adding trace

trace.php

@@ -0,0 +1,414 @@
+<?php
+declare(strict_types=1);
+
+const PING_COUNT     = 4;   // ICMP echo requests per ping run
+const PING_WAIT      = 2;   // seconds to wait for each reply
+const TRACE_MAX_HOPS = 30;  // RFC-ish practical ceiling, matches traceroute's default
+const TRACE_QUERIES  = 2;   // probes per hop — 3 is the default, 2 keeps the page snappy
+const TRACE_WAIT     = 2;   // seconds to wait for a hop to answer
+const CMD_TIMEOUT    = 25;  // hard wall-clock cap so a request can never hang the worker
+
+/** Record types offered for the DNS mode. PTR is handled via dig -x. */
+const DNS_TYPES = ['A', 'AAAA', 'MX', 'TXT', 'NS', 'CNAME', 'SOA', 'CAA', 'SRV', 'DS', 'DNSKEY', 'PTR', 'ANY'];
+
+/**
+ * Runs a command under `timeout` and returns its combined output.
+ * Every argument is escaped individually — nothing user-supplied ever reaches a shell
+ * as syntax, only as a single argv entry.
+ *
+ * @param string[] $args
+ * @return array{command:string,output:string,code:int}
+ */
+function runCommand(string $binary, array $args): array
+{
+    $command = 'timeout ' . CMD_TIMEOUT . ' ' . escapeshellarg($binary);
+    foreach ($args as $arg) {
+        $command .= ' ' . escapeshellarg((string) $arg);
+    }
+
+    $output = [];
+    $code = 0;
+    exec($command . ' 2>&1', $output, $code);
+
+    $text = implode("\n", $output);
+    if ($code === 124) {
+        $text .= ($text === '' ? '' : "\n") . '--- aborted: exceeded the ' . CMD_TIMEOUT . 's time limit ---';
+    } elseif ($code === 127) {
+        $text = 'The "' . $binary . '" command is not installed on this server.';
+    }
+
+    // Display the command without the timeout wrapper — that is plumbing, not diagnostics.
+    $display = $binary;
+    foreach ($args as $arg) {
+        $display .= ' ' . (string) $arg;
+    }
+
+    return ['command' => $display, 'output' => $text, 'code' => $code];
+}
+
+function performPing(string $target): array
+{
+    return runCommand('ping', ['-c', (string) PING_COUNT, '-W', (string) PING_WAIT, $target]);
+}
+
+function performTraceroute(string $target): array
+{
+    return runCommand('traceroute', [
+        '-m', (string) TRACE_MAX_HOPS,
+        '-q', (string) TRACE_QUERIES,
+        '-w', (string) TRACE_WAIT,
+        $target,
+    ]);
+}
+
+function performDns(string $target, string $type, string $resolver): array
+{
+    $args = [];
+    if ($resolver !== '') {
+        $args[] = '@' . $resolver;
+    }
+
+    if ($type === 'PTR' && filter_var($target, FILTER_VALIDATE_IP)) {
+        $args[] = '-x';
+        $args[] = $target;
+    } else {
+        $args[] = $target;
+        $args[] = $type;
+    }
+    $args[] = '+timeout=3';
+    $args[] = '+tries=2';
+
+    return runCommand('dig', $args);
+}
+
+/**
+ * Pulls the responding IP out of each traceroute hop line so the hops can be
+ * enriched the same way spf-check.php and mail-delivery-check.php enrich theirs.
+ *
+ * @return array<int,array{hop:string,host:string,ip:string}>
+ */
+function parseTracerouteHops(string $output): array
+{
+    $hops = [];
+    foreach (explode("\n", $output) as $line) {
+        if (!preg_match('/^\s*(\d+)\s+(.*)$/', $line, $m)) {
+            continue;
+        }
+        $rest = trim($m[2]);
+        $first = explode(' ', $rest)[0];
+
+        // A hop reads either "host (ip)  1.2 ms" or "ip  1.2 ms", or "* * *" when it stays silent.
+        if (preg_match('/\(([0-9a-fA-F:.]+)\)/', $rest, $paren)) {
+            $ip = $paren[1];
+        } else {
+            $ip = $first;
+        }
+        if (!filter_var($ip, FILTER_VALIDATE_IP)) {
+            continue;
+        }
+
+        $hops[] = ['hop' => $m[1], 'host' => $first === $ip ? '' : $first, 'ip' => $ip];
+    }
+    return $hops;
+}
+
+/**
+ * Enriches IPs with ASN / country / company via ip-api.com's free batch endpoint.
