iplist/docs/intersection

intersection.php — replace.cidr4 key seeder

Для русской версии: README.md

A one-off PHP script: walks every portal config under config/<group>/<portal>.json and, for every portal whose cidr4 contains any zone listed in cidr4.txt, adds that zone as a key in replace.cidr4 with an empty [] value.

Used to bulk-mark portals that share "wide" CIDR zones (e.g. 172.217.0.0/16 between google and yandex) — for the feature itself see ../REPLACE.en.md.

What the script actually does

1. Reads cidr4.txt — one CIDR per line. Blank lines and lines starting with # are skipped.
2. Recursively walks config/*/*.json.
3. For each portal: if its cidr4 contains any zone from the list, the script adds each such zone as a key in replace.cidr4 with an empty [] value (if the key isn't there already).
4. Materialises the canonical replace: {cidr4: {...}, cidr6: {}} shape when the portal had no replace block before.
5. Rewrites the portal JSON in the exact key order the server itself uses via Site::saveConfig.

Idempotent. Running it again is a no-op. Value arrays already populated by prior reload cycles are never overwritten.

How to run

Run from the project root:

# Direct
php docs/intersection/intersection.php

# Through docker compose
docker compose run --rm app php docs/intersection/intersection.php

The script bumps the memory limit to 4 GB (ini_set('memory_limit', '4048M')) so it can process heavy configs like Adobe / Amazon with thousands of domains.

cidr4.txt format

One CIDR zone per line, in exactly the form it appears in the portals' cidr4 arrays (the comparison is byte-for-byte, no normalisation). Blank lines and # comments are skipped:

# Akamai
23.32.0.0/11
23.192.0.0/11
104.64.0.0/10

# Google
172.217.0.0/16
216.58.192.0/19

What happens next

Restart the server. On the next reload cycle, with SYS_REPLACE_ESCALATE_IPS=true (the default), the empty value arrays will fill up with /32 entries pulled from each portal's ip4. If SYS_REPLACE_AGGREGATE_SUBNETS=true and the SYS_REPLACE_COLLAPSE_THRESHOLD_* thresholds are set, supernet aggregation and density collapse will also kick in. Full story in ../REPLACE.en.md.

Guards against malformed input

• Config file whose top level is not an object — skipped with a message on stderr.
• replace, replace.cidr4, or replace.cidr6 present but not an object — skipped with a message. Hand-broken structures are flagged, not silently overwritten.
• Empty or missing cidr4 on a portal — portal is left alone.
• A zone from cidr4.txt that doesn't match any portal — silently ignored.

When NOT to run

• If cidr4.txt is actively being edited / under a version-control review — wait until the list stabilises.
• If the server is mid-reload for a large portal — the script could overwrite a config on top of fresh escalation output. Stop the service or wait for a quiet moment.
• Repeatedly "just in case" — the script is idempotent, but file mtimes shift on every run.