X-Git-Url: http://git.osdn.net/view?a=blobdiff_plain;f=spam%2Fspam.php;h=ed4a2b626c17609d472f1945dc534b1ed4fbcb53;hb=6ce06a0f0de067ad24ec7b01781ce8f15cede441;hp=ea0cb64fc4ab05af6388bb00af20ca458d851eeb;hpb=06a275fc3d8ab8ce7132b8cf95b857ad3d935c76;p=pukiwiki%2Fpukiwiki_sandbox.git diff --git a/spam/spam.php b/spam/spam.php index ea0cb64..ed4a2b6 100644 --- a/spam/spam.php +++ b/spam/spam.php @@ -1,883 +1,675 @@ = 4.3.0): preg_match_all(PREG_OFFSET_CAPTURE): $method['uri_XXX'] related feature -if (! defined('SPAM_INI_FILE')) define('SPAM_INI_FILE', 'spam.ini.php'); -// --------------------- -// URI pickup - -// Return an array of URIs in the $string -// [OK] http://nasty.example.org#nasty_string -// [OK] http://nasty.example.org:80/foo/xxx#nasty_string/bar -// [OK] ftp://nasty.example.org:80/dfsdfs -// [OK] ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm (from RFC3986) -function uri_pickup($string = '', $normalize = TRUE, - $preserve_rawuri = FALSE, $preserve_chunk = TRUE) -{ - // Not available for: IDN(ignored) - $array = array(); - preg_match_all( - // scheme://userinfo@host:port/path/or/pathinfo/maybefile.and?query=string#fragment - // Refer RFC3986 (Regex below is not strict) - '#(\b[a-z][a-z0-9.+-]{1,8})://' . // 1: Scheme - '(?:' . - '([^\s<>"\'\[\]/\#?@]*)' . // 2: Userinfo (Username) - '@)?' . - '(' . - // 3: Host - '\[[0-9a-f:.]+\]' . '|' . // IPv6([colon-hex and dot]): RFC2732 - '(?:[0-9]{1-3}\.){3}[0-9]{1-3}' . '|' . // IPv4(dot-decimal): 001.22.3.44 - '[^\s<>"\'\[\]:/\#?]+' . // FQDN: foo.example.org - ')' . - '(?::([0-9]*))?' . // 4: Port - '((?:/+[^\s<>"\'\[\]/\#]+)*/+)?' . // 5: Directory path or path-info - '([^\s<>"\'\[\]\#?]+)?' . // 6: File? - '(?:\?([^\s<>"\'\[\]\#]+))?' . // 7: Query string - '(?:\#([a-z0-9._~%!$&\'()*+,;=:@-]*))?' . // 8: Fragment - '#i', - $string, $array, PREG_SET_ORDER | PREG_OFFSET_CAPTURE - ); - //var_dump(recursive_map('htmlspecialchars', $array)); +if (! defined('LIB_DIR')) define('LIB_DIR', './'); +require(LIB_DIR . 'spam_pickup.php'); +require(LIB_DIR . 'spam_util.php'); - // Shrink $array - static $parts = array( - 1 => 'scheme', 2 => 'userinfo', 3 => 'host', 4 => 'port', - 5 => 'path', 6 => 'file', 7 => 'query', 8 => 'fragment' - ); - $default = array(''); - foreach(array_keys($array) as $uri) { - $_uri = & $array[$uri]; - array_rename_keys($_uri, $parts, TRUE, $default); - - $offset = $_uri['scheme'][1]; // Scheme's offset - foreach(array_keys($_uri) as $part) { - // Remove offsets for each part - $_uri[$part] = & $_uri[$part][0]; - } +if (! defined('SPAM_INI_FILE')) define('SPAM_INI_FILE', 'spam.ini.php'); - if ($normalize) { - $_uri['scheme'] = scheme_normalize($_uri['scheme']); - if ($_uri['scheme'] === '') { - unset ($array[$uri]); - continue; - } - $_uri['host'] = strtolower($_uri['host']); - $_uri['port'] = port_normalize($_uri['port'], $_uri['scheme'], FALSE); - $_uri['path'] = path_normalize($_uri['path']); - if ($preserve_rawuri) $_uri['rawuri'] = & $_uri[0]; - // DEBUG - //$_uri['uri'] = uri_array_implode($_uri); - } else { - $_uri['uri'] = & $_uri[0]; // Raw - } - unset($_uri[0]); // Matched string itself - if (! $preserve_chunk) { - unset( - $_uri['scheme'], - $_uri['userinfo'], - $_uri['host'], - $_uri['port'], - $_uri['path'], - $_uri['file'], - $_uri['query'], - $_uri['fragment'] - ); - } +// --------------------- +// Regex - // Area offset for area_measure() - $_uri['area']['offset'] = $offset; - } +// Rough implementation of globbing +// +// USAGE: $regex = '/^' . generate_glob_regex('*.txt', '/') . '$/i'; +// +function generate_glob_regex($string = '', $divider = '/') +{ + static $from = array( + 1 => '*', + 11 => '?', + // 22 => '[', // Maybe cause regex compilation error (e.g. '[]') + // 23 => ']', // + ); + static $mid = array( + 1 => '_AST_', + 11 => '_QUE_', + // 22 => '_RBR_', + // 23 => '_LBR_', + ); + static $to = array( + 1 => '.*', + 11 => '.', + // 22 => '[', + // 23 => ']', + ); - return $array; -} + if (! is_string($string)) return ''; -// Destructive normalize of URI array -// NOTE: Give me the uri_pickup() result with chunks -function uri_array_normalize(& $pickups, $preserve = TRUE) -{ - if (! is_array($pickups)) return $pickups; - - foreach (array_keys($pickups) as $key) { - $_key = & $pickups[$key]; - $_key['path'] = isset($_key['path']) ? strtolower($_key['path']) : ''; - $_key['file'] = isset($_key['file']) ? file_normalize($_key['file']) : ''; - $_key['query'] = isset($_key['query']) ? query_normalize(strtolower($_key['query']), TRUE) : ''; - $_key['fragment'] = (isset($_key['fragment']) && $preserve) ? - strtolower($_key['fragment']) : ''; // Just ignore - } + $string = str_replace($from, $mid, $string); // Hide + $string = preg_quote($string, $divider); + $string = str_replace($mid, $to, $string); // Unhide - return $pickups; + return $string; } -// An URI array => An URI (See uri_pickup()) -function uri_array_implode($uri = array()) +// Generate host (FQDN, IPv4, ...) regex +// 'localhost' : Matches with 'localhost' only +// 'example.org' : Matches with 'example.org' only (See host_normalize() about 'www') +// '.example.org' : Matches with ALL FQDN ended with '.example.org' +// '*.example.org' : Almost the same of '.example.org' except 'www.example.org' +// '10.20.30.40' : Matches with IPv4 address '10.20.30.40' only +// [TODO] '192.' : Matches with all IPv4 hosts started with '192.' +// TODO: IPv4, CIDR?, IPv6 +function generate_host_regex($string = '', $divider = '/') { - if (empty($uri) || ! is_array($uri)) return NULL; + if (! is_string($string)) return ''; - $tmp = array(); - if (isset($uri['scheme']) && $uri['scheme'] !