<?php
/**
 * Resolve the client IP address behind a reverse proxy.
 *
 * REMOTE_ADDR is the only address PHP can trust unconditionally, and behind
 * Cloudflare or any other reverse proxy it is the proxy's address, not the
 * visitor's. Every hit then hashes to a handful of edge addresses, which
 * collapses the GA4 client ids derived from that hash and makes bot verification
 * impossible -- there is nothing left to check against a vendor's published
 * ranges.
 *
 * Forwarded headers are trivially forged by anyone who can reach the site, so
 * they are honoured only when REMOTE_ADDR proves the request genuinely arrived
 * through a proxy that is entitled to set them:
 *
 * - CF-Connecting-IP, only when REMOTE_ADDR is inside Cloudflare's published
 *   ranges. Cloudflare overwrites this header on every request it proxies, so
 *   within those ranges it cannot be spoofed by the client.
 * - X-Forwarded-For, only when REMOTE_ADDR is one of the proxies the site
 *   administrator has listed. The rightmost address that is not itself a
 *   trusted proxy is taken: everything to its left was appended by a hop the
 *   site has no reason to trust.
 *
 * With no trusted proxy in front, REMOTE_ADDR is returned unchanged and nothing
 * about the site's behaviour changes.
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

final class AI_O_Optimiser_Client_IP {

	/**
	 * Cloudflare's published proxy ranges (https://www.cloudflare.com/ips/).
	 *
	 * Shipped as data rather than fetched: this is consulted on every request,
	 * and a customer site should not make an outbound call to serve a page. The
	 * list changes rarely and is reviewed at each release; a site behind a
	 * newly added range simply falls back to REMOTE_ADDR until it is updated,
	 * which is the safe direction to fail. Override with the
	 * ai_o_optimiser_cloudflare_ranges filter to track a change sooner.
	 *
	 * @return string[]
	 */
	public static function cloudflare_ranges() {
		$ranges = array(
			'173.245.48.0/20',
			'103.21.244.0/22',
			'103.22.200.0/22',
			'103.31.4.0/22',
			'141.101.64.0/18',
			'108.162.192.0/18',
			'190.93.240.0/20',
			'188.114.96.0/20',
			'197.234.240.0/22',
			'198.41.128.0/17',
			'162.158.0.0/15',
			'104.16.0.0/13',
			'104.24.0.0/14',
			'172.64.0.0/13',
			'131.0.72.0/22',
			'2400:cb00::/32',
			'2606:4700::/32',
			'2803:f800::/32',
			'2405:b500::/32',
			'2405:8100::/32',
			'2a06:98c0::/29',
			'2c0f:f248::/32',
		);
		$filtered = apply_filters( 'ai_o_optimiser_cloudflare_ranges', $ranges );
		return is_array( $filtered ) ? array_values( array_filter( array_map( 'strval', $filtered ) ) ) : $ranges;
	}

	/**
	 * Proxy addresses and ranges the site administrator has declared trusted.
	 *
	 * @return string[]
	 */
	public static function trusted_proxies() {
		$settings = get_option( 'ai_o_optimiser_settings', array() );
		$raw      = isset( $settings['trusted_proxies'] ) ? $settings['trusted_proxies'] : '';
		$entries  = self::parse_proxy_list( $raw );
		$filtered = apply_filters( 'ai_o_optimiser_trusted_proxies', $entries );
		return is_array( $filtered ) ? array_values( array_filter( array_map( 'strval', $filtered ) ) ) : $entries;
	}

	/**
	 * Split an administrator-entered proxy list into validated entries.
	 *
	 * Accepts newlines or commas, and both bare addresses and CIDR blocks.
	 * Anything that is not a well-formed address or block is dropped rather
	 * than stored: a typo here would otherwise silently widen who is believed.
	 *
	 * @param string $raw Raw textarea contents.
	 * @return string[]
	 */
	public static function parse_proxy_list( $raw ) {
		$entries = preg_split( '/[\s,]+/', (string) $raw );
		$valid   = array();
		foreach ( (array) $entries as $entry ) {
			$entry = trim( (string) $entry );
			if ( '' === $entry ) {
				continue;
			}
			if ( self::is_valid_range( $entry ) ) {
				$valid[] = $entry;
			}
		}
		return array_values( array_unique( $valid ) );
	}

	/** @return bool Whether a string is a usable address or CIDR block. */
	public static function is_valid_range( $range ) {
		$range = (string) $range;
		if ( false === strpos( $range, '/' ) ) {
			return (bool) filter_var( $range, FILTER_VALIDATE_IP );
		}
		list( $subnet, $bits ) = array_pad( explode( '/', $range, 2 ), 2, '' );
		if ( ! filter_var( $subnet, FILTER_VALIDATE_IP ) || ! preg_match( '/^\d{1,3}$/', (string) $bits ) ) {
			return false;
		}
		$max = filter_var( $subnet, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 ) ? 128 : 32;
		return (int) $bits <= $max;
	}

