| 148 |
lars |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
/*
|
|
|
4 |
* This file is part of the Symfony package.
|
|
|
5 |
*
|
|
|
6 |
* (c) Fabien Potencier <fabien@symfony.com>
|
|
|
7 |
*
|
|
|
8 |
* For the full copyright and license information, please view the LICENSE
|
|
|
9 |
* file that was distributed with this source code.
|
|
|
10 |
*/
|
|
|
11 |
|
|
|
12 |
namespace Symfony\Component\HttpFoundation;
|
|
|
13 |
|
|
|
14 |
/**
|
|
|
15 |
* Http utility functions.
|
|
|
16 |
*
|
|
|
17 |
* @author Fabien Potencier <fabien@symfony.com>
|
|
|
18 |
*/
|
|
|
19 |
class IpUtils
|
|
|
20 |
{
|
|
|
21 |
private static array $checkedIps = [];
|
|
|
22 |
|
|
|
23 |
/**
|
|
|
24 |
* This class should not be instantiated.
|
|
|
25 |
*/
|
|
|
26 |
private function __construct()
|
|
|
27 |
{
|
|
|
28 |
}
|
|
|
29 |
|
|
|
30 |
/**
|
|
|
31 |
* Checks if an IPv4 or IPv6 address is contained in the list of given IPs or subnets.
|
|
|
32 |
*
|
|
|
33 |
* @param string|array $ips List of IPs or subnets (can be a string if only a single one)
|
|
|
34 |
*/
|
|
|
35 |
public static function checkIp(string $requestIp, string|array $ips): bool
|
|
|
36 |
{
|
|
|
37 |
if (!\is_array($ips)) {
|
|
|
38 |
$ips = [$ips];
|
|
|
39 |
}
|
|
|
40 |
|
|
|
41 |
$method = substr_count($requestIp, ':') > 1 ? 'checkIp6' : 'checkIp4';
|
|
|
42 |
|
|
|
43 |
foreach ($ips as $ip) {
|
|
|
44 |
if (self::$method($requestIp, $ip)) {
|
|
|
45 |
return true;
|
|
|
46 |
}
|
|
|
47 |
}
|
|
|
48 |
|
|
|
49 |
return false;
|
|
|
50 |
}
|
|
|
51 |
|
|
|
52 |
/**
|
|
|
53 |
* Compares two IPv4 addresses.
|
|
|
54 |
* In case a subnet is given, it checks if it contains the request IP.
|
|
|
55 |
*
|
|
|
56 |
* @param string $ip IPv4 address or subnet in CIDR notation
|
|
|
57 |
*
|
|
|
58 |
* @return bool Whether the request IP matches the IP, or whether the request IP is within the CIDR subnet
|
|
|
59 |
*/
|
|
|
60 |
public static function checkIp4(string $requestIp, string $ip): bool
|
|
|
61 |
{
|
| 991 |
lars |
62 |
$cacheKey = $requestIp.'-'.$ip.'-v4';
|
| 148 |
lars |
63 |
if (isset(self::$checkedIps[$cacheKey])) {
|
|
|
64 |
return self::$checkedIps[$cacheKey];
|
|
|
65 |
}
|
|
|
66 |
|
|
|
67 |
if (!filter_var($requestIp, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4)) {
|
|
|
68 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
69 |
}
|
|
|
70 |
|
|
|
71 |
if (str_contains($ip, '/')) {
|
|
|
72 |
[$address, $netmask] = explode('/', $ip, 2);
|
|
|
73 |
|
|
|
74 |
if ('0' === $netmask) {
|
| 399 |
lars |
75 |
return self::$checkedIps[$cacheKey] = false !== filter_var($address, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV4);
|
| 148 |
lars |
76 |
}
|
|
|
77 |
|
|
|
78 |
if ($netmask < 0 || $netmask > 32) {
|
|
|
79 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
80 |
}
|
|
|
81 |
} else {
|
|
|
82 |
$address = $ip;
|
|
|
83 |
$netmask = 32;
|
|
|
84 |
}
|
|
|
85 |
|
|
|
86 |
if (false === ip2long($address)) {
|
|
|
87 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
88 |
}
|
|
|
89 |
|
|
|
90 |
return self::$checkedIps[$cacheKey] = 0 === substr_compare(sprintf('%032b', ip2long($requestIp)), sprintf('%032b', ip2long($address)), 0, $netmask);
|
|
|
91 |
}
|
|
|
92 |
|
|
|
93 |
/**
|
|
|
94 |
* Compares two IPv6 addresses.
|
|
|
95 |
* In case a subnet is given, it checks if it contains the request IP.