== '') { - $tmp[] = & $uri['scheme']; - $tmp[] = '://'; - } - if (isset($uri['userinfo']) && $uri['userinfo'] !== '') { - $tmp[] = & $uri['userinfo']; - $tmp[] = '@'; - } - if (isset($uri['host']) && $uri['host'] !== '') { - $tmp[] = & $uri['host']; - } - if (isset($uri['port']) && $uri['port'] !== '') { - $tmp[] = ':'; - $tmp[] = & $uri['port']; - } - if (isset($uri['path']) && $uri['path'] !== '') { - $tmp[] = & $uri['path']; - } - if (isset($uri['file']) && $uri['file'] !== '') { - $tmp[] = & $uri['file']; - } - if (isset($uri['query']) && $uri['query'] !== '') { - $tmp[] = '?'; - $tmp[] = & $uri['query']; - } - if (isset($uri['fragment']) && $uri['fragment'] !== '') { - $tmp[] = '#'; - $tmp[] = & $uri['fragment']; + if (mb_strpos($string, '.') === FALSE || is_ip($string)) { + // "localhost", IPv4, etc + return generate_glob_regex($string, $divider); } - return implode('', $tmp); -} - -// $array['something'] => $array['wanted'] -function array_rename_keys(& $array, $keys = array('from' => 'to'), $force = FALSE, $default = '') -{ - if (! is_array($array) || ! is_array($keys)) return FALSE; - - // Nondestructive test - if (! $force) - foreach(array_keys($keys) as $from) - if (! isset($array[$from])) - return FALSE; - - foreach($keys as $from => $to) { - if ($from === $to) continue; - if (! $force || isset($array[$from])) { - $array[$to] = & $array[$from]; - unset($array[$from]); - } else { - $array[$to] = $default; - } + // FQDN or something + $part = explode('.', $string, 2); + if ($part[0] == '') { + // ".example.org" + $part[0] = '(?:.*\.)?'; + } else if ($part[0] == '*') { + // "*.example.org" + $part[0] = '.*\.'; + } else { + // example.org, etc + return generate_glob_regex($string, $divider); } - return TRUE; + $part[1] = generate_glob_regex($part[1], $divider); + + return implode('', $part); } + // --------------------- -// Area pickup +// Load -// Pickup all of markup areas -function area_pickup($string = '', $method = array()) +// Load SPAM_INI_FILE and return parsed one +function get_blocklist($list = '') { - $area = array(); - - // Anchor tags by preg_match_all() - // [OK] - // [OK] Good site! - // [OK] test - // [OK] visit http://nasty.example.com/ - // [OK] discount foobar - // [NG] visit http://ng.example.com _not_ended_ - if (isset($method['anchor'])) { - $areas = array(); - preg_match_all('#]*\bhref\b[^>]*>.*?]*(>)#i', - $string, $areas, PREG_SET_ORDER | PREG_OFFSET_CAPTURE); - //var_dump(recursive_map('htmlspecialchars', $areas)); - foreach(array_keys($areas) as $_area) { - $areas[$_area] = array( - $areas[$_area][0][1], // Area start () - $areas[$_area][1][1], // Area end () - ); - } - if (! empty($areas)) $area['anchor'] = $areas; + static $regexes; + + if ($list === NULL) { + $regexes = NULL; // Unset + return array(); } - // phpBB's "BBCode" by preg_match_all() - // [OK] [url][/url] - // [OK] [url]http://nasty.example.com/[/url] - // [OK] [link]http://nasty.example.com/[/link] - // [OK] [url=http://nasty.example.com]visit http://nasty.example.com/[/url] - // [OK] [link http://nasty.example.com/]buy something[/link] - if (isset($method['bbcode'])) { - $areas = array(); - preg_match_all('#\[(url|link)\b[^\]]*\].*?\[/\1\b[^\]]*(\])#i', - $string, $areas, PREG_SET_ORDER | PREG_OFFSET_CAPTURE); - //var_dump(recursive_map('htmlspecialchars', $areas)); - foreach(array_keys($areas) as $_area) { - $areas[$_area] = array( - $areas[$_area][0][1], // Area start ([url]) - $areas[$_area][2][1], // Area end ([/url]) - ); + if (! isset($regexes)) { + $regexes = array(); + if (file_exists(SPAM_INI_FILE)) { + $blocklist = array(); + + include(SPAM_INI_FILE); + // $blocklist['list'] = array( + // //'goodhost' => FALSE; + // 'badhost' => TRUE; + // ); + // $blocklist['badhost'] = array( + // '*.blogspot.com', // Blog services's subdomains (only) + // 'IANA-examples' => '#^(?:.*\.)?example\.(?:com|net|org)$#', + // ); + + foreach(array( + 'pre', + 'list', + ) as $special) { + + if (! isset($blocklist[$special])) continue; + + $regexes[$special] = $blocklist[$special]; + + foreach(array_keys($blocklist[$special]) as $_list) { + if (! isset($blocklist[$_list])) continue; + + foreach ($blocklist[$_list] as $key => $value) { + if (is_array($value)) { + $regexes[$_list][$key] = array(); + foreach($value as $_key => $_value) { + get_blocklist_add($regexes[$_list][$key], $_key, $_value); + } + } else { + get_blocklist_add($regexes[$_list], $key, $value); + } + } + + unset($blocklist[$_list]); + } + } } - if (! empty($areas)) $area['bbcode'] = $areas; } - // Various Wiki syntax - // [text_or_uri>text_or_uri] - // [text_or_uri:text_or_uri] - // [text_or_uri|text_or_uri] - // [text_or_uri->text_or_uri] - // [text_or_uri