Match a whitelist of IP addresses in PHP - php

Question

I have a list of IP ranges like
$whitelist=array('50*','202.16*','123.168*',');
I want to block all other traffic from seeing the page.
I've tried
if(in_array($_SERVER['REMOTE_ADDR'],$whitelist)){
//display page
}

Answer 1

in_array doesn't use regexs to compare. Also your regex is incorrect the * is a quantifier. That allows zero or more of the previous character.
Try:
$whitelist=array('50\..*','202\.16\..*','123\.168\..*');
if(preg_match('/^(' . implode('|', $whitelist) . ')/', $_SERVER['REMOTE_ADDR'])){
The .* is allowing anything (pretty much(see s modifier http://php.net/manual/en/reference.pcre.pattern.modifiers.php), . is any character and then paired with that quantifier previously mentioned). The ^ is the start of the string. \. is a literal .. The | is an or.
Demo: https://eval.in/571019
Regex Demo: https://regex101.com/r/dC5uI0/1

Answer 2

This should work for you:
you can loop through white list ip and trim space and * (if found from right).
There after using substr you can cut the IP address of the same length of whitelist ip in loop, and compare both.
$whitelists = array('50*','202.16*','123.168*');
foreach($whitelists as $whitelist){
$whitelist = rtrim($whitelist, "*\r\n\t\0 ");
if(substr($_SERVER['REMOTE_ADDR'], 0, strlen($whitelist)) == $whitelist) {
$match = true;
break;
}
}
echo $match ? 'Match' : 'Not Match';

Answer 3

as stated by #chris85, in_array doesn't use regexs.
To do such a thing, you could simply use a loop like this:
if(preg_match('/^(' . implode('|', $whitelist) . ')/i', $_SERVER['REMOTE_ADDR'])){
// Do your stuff
}
Your '*' doesn't work as you thought.. That's ok:
$whitelist=array('50\.*','202.16\.*','123.168\.*');

