make is_private_ip resolve hostnames and check all resolved ips

1 files changed, 26 insertions, 20 deletions

diff --git a/it.class b/it.class
index 87ceb9b..e634d44 100644
--- a/it.class
+++ b/it.class
@@ -430,28 +430,34 @@ static function cidr_match($ip, $cidrs)
 
 
 /**
- * check whether an IP address is a private, loopback or link-local address.
- * Supports IPv6 and IPv6
- * @param $ip IP address as string (192.168.42.123,
- *        2a02:169:200:d:0:1337:babe:d00d)
- * @return true if $ip is in a private, loopback or link-local network block
+ * check whether an IP address is a private, loopback, link-local or reserved
+ * address. Supports IPv4 and IPv6
+ * @param $host hostname or IP address as string
+ * @return true if $host is in a private, loopback, link-local or reserved
+ *         network block
  */
-static function is_private_ip($ip)
+static function is_private_ip($host)
 {
-	$private_cidrs = [
-		'10.0.0.0/8',
-		'127.0.0.0/8',
-		'169.254.0.0/16',
-		'172.16.0.0/12',
-		'192.0.0.0/24',
-		'192.168.0.0/16',
-		'198.18.0.0/15',
-		'::1/128',
-		'fc00::/7',
-		'fe80::/64',
-	];
-
-	return it::cidr_match($ip, $private_cidrs);
+	if ($host == filter_var($host, FILTER_VALIDATE_IP))
+		$ips = [$host];
+	else
+	{
+		$ips = [];
+		foreach (dns_get_record($host, DNS_A) as $record)
+			$ips[] = $record['ip'];
+		foreach (dns_get_record($host, DNS_AAAA) as $record)
+			$ips[] = $record['ipv6'];
+	}
+
+	foreach ($ips as $ip)
+	{
+		if ($ip !== filter_var($ip, FILTER_VALIDATE_IP))
+			continue;
+		if ($ip !== filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE))
+			return true;
+	}
+
+	return false;
 }