text_or_uri] // MediaWiki - // MediaWiki: [http://nasty.example.com/ visit http://nasty.example.com/] + if ($list === '') { + return $regexes; // ALL of + } else if (isset($regexes[$list])) { + return $regexes[$list]; // A part of + } else { + return array(); // Found nothing + } +} - return $area; +// Subroutine of get_blocklist(): Add new regex to the $array +function get_blocklist_add(& $array, $key = 0, $value = '*.example.org/path/to/file.html') +{ + if (is_string($key)) { + $array[$key] = & $value; // Treat $value as a regex for FQDN(host)s + } else { + $regex = generate_host_regex($value, '#'); + if (! empty($regex)) { + $array[$value] = '#^' . $regex . '$#i'; + } + } } -// If in doubt, it's a little doubtful -// if (Area => inside <= Area) $brief += -1 -function area_measure($areas, & $array, $belief = -1, $a_key = 'area', $o_key = 'offset') +// Blocklist metrics: Separate $host, to $blocked and not blocked +function blocklist_distiller(& $hosts, $keys = array('goodhost', 'badhost'), $asap = FALSE) { - if (! is_array($areas) || ! is_array($array)) return; - - $areas_keys = array_keys($areas); - foreach(array_keys($array) as $u_index) { - $offset = isset($array[$u_index][$o_key]) ? - intval($array[$u_index][$o_key]) : 0; - foreach($areas_keys as $a_index) { - if (isset($array[$u_index][$a_key])) { - $offset_s = intval($areas[$a_index][0]); - $offset_e = intval($areas[$a_index][1]); - // [Area => inside <= Area] - if ($offset_s < $offset && $offset < $offset_e) { - $array[$u_index][$a_key] += $belief; + if (! is_array($hosts)) $hosts = array($hosts); + if (! is_array($keys)) $keys = array($keys); + + $list = get_blocklist('list'); + $blocked = array(); + + foreach($keys as $key){ + foreach (get_blocklist($key) as $label => $regex) { + if (is_array($regex)) { + foreach($regex as $_label => $_regex) { + $group = preg_grep($_regex, $hosts); + if ($group) { + $hosts = array_diff($hosts, $group); + $blocked[$key][$label][$_label] = $group; + if ($asap && $list[$key]) break; + } + } + } else { + $group = preg_grep($regex, $hosts); + if ($group) { + $hosts = array_diff($hosts, $group); + $blocked[$key][$label] = $group; + if ($asap && $list[$key]) break; } } } } + + return $blocked; } + // --------------------- -// Spam-uri pickup - -// Domain exposure callback (See spam_uri_pickup_preprocess()) -// http://victim.example.org/?foo+site:nasty.example.com+bar -// => http://nasty.example.com/?refer=victim.example.org -// NOTE: 'refer=' is not so good for (at this time). -// Consider about using IP address of the victim, try to avoid that. -function _preg_replace_callback_domain_exposure($matches = array()) + + +// Default (enabled) methods and thresholds (for content insertion) +function check_uri_spam_method($times = 1, $t_area = 0, $rule = TRUE) { - $result = ''; - - // Preserve the victim URI as a complicity or ... - if (isset($matches[5])) { - $result = - $matches[1] . '://' . // scheme - $matches[2] . '/' . // victim.example.org - $matches[3]; // The rest of all (before victim) + $times = intval($times); + $t_area = intval($t_area); + + $positive = array( + // Thresholds + 'quantity' => 8 * $times, // Allow N URIs + 'non_uniqhost' => 3 * $times, // Allow N duped (and normalized) Hosts + //'non_uniquri'=> 3 * $times, // Allow N duped (and normalized) URIs + + // Areas + 'area_anchor' => $t_area, // Using HTML tag + 'area_bbcode' => $t_area, // Using [url] or [link] BBCode + //'uri_anchor' => $t_area, // URI inside HTML tag + //'uri_bbcode' => $t_area, // URI inside [url] or [link] BBCode + ); + if ($rule) { + $bool = array( + // Rules + //'asap' => TRUE, // Quit or return As Soon As Possible + 'uniqhost' => TRUE, // Show uniq host (at block notification mail) + 'badhost' => TRUE, // Check badhost + ); + } else { + $bool = array(); } - // Flipped URI - if (isset($matches[4])) { - $result = - $matches[1] . '://' . // scheme - $matches[4] . // nasty.example.com - '/?refer=' . strtolower($matches[2]) . // victim.example.org - ' ' . $result; + // Remove non-$positive values + foreach (array_keys($positive) as $key) { + if ($positive[$key] < 0) unset($positive[$key]); } - return $result; + return $positive + $bool; } -// Preprocess: rawurldecode() and adding space(s) and something -// to detect/count some URIs _if possible_ -// NOTE: It's maybe danger to var_dump(result). [e.g. 'javascript:'] -// [OK] http://victim.example.org/go?http%3A%2F%2Fnasty.example.org -// [OK] http://victim.example.org/http://nasty.example.org -function spam_uri_pickup_preprocess($string = '') +// Simple/fast spam check +function check_uri_spam($target = '', $method = array()) { - if (! is_string($string)) return ''; - - $string = rawurldecode($string); - - // Domain exposure (See _preg_replace_callback_domain_exposure()) - $string = preg_replace_callback( - array( - // Something Google: http://www.google.com/supported_domains - '#(http)://([a-z0-9.]+\.google\.[a-z]{2,3}(?:\.[a-z]{2})?)/' . - '([a-z0-9?=&.%_+-]+)' . // ?query=foo+ - '\bsite:([a-z0-9.