diff options
| -rw-r--r-- | lib/private/Security/Normalizer/IpAddress.php | 44 | ||||
| -rw-r--r-- | tests/lib/Security/Normalizer/IpAddressTest.php | 10 |
2 files changed, 51 insertions, 3 deletions
diff --git a/lib/private/Security/Normalizer/IpAddress.php b/lib/private/Security/Normalizer/IpAddress.php index 656487d8ce4..2d5dea67af1 100644 --- a/lib/private/Security/Normalizer/IpAddress.php +++ b/lib/private/Security/Normalizer/IpAddress.php @@ -93,6 +93,39 @@ class IpAddress { } /** + * Returns the IPv4 address embedded in an IPv6 if applicable. + * The detected format is "::ffff:x.x.x.x" using the binary form. + * + * @param string $ipv6 IPv6 string + * @return null|string embedded IPv4 string or null if none was found + */ + private function getEmbeddedIpv4($ipv6) { + $binary = inet_pton($ipv6); + if (!$binary) { + return null; + } + for ($i = 0; $i <= 9; $i++) { + if (unpack('C', $binary[$i])[1] !== 0) { + return null; + } + } + + for ($i = 10; $i <= 11; $i++) { + if (unpack('C', $binary[$i])[1] !== 255) { + return null; + } + } + + $binary4 = ''; + for ($i = 12; $i < 16; $i++) { + $binary4 .= $binary[$i]; + } + + return inet_ntop($binary4); + } + + + /** * Gets either the /32 (IPv4) or the /64 (IPv6) subnet of an IP address * * @return string @@ -103,9 +136,16 @@ class IpAddress { $this->ip, 32 ); - } elseif (substr(strtolower($this->ip), 0, 7) === '::ffff:') { - return '::ffff:' . $this->getIPv4Subnet(substr($this->ip, 7), 32); } + + $ipv4 = $this->getEmbeddedIpv4($this->ip); + if ($ipv4 !== null) { + return $this->getIPv4Subnet( + $ipv4, + 32 + ); + } + return $this->getIPv6Subnet( $this->ip, 64 diff --git a/tests/lib/Security/Normalizer/IpAddressTest.php b/tests/lib/Security/Normalizer/IpAddressTest.php index 7492e182c32..bb487659ced 100644 --- a/tests/lib/Security/Normalizer/IpAddressTest.php +++ b/tests/lib/Security/Normalizer/IpAddressTest.php @@ -40,7 +40,15 @@ class IpAddressTest extends TestCase { ], [ '::ffff:192.168.0.123', - '::ffff:192.168.0.123/32', + '192.168.0.123/32', + ], + [ + '0:0:0:0:0:ffff:192.168.0.123', + '192.168.0.123/32', + ], + [ + '0:0:0:0:0:ffff:c0a8:7b', + '192.168.0.123/32', ], [ '2001:0db8:85a3:0000:0000:8a2e:0370:7334', |