+ * @param string[] $ips
+ * @return array<string,array>
+ */
+function lookupIpInfo(array $ips): array
+{
+    $out = [];
+    $ips = array_values(array_unique(array_filter($ips)));
+    if (empty($ips)) {
+        return $out;
+    }
+    $fields = 'query,status,message,country,countryCode,as,asname,isp,org,city,regionName,reverse';
+    foreach (array_chunk($ips, 100) as $chunk) {
+        $payload = array_map(static fn($ip) => ['query' => $ip, 'fields' => $fields], $chunk);
+        $ch = curl_init('http://ip-api.com/batch');
+        curl_setopt_array($ch, [
+            CURLOPT_POST => true,
+            CURLOPT_POSTFIELDS => json_encode($payload),
+            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_TIMEOUT => 20,
+        ]);
+        $resp = curl_exec($ch);
+        curl_close($ch);
+        foreach ((json_decode((string) $resp, true) ?: []) as $item) {
+            if (isset($item['query'])) {
+                $out[$item['query']] = $item;
+            }
+        }
+    }
+    return $out;
+}
+
+/** True for addresses that are not routable on the public internet. */
+function isReservedIp(string $ip): bool
+{
+    return filter_var(
+        $ip,
+        FILTER_VALIDATE_IP,
+        FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
+    ) === false;
+}
+
+/** @return string[] */
+function resolveHost(string $host): array
+{
+    $ips = [];
+    foreach ((@dns_get_record($host, DNS_A) ?: []) as $r) {
+        if (!empty($r['ip'])) {
+            $ips[] = $r['ip'];
+        }
+    }
+    foreach ((@dns_get_record($host, DNS_AAAA) ?: []) as $r) {
+        if (!empty($r['ipv6'])) {
+            $ips[] = $r['ipv6'];
+        }
+    }
+    return $ips;
+}
+
+$target   = trim((string) ($_GET['target'] ?? ''));
+$action   = (string) ($_GET['action'] ?? 'ping');
+$dnsType  = strtoupper(trim((string) ($_GET['type'] ?? 'A')));
+$resolver = strtolower(trim((string) ($_GET['resolver'] ?? '')));
+
+$inputError = null;
+$result     = null;
+$hops       = [];
+$hopInfo    = [];
+
+if (!in_array($action, ['ping', 'traceroute', 'dns'], true)) {
+    $action = 'ping';
+}
+if (!in_array($dnsType, DNS_TYPES, true)) {
+    $dnsType = 'A';
+}
+
+if ($target !== '') {
+    $target = strtolower(rtrim($target, '.'));
+    $isIp = (bool) filter_var($target, FILTER_VALIDATE_IP);
+
+    if (!$isIp && !preg_match('/^(?=.{1,253}$)([a-z0-9](-?[a-z0-9])*\.)+[a-z]{2,}$/', $target)) {
+        $inputError = 'Please enter a valid hostname (e.g. example.com) or IP address (e.g. 8.8.8.8).';
+    } elseif ($resolver !== ''
+        && !filter_var($resolver, FILTER_VALIDATE_IP)
+        && !preg_match('/^(?=.{1,253}$)([a-z0-9](-?[a-z0-9])*\.)+[a-z]{2,}$/', $resolver)) {
+        $inputError = 'The resolver must be an IP address (e.g. 9.9.9.9) or a hostname.';
+    } elseif ($isIp && isReservedIp($target)) {
+        $inputError = 'Private, loopback and reserved addresses cannot be probed from this tool.';
+    } elseif ($resolver !== '' && filter_var($resolver, FILTER_VALIDATE_IP) && isReservedIp($resolver)) {
+        $inputError = 'Private, loopback and reserved addresses cannot be used as a resolver.';
+    } elseif ($action === 'dns' && $dnsType === 'PTR' && !$isIp) {
+        $inputError = 'A PTR lookup needs an IP address as the target.';
+    }
+
+    // A hostname that only resolves into reserved space is the same problem one step removed.
