40 lines
1.2 KiB
PHP
40 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace Modules\Security\Services;
|
|
|
|
use Modules\Security\Models\IpRule;
|
|
|
|
final class IpRuleService
|
|
{
|
|
public function isBlocked(string $ip, string $scope = 'admin'): bool
|
|
{
|
|
$column = $scope === 'login' ? 'applies_to_login' : 'applies_to_admin';
|
|
$rules = IpRule::query()->where('is_active', true)->where($column, true)->get();
|
|
$allow = $rules->where('type', 'allow');
|
|
if ($allow->isNotEmpty() && ! $allow->contains(fn (IpRule $rule) => $this->matches($ip, $rule->address))) {
|
|
return true;
|
|
}
|
|
|
|
return $rules->where('type', 'deny')->contains(fn (IpRule $rule) => $this->matches($ip, $rule->address));
|
|
}
|
|
|
|
private function matches(string $ip, string $rule): bool
|
|
{
|
|
if ($ip === $rule) {
|
|
return true;
|
|
}
|
|
if (! str_contains($rule, '/')) {
|
|
return false;
|
|
}
|
|
[$subnet,$bits] = explode('/', $rule, 2);
|
|
$bits = (int) $bits;
|
|
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) && filter_var($subnet, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
|
|
$mask = -1 << (32 - $bits);
|
|
|
|
return (ip2long($ip) & $mask) === (ip2long($subnet) & $mask);
|
|
}
|
|
|
|
return false;
|
|
}
|
|
}
|