Skip to content

Implement a filter that filters for Global IPs as per RFC 6890 #7893

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Implement a filter that filters for Global IPs as per RFC 6890 #7893

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a416da4
Implement a FILTER_FLAG_GLOBAL_RANGE filter that filters for Global I…
vnsavage Jan 6, 2022
ebd39c6
Added tests and an additional non-global range ::ffff:0:0/96
vnsavage Jan 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions ext/filter/filter.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,6 +226,7 @@ PHP_MINIT_FUNCTION(filter)
REGISTER_LONG_CONSTANT("FILTER_FLAG_IPV6", FILTER_FLAG_IPV6, CONST_CS | CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_FLAG_NO_RES_RANGE", FILTER_FLAG_NO_RES_RANGE, CONST_CS | CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_FLAG_NO_PRIV_RANGE", FILTER_FLAG_NO_PRIV_RANGE, CONST_CS | CONST_PERSISTENT);
REGISTER_LONG_CONSTANT("FILTER_FLAG_GLOBAL_RANGE", FILTER_FLAG_GLOBAL_RANGE, CONST_CS | CONST_PERSISTENT);

REGISTER_LONG_CONSTANT("FILTER_FLAG_HOSTNAME", FILTER_FLAG_HOSTNAME, CONST_CS | CONST_PERSISTENT);

Expand Down
13 changes: 7 additions & 6 deletions ext/filter/filter_private.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@

#define FILTER_FLAG_NONE 0x0000

#define FILTER_REQUIRE_ARRAY 0x1000000
#define FILTER_REQUIRE_SCALAR 0x2000000
#define FILTER_REQUIRE_ARRAY 0x10000000
#define FILTER_REQUIRE_SCALAR 0x20000000

#define FILTER_FORCE_ARRAY 0x4000000
#define FILTER_NULL_ON_FAILURE 0x8000000
Expand All @@ -46,10 +46,11 @@
#define FILTER_FLAG_PATH_REQUIRED 0x040000
#define FILTER_FLAG_QUERY_REQUIRED 0x080000

#define FILTER_FLAG_IPV4 0x100000
#define FILTER_FLAG_IPV6 0x200000
#define FILTER_FLAG_NO_RES_RANGE 0x400000
#define FILTER_FLAG_NO_PRIV_RANGE 0x800000
#define FILTER_FLAG_IPV4 0x0100000
#define FILTER_FLAG_IPV6 0x0200000
#define FILTER_FLAG_NO_RES_RANGE 0x0400000
#define FILTER_FLAG_NO_PRIV_RANGE 0x0800000
#define FILTER_FLAG_GLOBAL_RANGE 0x1000000

#define FILTER_FLAG_HOSTNAME 0x100000

Expand Down
38 changes: 31 additions & 7 deletions ext/filter/logical_filters.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -897,7 +897,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
}

/* Check flags */
if (flags & FILTER_FLAG_NO_PRIV_RANGE) {
if (flags & FILTER_FLAG_NO_PRIV_RANGE || flags & FILTER_FLAG_GLOBAL_RANGE) {
if (
(ip[0] == 10) ||
(ip[0] == 172 && ip[1] >= 16 && ip[1] <= 31) ||
Expand All @@ -907,7 +907,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
}
}

if (flags & FILTER_FLAG_NO_RES_RANGE) {
if (flags & FILTER_FLAG_NO_RES_RANGE || flags & FILTER_FLAG_GLOBAL_RANGE) {
if (
(ip[0] == 0) ||
(ip[0] >= 240) ||
Expand All @@ -917,6 +917,20 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
RETURN_VALIDATION_FAILED
}
}

if (flags & FILTER_FLAG_GLOBAL_RANGE) {
if (
(ip[0] == 100 && ip[1] >= 64 && ip[1] <= 127 ) ||
(ip[0] == 192 && ip[1] == 0 && ip[2] == 0 ) ||
(ip[0] == 192 && ip[1] == 0 && ip[2] == 2 ) ||
(ip[0] == 198 && ip[1] >= 18 && ip[1] <= 19 ) ||
(ip[0] == 198 && ip[1] == 51 && ip[2] == 100 ) ||
(ip[0] == 203 && ip[1] == 0 && ip[2] == 113 )
) {
RETURN_VALIDATION_FAILED
}
}

break;