Answer 4

Hope this helps someone. Seeing as how you didn't specifically ask about regular expressions, and since the topic is about matching IP addresses, I thought I'd put this out there so that it may help someone with a similar issue.
Server software usually strives to be as quick and efficient as possible; matching IP addresses is usually done arithmetically. That being said, I'll go over a fast way to do exactly what you're trying to do before going over a possible alternative.
If you're simply performing a wild card match on IP address strings, I would suggest that you use this method. It has been tailored to your use case, but I will include the simple matching function by itself.
For contrast, I've also included the sample output with execution times using this method compared to using PHP's RegEx functions (which are the way to go for more complex pattern matching)
NOTES:
I use the functions referenced herein for very specific purposes. They are applicable to this scenario because IP addresses don't have '*' characters in them. As they are written, if the variable you're testing has a '*' character in it, it will only match against a wild card character so there is a slight possibility for loss of information there.
If you're writing a command-line daemon or your process will use the same list of IPs to check against multiple times during its lifetime, it is beneficial to use the RegEx library. The small speed benefit to using my method here is only won when having to initially load and prepare the IP list RegEx for first use.
You can move the code from "wildcard_match()" to inside of "match_ip() for further benefit, avoiding the overhead of another function call.
Code (you can copy and paste):
<?php
/**
* This function compares a string ("$test") to see if it is
* equal to another string ("$wild"). An '*' in "$wild" will
* match any characters in "$test".
*
* #param string $wild - The string to compare against. This may
* be either an exact character string to match, or a string
* with a wild card ('*') character that will match any character(s)
* found in "$test".
*
* #param string $test - A character string we're comparing against
* "$wild" to determine if there is a match.
*
* #return bool Returns TRUE if "$test" is either an exact match to
* "$wild", or it fits the bill taking any wild card characters into
* consideration.
*
**/
function wildcard_match( $pattern, $test ) {
$p = 0;
$a_name = explode("*", $pattern);
$segs = count($a_name);
$max_seg = ($segs-1);
$plen = 0;
$test_len = strlen($test);
for ($i = 0; $i < $segs; $i++) {
$part = $a_name[$i];
$plen = strlen($part);
if ($plen === 0) {
if ($i === $max_seg) return true;
continue;
}
$p = strpos($test, $part, $p);
if ($p === false) {
return false;
}
$p+=$plen;
}
if ($p===$test_len) {
return true;
}
return false;
}
/**
* Function to quickly traverse an array of whole, or
* wild card IPv4 addresses given in "$whitelist" and
* determine if they match the given whole IPv4
* address in "$test".
*
* #param array $whitelist - An array of IPv4 addresses, either
* whole, or containing an '*' character wherein any character(s)
* in "$test" will match.
*
* #param string $test - A complete string (dot-decimal) IPv4
* address to compare against the contents of the array given in
* parameter one ("$whitelist").
*
* #return bool Returns TRUE, if the IPv4 address given in "$test" was
* matched to an IPv4 address or IPv4 wild card pattern in the array
* given in parameter one ("$whitelist").
*
**/
function match_ip( $whitelist, $test ) {
foreach ($whitelist as $w) {
if (wildcard_match($w, $test)) return true;
}
return false;
}
/* The array of IP addresses we're going to validate */
$check_array = array("50.245.1.9", "35.125.25.255", "202.16.15.25");
/* The array as given in your example (minus the extra ' at the end) */
$whitelist1=array('50*','202.16*','123.168*');
/* An array for RegEx matching */
$whitelist2=array('50\..*','202\.16\..*','123\.168\..*');
microtime(true); /* Execute this once to make sure its module is loaded */
echo "Giving PHP a second to get its ducks in a row...\n";
usleep(1000000); /** Give PHP a second to load and prepare */
$st = microtime(true);
foreach ($check_array as $c) {
if (match_ip($whitelist1, $c)) {
echo "$c....Match!\n";
} else {
echo "$c....No match!\n";
}
}
$dt = microtime(true)-$st;
echo "Time: $dt\n\n\n\n";
$st = microtime(true);
foreach ($check_array as $c) {
if(preg_match('/^(' . implode('|', $whitelist2) . ')/', $c)){
echo "$c....Match!\n";
} else {
echo "$c....No Match!\n";
}
}
$dt = microtime(true)-$st;
echo "Time: $dt\n\n";
The output from this is:
Giving PHP a second to get its ducks in a row...
50.245.1.9....Match!
35.125.25.255....No match!
202.16.15.25....Match!
Time 1: 0.00027704238891602
50.245.1.9....Match!
35.125.25.255....No Match!
202.16.15.25....Match!
Time 2: 0.00040698051452637
The first result set is from the function "match_ip()", the second result set is from firing up the RegEx library.
Now, a possible better solution to wild card matching IPs would be to employ an array of IP addresses in CIDR notation in your array. Often times, you want IP traffic to be allowed from a specific network or range of IP addresses.
There are quite a few assumptions here, but for example (using your "$whitelist" array):
'50*' might be construed as "I want all IP addressess from 50.xxx.xxx.xxx to be allowed access.
In that case, you'd specify the format "50.0.0.0/8". (The "0"s after the "50." can be any number. They will be completely ignored because of the "/8".)
xxx.xxx.xxx.xxx
| | | |
8 16 24 32
An IPv4 address is computationally 32 bits, so above, you're saying that all you care about is the first 8 bits matching.
'123.168*' would be "123.168.0.0/16"
"101.23.54.0/24" would allow all IP addresses starting with "101.23.54" access.
"44.32.240.10/32" would only allow the IP address "44.32.240.10" access. No range.
So you could do something like this:
<?php
/**
* Determines if the two given IPv4 addresses
* are equal, or are on the same network using
* the given number of "$mask" bits.
*
* #param string $ip1 - The first string dot-decimal IPv4
* address.
*
* #param string $ip1 - The second string dot-decimal IPv4
* address.
*
* #param int $mask - The number of bits in the mask.
*
* #return bool Returns TRUE if they match after being
* masked, or FALSE if not.
*
*/
function ip_match( $ip1, $ip2, $mask) {
$mask = (int)$mask;
$ip1 = ip2long($ip1);
$ip2 = ip2long($ip2);
if ($ip1 === false || $ip2 === false) return false;
if ($mask < 1 || $mask > 32) return false;
$mask = (0x00000000FFFFFFFF & 0x00000000FFFFFFFF << (32-$mask));
if ( ($ip1 & $mask) === ($ip2 & $mask) ) {
return true;
}
return false;
}
/**
* Takes an array of string (CIDR) network representations and
* sorts them into an array used later for checking against IP
* addresses.
*
* #param array $cidr_array - An array of IP addressess in
* CIDR notation e.g. 192.168.1.1/24
*
* #return array Returns an array of objects with the following
* properties:
* 'ip' - The string (dot-decimal) IP address that
* has been numerically verified for use
* in comparisons later.
*
* 'mask' - The number of bits used for creating
* the subnet mask against which IP
* addresses will be compared.
*
**/
function make_whitelist( $cidr_array ) {
$wl = array();
$lip = 0;
$bm = 0;
$spos = 0;
if (!is_array($cidr_array)) return false;
foreach ($cidr_array as $ip) {
$spos = strpos($ip, "/");
if ($spos === false) {
$bm = 32; /* If there's no "/", assume
* that we want an EXACT IP
* address. Hence the 32 bit
* mask
**/
} else {
$bm = (int)substr($ip, ($spos+1));
$ip = substr($ip, 0, $spos++);
}
$lip = ip2long($ip); /* Using this here to check IP validity
* before storing it in the array...
* We use ip2long() later for comparisons.
*
* You can store it this way - as a long -
* instead of as a string (I do) to
* use less memory if you wish.
*
**/
if ($bm === 0) continue; /* A bit mask of ZERO will block
* ALL IP addresses, skip it
* for the example.
**/
if ($lip === false) continue; /* If it's an invalid IP, skip it,
* you could optionally try to
* resolve it as a hostname using
* gethostbyname() or gethostbynamel()
* here...
**/
array_push($wl, (object)array('ip'=>$ip, 'mask'=>$bm));
}
return $wl;
}
$whitelist = make_whitelist(array("50.0.0.0/8", "202.16.0.0/16", "123.168.0.0/16", "1.1.1.1"));
$ips_to_check = array("50.1.174.41", "42.123.100.23", "123.168.4.79", "1.1.1.2", "1.1.1.1");
foreach ($ips_to_check as $ip) {
foreach ($whitelist as $w) {
if (ip_match($ip, $w->ip, $w->mask)) {
echo "\"$ip\" is allowed!\n";
continue 2;
}
}
echo "\"$ip\" is NOT allowed!\n";
}
I know this is a lot, but there is plenty here for people to think about, find while searching, and hopefully be able to use to make their lives easier!