Proxy

[phat_hip_prog]

Hi, I need to check for use of proxies for authenticity. So far i'm playing with:

print 'HTTP_X_FORWARDED_FOR: '.$_SERVER['HTTP_X_FORWARDED_FOR'].'<br>';
print 'force-proxy-request-1_0: '.$_SERVER['force-proxy-request-1_0'].'<br>';
print 'HTTP_VIA: '.$_SERVER['HTTP_VIA'].'<br>';
print 'HTTP_PROXY_CONNECTION: '.$_SERVER['HTTP_PROXY_CONNECTION'].'<br>';

 

But i've just found the following:

if (isset($_SERVER['REMOTE_ADDR']))
{
    $remoteaddr = $_SERVER['REMOTE_ADDR'];
    $ipaddr = $remoteaddr;

    if (IsSet($_SERVER['HTTP_X_FORWARDED_FOR']) 
            && is_ipaddress($_SERVER['HTTP_X_FORWARDED_FOR']))
    {
        $ipaddr = $_SERVER['HTTP_X_FORWARDED_FOR'];
    }

    if (IsSet($_SERVER['HTTP_VIA']) 
            && is_ipaddress($_SERVER['HTTP_VIA']))
    {
        $ipaddr = $_SERVER['HTTP_VIA'];
    }

    if (IsSet($_SERVER['HTTP_PROXY_CONNECTION']) 
            && is_ipaddress($_SERVER['HTTP_PROXY_CONNECTION']))
    {
        $ipaddr = $_SERVER['HTTP_PROXY_CONNECTION'];
    }

    if (IsSet($ipaddr) && is_ipaddress($ipaddr))
    {
        $remoteaddr = $ipaddr;
    }

    $remoteaddr = $fsdb->escape(htmlentities($remoteaddr));
}

 

Where 'is_ipaddress' is:

function is_ipaddress($ip = "")
{
    $len = strlen($ip);

    if ($len == 0 || $len > 15)
    {
        return false;
    }

    $bad = eregi_replace("([0-9\.]+)", "", $ip);

    if (!empty($bad))
    {
        return false;
    }

    $chunks = explode(".", $ip);
    $count = count($chunks);

    if ($count != 4)
    {
        return false;
    }

    while (list($key, $val) = each($chunks))
    {
        if (ereg("^0", $val))
        {
            return false;
        }

        $num = $val;
        settype($num, "integer");

        if ($num > 255)
        {
            return false;
        }
    }

    return true;
}

 

It all seems to read ok (maybe 4 or 6), yet it basically use's what I had already.

However i'm using tor, but it's not registering as being a proxy, yet google can catch it (do they compile list of exit nodes though?)

 

Does anybody have any other good scripts... I read somewhere that 'X-Forwarded-For' can be a list, is this true...