%_-]+)' . // site:nasty.example.com - //'()' . // Preserve or remove? - '#i', + // Return value + $progress = array( + 'method' => array( + // Theme to do => Dummy, optional value, or optional array() + //'quantity' => 8, + //'uniqhost' => TRUE, + //'non_uniqhost'=> 3, + //'non_uniquri' => 3, + //'badhost' => TRUE, + //'area_anchor' => 0, + //'area_bbcode' => 0, + //'uri_anchor' => 0, + //'uri_bbcode' => 0, ), - '_preg_replace_callback_domain_exposure', - $string - ); - - // URI exposure (uriuri => uri uri) - $string = preg_replace( - array( - '#(? array( + // Theme => Volume found (int) + ), + 'is_spam' => array( + // Flag. If someting defined here, + // one or more spam will be included + // in this report + ), + 'blocked' => array( + // Hosts blocked + //'category' => array( + // 'host', + //) + ), + 'hosts' => array( + // Hosts not blocked ), - ' $0', - $string ); - return $string; -} + // ---------------------------------------- + // Aliases -// Main function of spam-uri pickup -function spam_uri_pickup($string = '', $area = array()) -{ - if (! is_array($area) || empty($area)) { - $area = array( - 'anchor' => TRUE, - 'bbcode' => TRUE, - ); + $sum = & $progress['sum']; + $is_spam = & $progress['is_spam']; + $progress['method'] = & $method; // Argument + $blocked = & $progress['blocked']; + $hosts = & $progress['hosts']; + $asap = isset($method['asap']); + + // ---------------------------------------- + // Init + + if (! is_array($method) || empty($method)) { + $method = check_uri_spam_method(); + } + foreach(array_keys($method) as $key) { + if (! isset($sum[$key])) $sum[$key] = 0; } + if (! isset($sum['quantity'])) $sum['quantity'] = 0; - $string = spam_uri_pickup_preprocess($string); + // ---------------------------------------- + // Recurse - $array = uri_pickup($string); + if (is_array($target)) { + foreach($target as $str) { + if (! is_string($str)) continue; - // Area elevation for '(especially external)link' intension - if (! empty($array)) { - $areas = area_pickup($string, $area); - if (! empty($areas)) { - $area_shadow = array(); - foreach(array_keys($array) as $key){ - $area_shadow[$key] = & $array[$key]['area']; - $area_shadow[$key]['anchor'] = 0; - $area_shadow[$key]['bbcode'] = 0; - } - if (isset($areas['anchor'])) { - area_measure($areas['anchor'], $area_shadow, 1, 'anchor'); + $_progress = check_uri_spam($str, $method); // Recurse + + // Merge $sum + $_sum = & $_progress['sum']; + foreach (array_keys($_sum) as $key) { + if (! isset($sum[$key])) { + $sum[$key] = & $_sum[$key]; + } else { + $sum[$key] += $_sum[$key]; + } } - if (isset($areas['bbcode'])) { - area_measure($areas['bbcode'], $area_shadow, 1, 'bbcode'); + + // Merge $is_spam + $_is_spam = & $_progress['is_spam']; + foreach (array_keys($_is_spam) as $key) { + $is_spam[$key] = TRUE; + if ($asap) break; } - } - } + if ($asap && $is_spam) break; - // Remove 'offset's for area_measure() - foreach(array_keys($array) as $key) - unset($array[$key]['area']['offset']); + // Merge only + $blocked = array_merge_leaves($blocked, $_progress['blocked'], FALSE); + $hosts = array_merge_leaves($hosts, $_progress['hosts'], FALSE); + } - return $array; -} + // Unique values + $blocked = array_unique_recursive($blocked); + $hosts = array_unique_recursive($hosts); + // Recount $sum['badhost'] + $sum['badhost'] = array_count_leaves($blocked); -// --------------------- -// Normalization + return $progress; + } -// Scheme normalization: Renaming the schemes -// snntp://example.org => nntps://example.org -// NOTE: Keep the static lists simple. See also port_normalize(). -function scheme_normalize($scheme = '', $considerd_harmfull = TRUE) -{ - // Abbreviations considerable they don't have link intension - static $abbrevs = array( - 'ttp' => 'http', - 'ttps' => 'https', - ); + // ---------------------------------------- + // Area measure - // Alias => normalized - static $aliases = array( - 'pop' => 'pop3', - 'news' => 'nntp', - 'imap4' => 'imap', - 'snntp' => 'nntps', - 'snews' => 'nntps', - 'spop3' => 'pop3s', - 'pops' => 'pop3s', - ); + if (! $asap || ! $is_spam) { + + // Method pickup + $_method = array(); + foreach(array( + 'area_anchor', // There's HTML anchor tag + 'area_bbcode', // There's 'BBCode' linking tag + ) as $key) { + if (isset($method[$key])) $_method[$key] = TRUE; + } - $scheme = strtolower(trim($scheme)); - if (isset($abbrevs[$scheme])) { - if ($considerd_harmfull) { - $scheme = $abbrevs[$scheme]; + if ($_method) { + $_asap = isset($method['asap']) ? array('asap' => TRUE) : array(); + $_result = area_pickup($target, $_method + $_asap); + $_asap = NULL; } else { - $scheme = ''; + $_result = FALSE; } + + if ($_result) { + foreach(array_keys($_method) as $key) { + if (isset($_result[$key])) { + $sum[$key] = $_result[$key]; + if (isset($method[$key]) && $sum[$key] > $method[$key]) { + $is_spam[$key] = TRUE; + } + } + } + } + + unset($_asap, $_method, $_result); } - if (isset($aliases[$scheme])) $scheme = $aliases[$scheme]; - return $scheme; -} + // Return if ... + if ($asap && $is_spam) return $progress; -// Port normalization: Suppress the (redundant) default port -// HTTP://example.org:80/ => http://example.org/ -// HTTP://example.org:8080/ => http://example.org:8080/ -// HTTPS://example.org:443/ => https://example.org/ -function port_normalize($port, $scheme, $scheme_normalize = TRUE) -{ - // Schemes that users _maybe_ want to add protocol-handlers - // to their web browsers. (and attackers _maybe_ want to use ...) - // Reference: http://www.iana.org/assignments/port-numbers - static $array = array( - // scheme => default port - 'ftp' => 21, - 'ssh' => 22, - 'telnet' => 23, - 'smtp' => 25, - 'tftp' => 69, - 'gopher' => 70, - 'finger' => 79, - 'http' => 80, - 'pop3' => 110, - 'sftp' => 115, - 'nntp' => 119, - 'imap' => 143, - 'irc' => 194, - 'wais' => 210, - 'https' => 443, - 'nntps' => 563, - 'rsync' => 873, - 'ftps' => 990, - 'telnets' => 992, - 'imaps' => 993, - 'ircs' => 994, - 'pop3s' => 995, - 'mysql' => 3306, - ); + // ---------------------------------------- + // URI: Pickup - $port = trim($port); - if ($port === '') return $port; + $pickups = spam_uri_pickup($target, $method); - if ($scheme_normalize) $scheme = scheme_normalize($scheme); - if (isset($array[$scheme]) && $port == $array[$scheme]) - $port = ''; // Ignore the defaults - return $port; -} + // Return if ... + if (empty($pickups)) return $progress; -// Path normalization -// http://example.org => http://example.org/ -// http://example.org#hoge => http://example.org/#hoge -// http://example.org/path/a/b/./c////./d => http://example.org/path/a/b/c/d -// http://example.org/path/../../a/../back => http://example.org/back -function path_normalize($path = '', $divider = '/', $addroot = TRUE) -{ - if (! is_string($path) || $path == '') - return $addroot ? $divider : ''; + // Normalize all + $pickups = uri_pickup_normalize($pickups); - $path = trim($path); - $last = ($path[strlen($path) - 1] == $divider) ? $divider : ''; - $array = explode($divider, $path); + // ---------------------------------------- + // Pickup some part of URI - // Remove paddings - foreach(array_keys($array) as $key) { - if ($array[$key] == '' || $array[$key] == '.') - unset($array[$key]); + $hosts = array(); + foreach ($pickups as $key => $pickup) { + $hosts[$key] = & $pickup['host']; } - // Back-track - $tmp = array(); - foreach($array as $value) { - if ($value == '..') { - array_pop($tmp); - } else { - array_push($tmp, $value); - } - } - $array = & $tmp; - $path = $addroot ? $divider : ''; - if (! empty($array)) $path .= implode($divider, $array) . $last; + // ---------------------------------------- + // URI: Bad host (Separate good/bad hosts from $hosts) - return $path; -} + if ((! $asap || ! $is_spam) && isset($method['badhost'])) { + $list = get_blocklist('pre'); + $blocked = blocklist_distiller($hosts, array_keys($list), $asap); + foreach($list as $key => $type){ + if (! $type) unset($blocked[$key]); // Ignore goodhost etc + } + unset($list); + if (! empty($blocked)) $is_spam['badhost'] = TRUE; + } -// DirectoryIndex normalize (Destructive and rough) -function file_normalize($string = 'index.html.en') -{ - static $array = array( - 'index' => TRUE, // Some system can omit the suffix - 'index.htm' => TRUE, - 'index.html' => TRUE, - 'index.shtml' => TRUE, - 'index.jsp' => TRUE, - 'index.php' => TRUE, - 'index.php3' => TRUE, - 'index.php4' => TRUE, - //'index.pl' => TRUE, - //'index.py' => TRUE, - //'index.rb' => TRUE, - 'index.cgi' => TRUE, - 'default.htm' => TRUE, - 'default.html' => TRUE, - 'default.asp' => TRUE, - 'default.aspx' => TRUE, - ); + // Return if ... + if ($asap && $is_spam) return $progress; - // Content-negothiation filter: - // Roughly removing ISO 639 -like - // 2-letter suffixes (See RFC3066) - $matches = array(); - if (preg_match('/(.*)\.[a-z][a-z](?:-[a-z][a-z])?$/i', $string, $matches)) { - $_string = $matches[1]; - } else { - $_string = & $string; + // Remove blocked from $pickups + foreach(array_keys($pickups) as $key) { + if (! isset($hosts[$key])) { + unset($pickups[$key]); + } } - if (isset($array[strtolower($_string)])) { - return ''; - } else { - return $string; + // ---------------------------------------- + // URI: Check quantity + + $sum['quantity'] += count($pickups); + // URI quantity + if ((! $asap || ! $is_spam) && isset($method['quantity']) && + $sum['quantity'] > $method['quantity']) { + $is_spam['quantity'] = TRUE; } -} -// Sort query-strings if possible (Destructive and rough) -// [OK] &&&&f=d&b&d&c&a=0dd => a=0dd&b&c&d&f=d -// [OK] nothing==&eg=dummy&eg=padding&eg=foobar => eg=foobar -function query_normalize($string = '', $equal = FALSE, $equal_cutempty = TRUE) -{ - $array = explode('&', $string); + // ---------------------------------------- + // URI: used inside HTML anchor tag pair - // Remove '&' paddings - foreach(array_keys($array) as $key) { - if ($array[$key] == '') { - unset($array[$key]); + if ((! $asap || ! $is_spam) && isset($method['uri_anchor'])) { + $key = 'uri_anchor'; + foreach($pickups as $pickup) { + if (isset($pickup['area'][$key])) { + $sum[$key] += $pickup['area'][$key]; + if(isset($method[$key]) && + $sum[$key] > $method[$key]) { + $is_spam[$key] = TRUE; + if ($asap && $is_spam) break; + } + if ($asap && $is_spam) break; + } } } - // Consider '='-sepalated input and