@@ -17,89 +17,89 @@ |
||
| 17 | 17 | * @package OC\Security\Normalizer |
| 18 | 18 | */ |
| 19 | 19 | class IpAddress { |
| 20 | - /** |
|
| 21 | - * @param string $ip IP to normalize |
|
| 22 | - */ |
|
| 23 | - public function __construct( |
|
| 24 | - private string $ip, |
|
| 25 | - ) { |
|
| 26 | - } |
|
| 20 | + /** |
|
| 21 | + * @param string $ip IP to normalize |
|
| 22 | + */ |
|
| 23 | + public function __construct( |
|
| 24 | + private string $ip, |
|
| 25 | + ) { |
|
| 26 | + } |
|
| 27 | 27 | |
| 28 | - /** |
|
| 29 | - * Return the given subnet for an IPv6 address |
|
| 30 | - * Rely on security.ipv6_normalized_subnet_size, defaults to 56 |
|
| 31 | - */ |
|
| 32 | - private function getIPv6Subnet(string $ip): string { |
|
| 33 | - if ($ip[0] === '[' && $ip[-1] === ']') { // If IP is with brackets, for example [::1] |
|
| 34 | - $ip = substr($ip, 1, strlen($ip) - 2); |
|
| 35 | - } |
|
| 36 | - $pos = strpos($ip, '%'); // if there is an explicit interface added to the IP, e.g. fe80::ae2d:d1e7:fe1e:9a8d%enp2s0 |
|
| 37 | - if ($pos !== false) { |
|
| 38 | - $ip = substr($ip, 0, $pos - 1); |
|
| 39 | - } |
|
| 28 | + /** |
|
| 29 | + * Return the given subnet for an IPv6 address |
|
| 30 | + * Rely on security.ipv6_normalized_subnet_size, defaults to 56 |
|
| 31 | + */ |
|
| 32 | + private function getIPv6Subnet(string $ip): string { |
|
| 33 | + if ($ip[0] === '[' && $ip[-1] === ']') { // If IP is with brackets, for example [::1] |
|
| 34 | + $ip = substr($ip, 1, strlen($ip) - 2); |
|
| 35 | + } |
|
| 36 | + $pos = strpos($ip, '%'); // if there is an explicit interface added to the IP, e.g. fe80::ae2d:d1e7:fe1e:9a8d%enp2s0 |
|
| 37 | + if ($pos !== false) { |
|
| 38 | + $ip = substr($ip, 0, $pos - 1); |
|
| 39 | + } |
|
| 40 | 40 | |
| 41 | - $config = \OCP\Server::get(IConfig::class); |
|
| 42 | - $maskSize = min(64, $config->getSystemValueInt('security.ipv6_normalized_subnet_size', 56)); |
|
| 43 | - $maskSize = max(32, $maskSize); |
|
| 44 | - if (PHP_INT_SIZE === 4) { |
|
| 45 | - if ($maskSize === 64) { |
|
| 46 | - $value = -1; |
|
| 47 | - } elseif ($maskSize === 63) { |
|
| 48 | - $value = PHP_INT_MAX; |
|
| 49 | - } else { |
|
| 50 | - $value = (1 << $maskSize - 32) - 1; |
|
| 51 | - } |
|
| 52 | - // as long as we support 32bit PHP we cannot use the `P` pack formatter (and not overflow 32bit integer) |
|
| 53 | - $mask = pack('VVVV', -1, $value, 0, 0); |
|
| 54 | - } else { |
|
| 55 | - $mask = pack('VVP', (1 << 32) - 1, (1 << $maskSize - 32) - 1, 0); |
|
| 56 | - } |
|
| 41 | + $config = \OCP\Server::get(IConfig::class); |
|
| 42 | + $maskSize = min(64, $config->getSystemValueInt('security.ipv6_normalized_subnet_size', 56)); |
|
| 43 | + $maskSize = max(32, $maskSize); |
|
| 44 | + if (PHP_INT_SIZE === 4) { |
|
| 45 | + if ($maskSize === 64) { |
|
| 46 | + $value = -1; |
|
| 47 | + } elseif ($maskSize === 63) { |
|
| 48 | + $value = PHP_INT_MAX; |
|
| 49 | + } else { |
|
| 50 | + $value = (1 << $maskSize - 32) - 1; |
|
| 51 | + } |
|
| 52 | + // as long as we support 32bit PHP we cannot use the `P` pack formatter (and not overflow 32bit integer) |
|
| 53 | + $mask = pack('VVVV', -1, $value, 0, 0); |
|
| 54 | + } else { |
|
| 55 | + $mask = pack('VVP', (1 << 32) - 1, (1 << $maskSize - 32) - 1, 0); |
