diff options
| author | Côme Chilliet <91878298+come-nc@users.noreply.github.com> | 2022-07-26 12:39:32 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-26 12:39:32 +0300 |
| commit | 7615536977eda7f3bda5c29eaa780a323c97afc7 (patch) | |
| tree | e546e2a2ea14d7a2475edd14a3c3c52678ea875a /lib | |
| parent | 9f77aba9fac4badc35ff634eaf83252f3850b921 (diff) | |
| parent | c5ffd7ce32a74c06dddd55652edea5c896ee9b3d (diff) | |
Merge pull request #33031 from nextcloud/fix/improve-local-ip-detection
Improve local IP detection
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/private/Http/Client/LocalAddressChecker.php | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/lib/private/Http/Client/LocalAddressChecker.php b/lib/private/Http/Client/LocalAddressChecker.php index c69d1007a16..f4fea503ab9 100644 --- a/lib/private/Http/Client/LocalAddressChecker.php +++ b/lib/private/Http/Client/LocalAddressChecker.php @@ -27,6 +27,7 @@ namespace OC\Http\Client; use OCP\Http\Client\LocalServerException; use Psr\Log\LoggerInterface; +use Symfony\Component\HttpFoundation\IpUtils; class LocalAddressChecker { private LoggerInterface $logger; @@ -36,7 +37,16 @@ class LocalAddressChecker { } public function ThrowIfLocalIp(string $ip) : void { - if ((bool)filter_var($ip, FILTER_VALIDATE_IP) && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { + $localRanges = [ + '100.64.0.0/10', // See RFC 6598 + '192.0.0.0/24', // See RFC 6890 + ]; + if ( + (bool)filter_var($ip, FILTER_VALIDATE_IP) && + ( + !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) || + IpUtils::checkIp($ip, $localRanges) + )) { $this->logger->warning("Host $ip was not connected to because it violates local access rules"); throw new LocalServerException('Host violates local access rules'); } @@ -46,7 +56,9 @@ class LocalAddressChecker { $delimiter = strrpos($ip, ':'); // Get last colon $ipv4Address = substr($ip, $delimiter + 1); - if (!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) { + if ( + !filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) || + IpUtils::checkIp($ip, $localRanges)) { $this->logger->warning("Host $ip was not connected to because it violates local access rules"); throw new LocalServerException('Host violates local access rules'); } |