paddings - if ($equal) { - $equals = $not_equals = array(); - foreach ($array as $part) { - if (strpos($part, '=') === FALSE) { - $not_equals[] = $part; - } else { - list($key, $value) = explode('=', $part, 2); - $value = ltrim($value, '='); - if (! $equal_cutempty || $value != '') { - $equals[$key] = $value; + // ---------------------------------------- + // URI: used inside 'BBCode' pair + + if ((! $asap || ! $is_spam) && isset($method['uri_bbcode'])) { + $key = 'uri_bbcode'; + foreach($pickups as $pickup) { + if (isset($pickup['area'][$key])) { + $sum[$key] += $pickup['area'][$key]; + if(isset($method[$key]) && + $sum[$key] > $method[$key]) { + $is_spam[$key] = TRUE; + if ($asap && $is_spam) break; } + if ($asap && $is_spam) break; } } - - $array = & $not_equals; - foreach ($equals as $key => $value) { - $array[] = $key . '=' . $value; - } - unset($equals); } - natsort($array); - return implode('&', $array); -} + // ---------------------------------------- + // URI: Uniqueness (and removing non-uniques) -// --------------------- -// Part One : Checker + if ((! $asap || ! $is_spam) && isset($method['non_uniquri'])) { -function generate_glob_regex($string = '', $divider = '/') -{ - static $from = array( - 1 => '*', - 11 => '?', - // 22 => '[', // Maybe cause regex compilation error (e.g. '[]') - // 23 => ']', // - ); - static $mid = array( - 1 => '_AST_', - 11 => '_QUE_', - // 22 => '_RBR_', - // 23 => '_LBR_', - ); - static $to = array( - 1 => '.*', - 11 => '.', - // 22 => '[', - // 23 => ']', - ); - - if (is_array($string)) { - // Recurse - return '(?:' . - implode('|', // OR - array_map('generate_glob_regex', - $string, - array_pad(array(), count($string), $divider) - ) - ) . - ')'; - } else { - $string = str_replace($from, $mid, $string); // Hide - $string = preg_quote($string, $divider); - $string = str_replace($mid, $to, $string); // Unhide - return $string; - } -} - -// TODO: Ignore list -// TODO: preg_grep() ? -// TODO: Multi list -function is_badhost($hosts = '', $asap = TRUE) -{ - static $regex; - - if (! isset($regex)) { - $regex = array(); - $regex['badhost'] = array(); - - // Sample - if (TRUE) { - $blocklist['badhost'] = array( - //'*', // Deny all uri - //'10.20.*.*', // 10.20.example.com also matches - //'*.blogspot.com', // Blog services subdomains - //array('blogspot.com', '*.blogspot.com') - ); - foreach ($blocklist['badhost'] as $part) { - $regex['badhost'][$part] = '/^' . generate_glob_regex($part) . '$/i'; - } + $uris = array(); + foreach (array_keys($pickups) as $key) { + $uris[$key] = uri_pickup_implode($pickups[$key]); } - - // Load - if (file_exists(SPAM_INI_FILE)) { - $blocklist = array(); - require(SPAM_INI_FILE); - foreach ($blocklist['badhost'] as $part) { - $regex['badhost'][$part] = '/^' . generate_glob_regex($part) . '$/i'; + $count = count($uris); + $uris = array_unique($uris); + $sum['non_uniquri'] += $count - count($uris); + if ($sum['non_uniquri'] > $method['non_uniquri']) { + $is_spam['non_uniquri'] = TRUE; + } + if (! $asap || ! $is_spam) { + foreach (array_diff(array_keys($pickups), + array_keys($uris)) as $remove) { + unset($pickups[$remove]); } } + unset($uris); } - //var_dump($regex); - $result = array(); - if (! is_array($hosts)) $hosts = array($hosts); + // Return if ... + if ($asap && $is_spam) return $progress; - foreach($hosts as $host) { - if (! is_string($host)) $host = ''; - foreach ($regex['badhost'] as $part => $_regex) { - if (preg_match($_regex, $host)) { - if (! isset($result[$part])) $result[$part] = array(); - $result[$part][] = $host; - if ($asap) { - return $result; - } else { - break; - } - } + // ---------------------------------------- + // Host: Uniqueness (uniq / non-uniq) + + $hosts = array_unique($hosts); + + if (isset($sum['uniqhost'])) $sum['uniqhost'] += count($hosts); + if ((! $asap || ! $is_spam) && isset($method['non_uniqhost'])) { + $sum['non_uniqhost'] = $sum['quantity'] - $sum['uniqhost']; + if ($sum['non_uniqhost'] > $method['non_uniqhost']) { + $is_spam['non_uniqhost'] = TRUE; } } - return $result; -} + // Return if ... + if ($asap && $is_spam) return $progress; -// Default (enabled) methods and thresholds -function check_uri_spam_method($times = 1, $t_area = 0, $rule = TRUE) -{ - $times = intval($times); - $t_area = intval($t_area); - - // Thresholds - $method = array( - 'quantity' => 8 * $times, // Allow N URIs - 'non_uniq' => 3 * $times, // Allow N duped (and normalized) URIs - ); + // ---------------------------------------- + // URI: Bad host (Separate good/bad hosts from $hosts) - // Areas - $area = array( - //'total' => $t_area, // Allow N areas total, enabled below - 'anchor' => $t_area, // Inside HTML tag - 'bbcode' => $t_area, // Inside [url] or [link] BBCode - ); + if ((! $asap || ! $is_spam) && isset($method['badhost'])) { + $list = get_blocklist('list'); + $blocked = array_merge_leaves( + $blocked, + blocklist_distiller($hosts, array_keys($list), $asap), + FALSE + ); + foreach($list as $key=>$type){ + if (! $type) unset($blocked[$key]); // Ignore goodhost etc + } + unset($list); + if (! empty($blocked)) $is_spam['badhost'] = TRUE; + } - // Rules - $rules = array( - 'asap' => FALSE, // Quit As Soon As Possible - 'uniqhost' => TRUE, // Show uniq host (at block notification mail) - 'badhost' => TRUE, // Check badhost - ); + // Return if ... + //if ($asap && $is_spam) return $progress; - // Remove unused - foreach (array_keys($method) as $key) { - if ($method[$key] < 0) unset($method[$key]); - } - foreach (array_keys($area) as $key) { - if ($area[$key] < 0) unset($area[$key]); - } - $area = empty($area) ? array() : array('area' => $area); - $rules = $rule ? $rules : array(); + // ---------------------------------------- + // End - return $method + $area + $rules; + return $progress; } -// Simple/fast spam check -function check_uri_spam($target = '', $method = array()) -{ - if (! is_array($method) || empty($method)) { - $method = check_uri_spam_method(); - } - - $asap = isset($method['asap']) ? $method['asap'] : TRUE; - $sum = array( - 'quantity' => 0, - 'uniqhost' => 0, - 'non_uniq' => 0, - 'badhost' => 0, - 'area_total' => 0, - 'area_anchor' => 0, - 'area_bbcode' => 0, - ); - $is_spam = array(); - $progress = array( - 'sum' => & $sum, - 'is_spam' => & $is_spam, - 'method' => & $method, - ); +// --------------------- +// Reporting - if (is_array($target)) { - // Recurse - foreach($target as $str) { - $_progress = check_uri_spam($str, $method); - foreach (array_keys($_progress['sum']) as $key) { - $sum[$key] += $_progress['sum'][$key]; - } - foreach(array_keys($_progress['is_spam']) as $key) { - $is_spam[$key] = TRUE; - } - if ($asap && $is_spam) break; - } +// Summarize $progress (blocked only) +function summarize_spam_progress($progress = array(), $blockedonly = FALSE) +{ + if ($blockedonly) { + $tmp = array_keys($progress['is_spam']); } else { - $pickups = spam_uri_pickup($target); - if (! empty($pickups)) { - $sum['quantity'] += count($pickups); - - // URI quantity - if ((! $asap || ! $is_spam) && isset($method['quantity']) && - $sum['quantity'] > $method['quantity']) { - $is_spam['quantity'] = TRUE; - } - //var_dump($method['quantity'], $is_spam); - - // Using invalid area - if ((! $asap || ! $is_spam) && isset($method['area'])) { - foreach($pickups as $pickup) { - foreach ($pickup['area'] as $key => $value) { - if ($key == 'offset') continue; - // Total - $sum['area_total'] += $value; - if (isset($method['area']['total']) && - $sum['area_total'] > $method['area']['total']) { - $is_spam['area_total'] = TRUE; - if ($asap && $is_spam) break; - } - // Each area - $p_key = 'area_' . $key; - $sum[$p_key] += $value; - if(isset($method['area'][$key]) && - $sum[$p_key] > $method['area'][$key]) { - $is_spam[$p_key] = TRUE; - if ($asap && $is_spam) break; - } - } - if ($asap && $is_spam) break; - } - } - //var_dump($method['area'], $is_spam); - - // URI uniqueness (and removing non-uniques) - if ((! $asap || ! $is_spam) && isset($method['non_uniq'])) { - - // Destructive normalize of URIs - uri_array_normalize($pickups); - - $uris = array(); - foreach (array_keys($pickups) as $key) { - $uris[$key] = uri_array_implode($pickups[$key]); - } - $count = count($uris); - $uris = array_unique($uris); - $sum['non_uniq'] += $count - count($uris); - if ($sum['non_uniq'] > $method['non_uniq']) { - $is_spam['non_uniq'] = TRUE; - } - if (! $asap || ! $is_spam) { - foreach (array_diff(array_keys($pickups), - array_keys($uris)) as $remove) { - unset($pickups[$remove]); - } + $tmp = array(); + $method = & $progress['method']; + if (isset($progress['sum'])) { + foreach ($progress['sum'] as $key => $value) { + if (isset($method[$key]) && $value) { + $tmp[] = $key . '(' . $value . ')'; } - unset($uris); - } - //var_dump($method['non_uniq'], $is_spam); - - // Unique host - $hosts = array(); - foreach ($pickups as $pickup) $hosts[] = & $pickup['host']; - $hosts = array_unique($hosts); - $sum['uniqhost'] += count($hosts); - //var_dump($method['uniqhost'], $is_spam); - - // Bad host - if ((! $asap || ! $is_spam) && isset($method['badhost'])) { - $count = array_count_leaves(is_badhost($hosts, $asap)); - $sum['badhost'] += $count; - if ($count != 0) $is_spam['badhost'] = TRUE; } - //var_dump($method['badhost'], $is_spam); } } - return $progress; + return implode(', ', $tmp); } -// Count leaves -function array_count_leaves($array = array(), $count_empty_array = FALSE) +function summarize_detail_badhost($progress = array()) { - if (! is_array($array) || (empty($array) && $count_empty_array)) - return 1; + if (! isset($progress['blocked']) || empty($progress['blocked'])) return ''; + + // Flat per group + $blocked = array(); + foreach($progress['blocked'] as $list => $lvalue) { + foreach($lvalue as $group => $gvalue) { + $flat = implode(', ', array_flat_leaves($gvalue)); + if ($flat === $group) { + $blocked[$list][] = $flat; + } else { + $blocked[$list][$group] = $flat; + } + } + } - // Recurse - $result = 0; - foreach ($array as $part) { - $result += array_count_leaves($part, $count_empty_array); + // Shrink per list + // From: 'A-1' => array('ie.to') + // To: 'A-1' => 'ie.to' + foreach($blocked as $list => $lvalue) { + if (is_array($lvalue) && + count($lvalue) == 1 && + is_numeric(key($lvalue))) { + $blocked[$list] = current($lvalue); + } } - return $result; -} -// --------------------- -// Reporting + return var_export_shrink($blocked, TRUE, TRUE); +} -// TODO: Don't show unused $method! -// Summarize $progress (blocked only) -function summarize_spam_progress($progress = array(), $blockedonly = FALSE) +function summarize_detail_newtral($progress = array()) { - $method = $progress['method']; - if (isset($method['area'])) { - foreach(array_keys($method['area']) as $key) { - $method['area_' . $key] = TRUE; + if (! isset($progress['hosts']) || + ! is_array($progress['hosts']) || + empty($progress['hosts'])) return ''; + + // Generate a responsible $trie + $trie = array(); + foreach($progress['hosts'] as $value) { + // 'A.foo.bar.example.com' + $resp = whois_responsibility($value); // 'example.com' + if (empty($resp)) { + // One or more test, or do nothing here + $resp = strval($value); + $rest = ''; + } else { + $rest = rtrim(substr($value, 0, - strlen($resp)), '.'); // 'A.foo.bar' } + $trie = array_merge_leaves($trie, array($resp => array($rest => NULL)), FALSE); } - if ($blockedonly) { - $tmp = array_keys($progress['is_spam']); - } else { - $tmp = array(); - foreach ($progress['sum'] as $key => $value) { - if (isset($method[$key])) { - $tmp[] = $key . '(' . $value . ')'; + // Format: var_export_shrink() -like output + $result = array(); + ksort_by_domain($trie); + foreach(array_keys($trie) as $key) { + ksort_by_domain($trie[$key]); + if (count($trie[$key]) == 1 && key($trie[$key]) == '') { + // Just one 'responsibility.example.com' + $result[] = ' \'' . $key . '\','; + } else { + // One subdomain-or-host, or several ones + $subs = array(); + foreach(array_keys($trie[$key]) as $sub) { + if ($sub == '') { + $subs[] = $key; // 'example.com' + } else { + $subs[] = $sub . '. '; // 'A.foo.bar. ' + } } + $result[] = ' \'' . $key . '\' => \'' . implode(', ', $subs) . '\','; } + unset($trie[$key]); } - - return implode(', ', $tmp); + return + 'array (' . "\n" . + implode("\n", $result) . "\n" . + ')'; } + // --------------------- // Exit +// Freeing memories +function spam_dispose() +{ + get_blocklist(NULL); + whois_responsibility(NULL); +} + // Common bahavior for blocking // NOTE: Call this function from various blocking feature, to disgueise the reason 'why blocked' -function spam_exit() +function spam_exit($mode = '', $data = array()) { - die("\n"); + $exit = TRUE; + + switch ($mode) { + case '': + echo("\n"); + break; + case 'dump': + echo('
' . "\n");
+			echo htmlsc(var_export($data, TRUE));
+			echo('
' . "\n"); + break; + }; + + if ($exit) exit; // Force exit } @@ -886,17 +678,23 @@ function spam_exit() // TODO: Record them // Simple/fast spam filter ($target: 'a string' or an array()) -function pkwk_spamfilter($action, $page, $target = array('title' => ''), $method = array()) +function pkwk_spamfilter($action, $page, $target = array('title' => ''), $method = array(), $exitmode = '') { - global $notify; - $progress = check_uri_spam($target, $method); - if (! empty($progress['is_spam'])) { - // Mail to administrator(s) - if ($notify) pkwk_spamnotify($action, $page, $target, $progress, $method); - // End - spam_exit(); + if (empty($progress['is_spam'])) { + spam_dispose(); + } else { + +// TODO: detect encoding from $target for mbstring functions +// $tmp = array(); +// foreach(array_keys($target) as $key) { +// $tmp[strings($key, 0, FALSE, TRUE)] = strings($target[$key], 0, FALSE, TRUE); // Removing "\0" etc +// } +// $target = & $tmp; + + pkwk_spamnotify($action, $page, $target, $progress, $method); + spam_exit($exitmode, $progress); } } @@ -906,21 +704,29 @@ function pkwk_spamfilter($action, $page, $target = array('title' => ''), $method // Mail to administrator(s) function pkwk_spamnotify($action, $page, $target = array('title' => ''), $progress = array(), $method = array()) { - global $notify_subject; + global $notify, $notify_subject; - $asap = isset($method['asap']) ? $method['asap'] : TRUE; + if (! $notify) return; - $footer['ACTION'] = 'Blocked by: ' . summarize_spam_progress($progress, TRUE); + $asap = isset($method['asap']); + $summary['ACTION'] = 'Blocked by: ' . summarize_spam_progress($progress, TRUE); if (! $asap) { - $footer['METRICS'] = summarize_spam_progress($progress); + $summary['METRICS'] = summarize_spam_progress($progress); } - $footer['COMMENT'] = $action; - $footer['PAGE'] = '[blocked] ' . $page; - $footer['URI'] = get_script_uri() . '?' . rawurlencode($page); - $footer['USER_AGENT'] = TRUE; - $footer['REMOTE_ADDR'] = TRUE; - pkwk_mail_notify($notify_subject, var_export($target, TRUE), $footer); + + $tmp = summarize_detail_badhost($progress); + if ($tmp != '') $summary['DETAIL_BADHOST'] = $tmp; + + $tmp = summarize_detail_newtral($progress); + if (! $asap && $tmp != '') $summary['DETAIL_NEUTRAL_HOST'] = $tmp; + + $summary['COMMENT'] = $action; + $summary['PAGE'] = '[blocked] ' . (is_pagename($page) ? $page : ''); + $summary['URI'] = get_script_uri() . '?' . rawurlencode($page); + $summary['USER_AGENT'] = TRUE; + $summary['REMOTE_ADDR'] = TRUE; + pkwk_mail_notify($notify_subject, var_export($target, TRUE), $summary, TRUE); } ?>