+    if ($inputError === null && !$isIp) {
+        $resolved = resolveHost($target);
+        if (!empty($resolved) && count(array_filter($resolved, 'isReservedIp')) === count($resolved)) {
+            $inputError = 'That hostname only resolves to private or reserved addresses, which cannot be probed.';
+        }
+    }
+
+    if ($inputError === null) {
+        if ($action === 'ping') {
+            $result = performPing($target);
+        } elseif ($action === 'traceroute') {
+            $result = performTraceroute($target);
+            $hops = parseTracerouteHops($result['output']);
+            $hopInfo = lookupIpInfo(array_column($hops, 'ip'));
+        } else {
+            $result = performDns($target, $dnsType, $resolver);
+        }
+    }
+}
+
+$clientIp = (string) ($_SERVER['REMOTE_ADDR'] ?? '');
+$clientInfo = $clientIp !== '' && !isReservedIp($clientIp) ? (lookupIpInfo([$clientIp])[$clientIp] ?? null) : null;
+?>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Network Trace</title>
+    <style>
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            max-width: 1200px;
+            margin: 40px auto;
+            padding: 0 20px;
+            background: #f5f5f5;
+            color: #333;
+        }
+        h1 { color: #333; }
+        h2 { color: #333; margin-top: 30px; }
+        .info { background: #e3f2fd; padding: 15px; border-radius: 5px; margin-bottom: 20px; }
+        form.lookup { margin-bottom: 20px; display: flex; gap: 10px; flex-wrap: wrap; align-items: center; }
+        input[type=text] {
+            flex: 1; min-width: 240px; padding: 10px; font-size: 15px;
+            border: 1px solid #ccc; border-radius: 5px;
+        }
+        select {
+            padding: 10px; font-size: 15px; border: 1px solid #ccc;
+            border-radius: 5px; background: white;
+        }
+        .btn {
+            display: inline-block; padding: 10px 20px; background: #2196F3; color: white;
+            text-decoration: none; border-radius: 5px; border: none; cursor: pointer; font-size: 15px;
+        }
+        .btn:hover { background: #1976D2; }
+        .error { background: #ffebee; color: #c62828; padding: 10px; border-radius: 5px; margin: 10px 0; }
+        .warning {
+            background: #fff8e1; color: #e65100; padding: 12px 15px; border-radius: 5px;
+            margin: 10px 0; border-left: 5px solid #ff9800;
+        }
+        .output {
+            background: #263238; color: #aed581; padding: 15px; border-radius: 4px;
+            font-family: monospace; font-size: 13px; white-space: pre-wrap;
+            word-break: break-all; margin: 10px 0; line-height: 1.5;
+        }
+        .command {
+            font-family: monospace; font-size: 12px; color: #888; margin-bottom: 4px;
+        }
+        table { width: 100%; border-collapse: collapse; background: white; box-shadow: 0 1px 3px rgba(0,0,0,0.1); margin-top: 10px; }
+        th, td { padding: 10px 12px; text-align: left; border-bottom: 1px solid #ddd; font-size: 13px; }
+        th { background: #2196F3; color: white; }
+        tr:hover { background: #f5f5f5; }
+        td.ip { font-family: monospace; }
+        .empty { text-align: center; color: #999; padding: 40px; }
+        .muted { color: #888; font-size: 12px; }
+        .self { background: white; padding: 12px 15px; border-radius: 5px; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+        .self strong { color: #333; }
+        .hidden { display: none; }
+    </style>
+</head>
+<body>
+    <h1>📡 Network Trace</h1>
+
+    <div class="info">
+        Runs <strong>ping</strong>, <strong>traceroute</strong> and <strong>DNS</strong> lookups from this server
+        against a public host, and enriches every traceroute hop with its
+        <strong>ASN, country and company</strong>. Probes are capped at
+        <?= CMD_TIMEOUT ?>s and <?= TRACE_MAX_HOPS ?> hops.