	/**
	 * The client address for this request, or '' when none can be determined.
	 *
	 * @return string
	 */
	public static function resolve() {
		$remote = isset( $_SERVER['REMOTE_ADDR'] ) ? trim( sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) ) : '';
		if ( ! filter_var( $remote, FILTER_VALIDATE_IP ) ) {
			return '';
		}

		if ( self::in_any_range( $remote, self::cloudflare_ranges() ) ) {
			$forwarded = isset( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ? trim( sanitize_text_field( wp_unslash( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ) ) : '';
			if ( filter_var( $forwarded, FILTER_VALIDATE_IP ) ) {
				return $forwarded;
			}
			return $remote;
		}

		$trusted = self::trusted_proxies();
		if ( empty( $trusted ) || ! self::in_any_range( $remote, $trusted ) ) {
			return $remote;
		}

		$chain = isset( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_X_FORWARDED_FOR'] ) ) : '';
		$hops  = array_filter( array_map( 'trim', explode( ',', $chain ) ) );

		// Walk right to left: each trusted hop is stepped over, and the first
		// address that is not one is the furthest point the chain can be
		// believed to. Anything further left was appended by an untrusted hop.
		while ( ! empty( $hops ) ) {
			$candidate = self::strip_port( (string) array_pop( $hops ) );
			if ( ! filter_var( $candidate, FILTER_VALIDATE_IP ) ) {
				return $remote;
			}
			if ( ! self::in_any_range( $candidate, $trusted ) ) {
				return $candidate;
			}
		}

		return $remote;
	}

	/**
	 * Drop a port suffix from a forwarded address.
	 *
	 * IPv6 in a forwarded chain is bracketed when a port is present, so only a
	 * bracketed form or a single-colon IPv4 form can carry one.
	 *
	 * @param string $address Candidate address.
	 * @return string
	 */
	private static function strip_port( $address ) {
		$address = trim( (string) $address );
		if ( '' === $address ) {
			return '';
		}
		if ( '[' === $address[0] ) {
			$close = strpos( $address, ']' );
			return false === $close ? $address : substr( $address, 1, $close - 1 );
		}
		if ( 1 === substr_count( $address, ':' ) ) {
			return strtok( $address, ':' );
		}
		return $address;
	}

	/**
	 * @param string   $ip     Address to test.
	 * @param string[] $ranges Addresses or CIDR blocks.
	 * @return bool
	 */
	public static function in_any_range( $ip, $ranges ) {
		foreach ( (array) $ranges as $range ) {
			if ( self::in_range( $ip, $range ) ) {
				return true;
			}
		}
		return false;
	}

	/**
	 * Whether an address falls inside one address or CIDR block.
	 *
	 * Compares packed binary forms, so IPv4 and IPv6 use the same path and a
	 * mismatched pair (an IPv4 address against an IPv6 block) simply fails on
	 * length rather than producing a false positive.
	 *
	 * @param string $ip    Address to test.
	 * @param string $range Address or CIDR block.
	 * @return bool
	 */
	public static function in_range( $ip, $range ) {
		$ip    = trim( (string) $ip );
		$range = trim( (string) $range );
		if ( '' === $ip || '' === $range ) {
			return false;
		}

		if ( false === strpos( $range, '/' ) ) {
			return self::normalise( $ip ) === self::normalise( $range ) && '' !== self::normalise( $ip );
		}

		list( $subnet, $bits ) = array_pad( explode( '/', $range, 2 ), 2, '' );
		if ( ! preg_match( '/^\d{1,3}$/', (string) $bits ) ) {
			return false;
		}
		$bits = (int) $bits;

		$packed_ip     = @inet_pton( $ip );     // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- a malformed address is a false, not a warning.
		$packed_subnet = @inet_pton( $subnet ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- same.
		if ( false === $packed_ip || false === $packed_subnet ) {
			return false;
		}
		// An IPv4 address is never inside an IPv6 block, and vice versa.
		if ( strlen( $packed_ip ) !== strlen( $packed_subnet ) ) {
			return false;
		}
		if ( $bits > strlen( $packed_ip ) * 8 ) {
			return false;
		}
		if ( 0 === $bits ) {
			return true;
		}

		$whole_bytes = intdiv( $bits, 8 );
		$rest_bits   = $bits % 8;

		if ( $whole_bytes > 0 && substr( $packed_ip, 0, $whole_bytes ) !== substr( $packed_subnet, 0, $whole_bytes ) ) {
			return false;
		}
		if ( 0 === $rest_bits ) {
			return true;
		}

		$mask = ~( ( 1 << ( 8 - $rest_bits ) ) - 1 ) & 0xFF;
		return ( ord( $packed_ip[ $whole_bytes ] ) & $mask ) === ( ord( $packed_subnet[ $whole_bytes ] ) & $mask );
	}

	/**
	 * Canonical binary form of an address, for equality comparison.
	 *
	 * @param string $ip Address.
	 * @return string Packed form, or '' when the address is malformed.
	 */
	private static function normalise( $ip ) {
		$packed = @inet_pton( trim( (string) $ip ) ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- a malformed address is a '', not a warning.
		return false === $packed ? '' : $packed;
	}
}