|
| 56 | + } |
|
| 57 | 57 | |
| 58 | - $binary = \inet_pton($ip); |
|
| 59 | - return inet_ntop($binary & $mask) . '/' . $maskSize; |
|
| 60 | - } |
|
| 58 | + $binary = \inet_pton($ip); |
|
| 59 | + return inet_ntop($binary & $mask) . '/' . $maskSize; |
|
| 60 | + } |
|
| 61 | 61 | |
| 62 | - /** |
|
| 63 | - * Returns the IPv4 address embedded in an IPv6 if applicable. |
|
| 64 | - * The detected format is "::ffff:x.x.x.x" using the binary form. |
|
| 65 | - * |
|
| 66 | - * @return string|null embedded IPv4 string or null if none was found |
|
| 67 | - */ |
|
| 68 | - private function getEmbeddedIpv4(string $ipv6): ?string { |
|
| 69 | - $binary = inet_pton($ipv6); |
|
| 70 | - if (!$binary) { |
|
| 71 | - return null; |
|
| 72 | - } |
|
| 62 | + /** |
|
| 63 | + * Returns the IPv4 address embedded in an IPv6 if applicable. |
|
| 64 | + * The detected format is "::ffff:x.x.x.x" using the binary form. |
|
| 65 | + * |
|
| 66 | + * @return string|null embedded IPv4 string or null if none was found |
|
| 67 | + */ |
|
| 68 | + private function getEmbeddedIpv4(string $ipv6): ?string { |
|
| 69 | + $binary = inet_pton($ipv6); |
|
| 70 | + if (!$binary) { |
|
| 71 | + return null; |
|
| 72 | + } |
|
| 73 | 73 | |
| 74 | - $mask = inet_pton('::FFFF:FFFF'); |
|
| 75 | - if (($binary & ~$mask) !== inet_pton('::FFFF:0.0.0.0')) { |
|
| 76 | - return null; |
|
| 77 | - } |
|
| 74 | + $mask = inet_pton('::FFFF:FFFF'); |
|
| 75 | + if (($binary & ~$mask) !== inet_pton('::FFFF:0.0.0.0')) { |
|
| 76 | + return null; |
|
| 77 | + } |
|
| 78 | 78 | |
| 79 | - return inet_ntop(substr($binary, -4)); |
|
| 80 | - } |
|
| 79 | + return inet_ntop(substr($binary, -4)); |
|
| 80 | + } |
|
| 81 | 81 | |
| 82 | 82 | |
| 83 | - /** |
|
| 84 | - * Gets either the /32 (IPv4) or the /56 (default for IPv6) subnet of an IP address |
|
| 85 | - */ |
|
| 86 | - public function getSubnet(): string { |
|
| 87 | - if (filter_var($this->ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) { |
|
| 88 | - return $this->ip . '/32'; |
|
| 89 | - } |
|
| 83 | + /** |
|
| 84 | + * Gets either the /32 (IPv4) or the /56 (default for IPv6) subnet of an IP address |
|
| 85 | + */ |
|
| 86 | + public function getSubnet(): string { |
|
| 87 | + if (filter_var($this->ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) { |
|
| 88 | + return $this->ip . '/32'; |
|
| 89 | + } |
|
| 90 | 90 | |
| 91 | - $ipv4 = $this->getEmbeddedIpv4($this->ip); |
|
| 92 | - if ($ipv4 !== null) { |
|
| 93 | - return $ipv4 . '/32'; |
|
| 94 | - } |
|
| 91 | + $ipv4 = $this->getEmbeddedIpv4($this->ip); |
|
| 92 | + if ($ipv4 !== null) { |
|
| 93 | + return $ipv4 . '/32'; |
|
| 94 | + } |
|
| 95 | 95 | |
| 96 | - return $this->getIPv6Subnet($this->ip); |
|
| 97 | - } |
|
| 96 | + return $this->getIPv6Subnet($this->ip); |
|
| 97 | + } |
|
| 98 | 98 | |
| 99 | - /** |
|
| 100 | - * Returns the specified IP address |
|
| 101 | - */ |
|
| 102 | - public function __toString(): string { |
|
| 103 | - return $this->ip; |
|
| 104 | - } |
|
| 99 | + /** |
|
| 100 | + * Returns the specified IP address |
|
| 101 | + */ |
|
| 102 | + public function __toString(): string { |
|
| 103 | + return $this->ip; |
|
| 104 | + } |
|
| 105 | 105 | } |