+    </div>
+
+    <form class="lookup" method="GET">
+        <input type="text" name="target" placeholder="example.com or 8.8.8.8"
+               value="<?= htmlspecialchars($target) ?>" autofocus>
+        <select name="action" id="action">
+            <option value="ping"       <?= $action === 'ping' ? 'selected' : '' ?>>Ping</option>
+            <option value="traceroute" <?= $action === 'traceroute' ? 'selected' : '' ?>>Traceroute</option>
+            <option value="dns"        <?= $action === 'dns' ? 'selected' : '' ?>>DNS Query</option>
+        </select>
+        <select name="type" id="type" class="<?= $action === 'dns' ? '' : 'hidden' ?>">
+            <?php foreach (DNS_TYPES as $t): ?>
+                <option value="<?= $t ?>" <?= $dnsType === $t ? 'selected' : '' ?>><?= $t ?></option>
+            <?php endforeach; ?>
+        </select>
+        <input type="text" name="resolver" id="resolver" class="<?= $action === 'dns' ? '' : 'hidden' ?>"
+               style="flex: 0 1 160px; min-width: 120px;" placeholder="resolver (optional)"
+               value="<?= htmlspecialchars($resolver) ?>">
+        <button type="submit" class="btn">🔍 Run</button>
+    </form>
+
+    <?php if ($inputError): ?>
+        <div class="error"><?= htmlspecialchars($inputError) ?></div>
+    <?php endif; ?>
+
+    <?php if ($result !== null): ?>
+        <h2>
+            <?= $action === 'dns' ? htmlspecialchars($dnsType) . ' lookup' : ucfirst($action) ?>
+            — <?= htmlspecialchars($target) ?>
+        </h2>
+        <div class="command"><?= htmlspecialchars($result['command']) ?></div>
+        <div class="output"><?= htmlspecialchars($result['output'] !== '' ? $result['output'] : '(no output)') ?></div>
+        <?php if ($result['code'] !== 0 && $result['code'] !== 124): ?>
+            <div class="warning">⚠️ The command exited with code <?= (int) $result['code'] ?>.</div>
+        <?php endif; ?>
+
+        <?php if ($action === 'traceroute' && !empty($hops)): ?>
+            <h2>Hops (<?= count($hops) ?>)</h2>
+            <table>
+                <thead>
+                    <tr>
+                        <th>#</th>
+                        <th>IP</th>
+                        <th>Reverse DNS</th>
+                        <th>ASN</th>
+                        <th>Company / ISP</th>
+                        <th>Country</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php foreach ($hops as $hop): ?>
+                        <?php
+                            $info = $hopInfo[$hop['ip']] ?? null;
+                            $ok = $info && ($info['status'] ?? '') === 'success';
+                            $asn = $ok ? ($info['as'] ?: '—') : '—';
+                            $company = $ok ? ($info['org'] ?: ($info['isp'] ?? '') ?: ($info['asname'] ?? '')) : '';
+                            $country = $ok ? trim(($info['country'] ?? '') . ' ' . ($info['countryCode'] ?? '')) : '';
+                            $rdns = $hop['host'] !== '' ? $hop['host'] : ($ok ? ($info['reverse'] ?? '') : '');
+                        ?>
+                        <tr>
+                            <td><?= htmlspecialchars($hop['hop']) ?></td>
+                            <td class="ip"><?= htmlspecialchars($hop['ip']) ?></td>
+                            <td><?= htmlspecialchars($rdns !== '' ? $rdns : '—') ?></td>
+                            <td><?= htmlspecialchars($asn) ?></td>
+                            <td><?= htmlspecialchars($company !== '' ? $company : '—') ?></td>
+                            <td><?= htmlspecialchars($country !== '' ? $country : '—') ?></td>
+                        </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+            <p class="muted" style="margin-top: 10px;">
+                Hops answering with <code>* * *</code> are omitted from this table.
+                IP intelligence via ip-api.com (free tier).
+            </p>
+        <?php endif; ?>
+    <?php elseif ($inputError === null): ?>
+        <div class="empty">Enter a hostname or IP address above to run a probe.</div>
+    <?php endif; ?>
+
+    <h2>Your connection</h2>
+    <div class="self">
+        <p><strong>IP address:</strong> <?= htmlspecialchars($clientIp !== '' ? $clientIp : 'unknown') ?></p>
+        <?php if ($clientInfo && ($clientInfo['status'] ?? '') === 'success'): ?>
+            <p><strong>ISP:</strong> <?= htmlspecialchars($clientInfo['isp'] ?: '—') ?></p>
+            <?php if (!empty($clientInfo['as'])): ?>
+                <p><strong>ASN:</strong> <?= htmlspecialchars($clientInfo['as']) ?></p>
+            <?php endif; ?>
+            <?php
+                $location = implode(', ', array_filter([
+                    $clientInfo['city'] ?? '',
+                    $clientInfo['regionName'] ?? '',
+                    $clientInfo['country'] ?? '',
+                ]));
+            ?>
+            <?php if ($location !== ''): ?>
+                <p><strong>Location:</strong> <?= htmlspecialchars($location) ?></p>
+            <?php endif; ?>
+        <?php else: ?>
+            <p class="muted">No public IP intelligence available for this address.</p>
+        <?php endif; ?>
+    </div>
+
+    <script>
+        // Show the DNS-only controls when the DNS mode is selected.
+        var action = document.getElementById('action');
+        function syncDnsFields() {
+            var isDns = action.value === 'dns';
+            document.getElementById('type').classList.toggle('hidden', !isDns);
+            document.getElementById('resolver').classList.toggle('hidden', !isDns);
+        }
+        action.addEventListener('change', syncDnsFields);
+        syncDnsFields();
+    </script>
+</body>
+</html>