Adding CIDR support to proxied ip addresses; Fixes #13

src/ClientIp.php

@@ -97,7 +97,7 @@ private function getIp(ServerRequestInterface $request)
 
         $localIp = $this->getLocalIp($request);
 
-        if ($this->proxyIps && !in_array($localIp, $this->proxyIps)) {
+        if ($this->proxyIps && !$this->isInProxiedIps($localIp)) {
             // Local IP address does not point at a known proxy, do not attempt
             // to read proxied IP address.
             return $localIp;
@@ -113,6 +113,36 @@ private function getIp(ServerRequestInterface $request)
         return $localIp;
     }
 
+    /**
+     * checks if the given ip address is in the list of proxied ips provided
+     *
+     * @param  string $ip
+     * @return bool
+     */
+    private function isInProxiedIps(string $ip): bool
+    {
+        foreach ($this->proxyIps as $proxyIp) {
+            if ($ip === $proxyIp || self::isInCIDR($ip, $proxyIp)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static function isInCIDR(string $ip, string $cidr): bool
+    {
+        $tokens = explode('/', $cidr);
+        if (count($tokens) !== 2 || !self::isValid($ip) || !self::isValid($tokens[0]) || !is_numeric($tokens[1])) {
+            return false;
+        }
+
+        $cidr_base = ip2long($tokens[0]);
+        $ip_long = ip2long($ip);
+        $mask = (0xffffffff << intval($tokens[1])) & 0xffffffff;
+
+        return ($cidr_base & $mask) === ($ip_long & $mask);
+    }
+
     /**
      * Returns the IP address from remote service.
      *
@@ -180,7 +210,7 @@ private function getForwardedHeaderIp(string $header)
 
                 $ip = trim(substr($directive, 4));
 
-                if (self::isValid($ip) && !in_array($ip, $this->proxyIps)) {
+                if (self::isValid($ip) && !$this->isInProxiedIps($ip)) {
                     return $ip;
                 }
             }
@@ -195,7 +225,7 @@ private function getForwardedHeaderIp(string $header)
     private function getHeaderIp(string $header)
     {
         foreach (array_reverse(array_map('trim', explode(',', $header))) as $ip) {
-            if (self::isValid($ip) && !in_array($ip, $this->proxyIps)) {
+            if (self::isValid($ip) && !$this->isInProxiedIps($ip)) {
                 return $ip;
             }
         }

tests/ClientIpTest.php

@@ -145,6 +145,24 @@ function ($request) {
         ], $request);
 
         $this->assertEquals('3.3.3.3', (string) $response->getBody());
+
+        $response = Dispatcher::run([
+            (new ClientIp())->proxy(['1.1.0.0/16', '2.2.2.0/8']),
+            function ($request) {
+                echo $request->getAttribute('client-ip');
+            },
+        ], $request);
+
+        $this->assertEquals('3.3.3.3', (string) $response->getBody());
+
+        $response = Dispatcher::run([
+            (new ClientIp())->proxy(['5.5.5.0/12']),
+            function ($request) {
+                echo $request->getAttribute('client-ip');
+            },
+        ], $request);
+
+        $this->assertEquals('1.1.1.1', (string) $response->getBody());
     }
 
     public function testNoRemoteAddr()