|
|
|
$ipBin = @inet_pton($client['ip']);
|
|
$subnetBin = @inet_pton($range['ip']);
|
|
|
|
if ($ipBin === false || $subnetBin === false) {
|
|
return false;
|
|
}
|
|
|
|
if (strlen($ipBin) !== strlen($subnetBin)) {
|
|
return false;
|
|
}
|
|
|
|
$maskBits = (int) $range['cidr'];
|
|
$bytes = intdiv($maskBits, 8);
|
|
$remainder = $maskBits % 8;
|
|
|
|
if ($bytes > 0 && substr($ipBin, 0, $bytes) !== substr($subnetBin, 0, $bytes)) {
|
|
return false;
|
|
}
|
|
|
|
if ($remainder === 0) {
|
|
return true;
|
|
}
|
|
|
|
if (!isset($ipBin[$bytes], $subnetBin[$bytes])) {
|
|
return false;
|
|
}
|
|
|
|
$mask = 0xff << (8 - $remainder) & 0xff;
|
|
|
|
return (ord($ipBin[$bytes]) & $mask) === (ord($subnetBin[$bytes]) & $mask);
|
|
}
|