|
|
|
96 |
*
|
|
|
97 |
* @author David Soria Parra <dsp at php dot net>
|
|
|
98 |
*
|
|
|
99 |
* @see https://github.com/dsp/v6tools
|
|
|
100 |
*
|
|
|
101 |
* @param string $ip IPv6 address or subnet in CIDR notation
|
|
|
102 |
*
|
|
|
103 |
* @throws \RuntimeException When IPV6 support is not enabled
|
|
|
104 |
*/
|
|
|
105 |
public static function checkIp6(string $requestIp, string $ip): bool
|
|
|
106 |
{
|
| 991 |
lars |
107 |
$cacheKey = $requestIp.'-'.$ip.'-v6';
|
| 148 |
lars |
108 |
if (isset(self::$checkedIps[$cacheKey])) {
|
|
|
109 |
return self::$checkedIps[$cacheKey];
|
|
|
110 |
}
|
|
|
111 |
|
|
|
112 |
if (!((\extension_loaded('sockets') && \defined('AF_INET6')) || @inet_pton('::1'))) {
|
|
|
113 |
throw new \RuntimeException('Unable to check Ipv6. Check that PHP was not compiled with option "disable-ipv6".');
|
|
|
114 |
}
|
|
|
115 |
|
|
|
116 |
// Check to see if we were given a IP4 $requestIp or $ip by mistake
|
|
|
117 |
if (!filter_var($requestIp, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
|
|
|
118 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
119 |
}
|
|
|
120 |
|
|
|
121 |
if (str_contains($ip, '/')) {
|
|
|
122 |
[$address, $netmask] = explode('/', $ip, 2);
|
|
|
123 |
|
|
|
124 |
if (!filter_var($address, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
|
|
|
125 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
126 |
}
|
|
|
127 |
|
|
|
128 |
if ('0' === $netmask) {
|
|
|
129 |
return (bool) unpack('n*', @inet_pton($address));
|
|
|
130 |
}
|
|
|
131 |
|
|
|
132 |
if ($netmask < 1 || $netmask > 128) {
|
|
|
133 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
134 |
}
|
|
|
135 |
} else {
|
|
|
136 |
if (!filter_var($ip, \FILTER_VALIDATE_IP, \FILTER_FLAG_IPV6)) {
|
|
|
137 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
138 |
}
|
|
|
139 |
|
|
|
140 |
$address = $ip;
|
|
|
141 |
$netmask = 128;
|
|
|
142 |
}
|
|
|
143 |
|
|
|
144 |
$bytesAddr = unpack('n*', @inet_pton($address));
|
|
|
145 |
$bytesTest = unpack('n*', @inet_pton($requestIp));
|
|
|
146 |
|
|
|
147 |
if (!$bytesAddr || !$bytesTest) {
|
|
|
148 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
149 |
}
|
|
|
150 |
|
|
|
151 |
for ($i = 1, $ceil = ceil($netmask / 16); $i <= $ceil; ++$i) {
|
|
|
152 |
$left = $netmask - 16 * ($i - 1);
|
|
|
153 |
$left = ($left <= 16) ? $left : 16;
|
|
|
154 |
$mask = ~(0xFFFF >> $left) & 0xFFFF;
|
|
|
155 |
if (($bytesAddr[$i] & $mask) != ($bytesTest[$i] & $mask)) {
|
|
|
156 |
return self::$checkedIps[$cacheKey] = false;
|
|
|
157 |
}
|
|
|
158 |
}
|
|
|
159 |
|
|
|
160 |
return self::$checkedIps[$cacheKey] = true;
|
|
|
161 |
}
|
|
|
162 |
|
|
|
163 |
/**
|
|
|
164 |
* Anonymizes an IP/IPv6.
|
|
|
165 |
*
|
|
|
166 |
* Removes the last byte for v4 and the last 8 bytes for v6 IPs
|
|
|
167 |
*/
|
|
|
168 |
public static function anonymize(string $ip): string
|
|
|
169 |
{
|
|
|
170 |
$wrappedIPv6 = false;
|
|
|
171 |
if (str_starts_with($ip, '[') && str_ends_with($ip, ']')) {
|
|
|
172 |
$wrappedIPv6 = true;
|
|
|
173 |
$ip = substr($ip, 1, -1);
|
|
|
174 |
}
|
|
|
175 |
|
|
|
176 |
$packedAddress = inet_pton($ip);
|
|
|
177 |
if (4 === \strlen($packedAddress)) {
|
|
|
178 |
$mask = '255.255.255.0';
|
|
|
179 |
} elseif ($ip === inet_ntop($packedAddress & inet_pton('::ffff:ffff:ffff'))) {
|
|
|
180 |
$mask = '::ffff:ffff:ff00';
|
|
|
181 |
} elseif ($ip === inet_ntop($packedAddress & inet_pton('::ffff:ffff'))) {
|
|
|
182 |
$mask = '::ffff:ff00';
|
|
|
183 |
} else {
|
|
|
184 |
$mask = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
|
|
|
185 |
}
|
|
|
186 |
$ip = inet_ntop($packedAddress & inet_pton($mask));
|
|
|
187 |
|
|
|
188 |
if ($wrappedIPv6) {
|
|
|
189 |
$ip = '['.$ip.']';
|
|
|
190 |
}
|
|
|
191 |
|
|
|
192 |
return $ip;
|
|
|
193 |
}
|
|
|
194 |
}
|