case FORMAT_IPV6:
Expand All @@ -927,23 +941,33 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
RETURN_VALIDATION_FAILED
}
/* Check flags */
if (flags & FILTER_FLAG_NO_PRIV_RANGE) {
if (flags & FILTER_FLAG_NO_PRIV_RANGE || flags & FILTER_FLAG_GLOBAL_RANGE) {
if (ip[0] >= 0xfc00 && ip[0] <= 0xfdff) {
RETURN_VALIDATION_FAILED
}
}
if (flags & FILTER_FLAG_NO_RES_RANGE) {
if (flags & FILTER_FLAG_NO_RES_RANGE || flags & FILTER_FLAG_GLOBAL_RANGE) {
if ((ip[0] == 0 && ip[1] == 0 && ip[2] == 0 && ip[3] == 0
&& ip[4] == 0 && ip[5] == 0 && ip[6] == 0 && (ip[7] == 0 || ip[7] == 1))
&& ip[4] == 0 && ip[5] == 0 && ip[6] == 0 && (ip[7] == 0 || ip[7] == 1))
|| (ip[0] == 0x5f)
|| (ip[0] >= 0xfe80 && ip[0] <= 0xfebf)
|| (ip[0] == 0x2001 && (ip[1] == 0x0db8 || (ip[1] >= 0x0010 && ip[1] <= 0x001f)))
|| (ip[0] == 0x3ff3)
) {
RETURN_VALIDATION_FAILED
}
}
}
}
if (flags & FILTER_FLAG_GLOBAL_RANGE) {
if ((ip[0] == 0 && ip[1] == 0 && ip[2] == 0 && ip[3] == 0 && ip[4] == 0 && ip[5] == 0xffff) ||
(ip[0] == 0x0100 && ip[1] == 0 && ip[2] == 0 && ip[3] == 0) ||
(ip[0] == 0x2001 && ip[1] <= 0x01ff) ||
(ip[0] == 0x2001 && ip[1] == 0x0002 && ip[2] == 0) ||
(ip[0] >= 0xfc00 && ip[0] <= 0xfdff)
) {
RETURN_VALIDATION_FAILED
}
}
}
break;
}
}
Expand Down
121 changes: 121 additions & 0 deletions ext/filter/tests/bug77221.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
--TEST--
Bug #77221 (Request IP address filter flag to exclude non-global IP addresses)
--SKIPIF--
<?php
if (!extension_loaded('filter')) die("skip filter extension not available");
?>
--FILE--
<?php

$non_global_ranges = [];
$non_global_ranges['0.0.0.0/8'] = ['0.0.0.0', '0.255.255.255'];
$non_global_ranges['10.0.0.0/8'] = ['10.0.0.0', '10.255.255.255'];
$non_global_ranges['100.64.0.0/10'] = ['100.64.0.0', '100.127.255.255'];
$non_global_ranges['127.0.0.0/8'] = ['127.0.0.0', '127.255.255.255'];
$non_global_ranges['169.254.0.0/16'] = ['169.254.0.0', '169.254.255.255'];
$non_global_ranges['172.16.0.0/12'] = ['172.16.0.0', '172.31.255.255'];
$non_global_ranges['192.0.0.0/24'] = ['192.0.0.0', '192.0.0.255'];
$non_global_ranges['192.0.2.0/24'] = ['192.0.2.0', '192.0.2.255'];
$non_global_ranges['192.168.0.0/16'] = ['192.168.0.0', '192.168.255.255'];
$non_global_ranges['198.18.0.0/15'] = ['198.18.0.0', '198.19.255.255'];
$non_global_ranges['198.51.100.0/24'] = ['198.51.100.0', '198.51.100.255'];
$non_global_ranges['203.0.113.0/24'] = ['203.0.113.0', '203.0.113.255'];
$non_global_ranges['240.0.0.0/4'] = ['240.0.0.0', '255.255.255.255'];

$non_global_ranges['::/128'] = ['::0', '::'];
$non_global_ranges['::1/128'] = ['0000:0000:0000:0000:0000:0000:0000:1', '0:0:0:0:0:0:0:1'];
$non_global_ranges['::ffff:0:0/96'] = ['::ffff:0:0', '::ffff:ffff:ffff'];
$non_global_ranges['100::/64'] = ['0100::', '100::ffff:ffff:ffff:ffff'];
$non_global_ranges['2001::/23'] = ['2001::', '2001:01ff:ffff:ffff:ffff:ffff:ffff:ffff'];
$non_global_ranges['2001:2::/48'] = ['2001:2::', '2001:2:0:ffff:ffff:ffff:ffff:ffff'];
$non_global_ranges['2001:db8::/32'] = ['2001:db8::', '2001:db8:ffff:ffff:ffff:ffff:ffff:ffff'];
$non_global_ranges['2001:10::/28'] = ['2001:10::', '2001:1f:ffff:ffff:ffff:ffff:ffff:ffff'];
$non_global_ranges['fc00::/7'] = ['fc00::', 'fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'];
$non_global_ranges['fe80::/10'] = ['fe80::', 'febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff'];


foreach ($non_global_ranges as $key => $range) {
list($min, $max) = $range;
var_dump($key);
var_dump(filter_var($min, FILTER_VALIDATE_IP, FILTER_FLAG_GLOBAL_RANGE));
var_dump(filter_var($max, FILTER_VALIDATE_IP, FILTER_FLAG_GLOBAL_RANGE));
}

var_dump(filter_var('185.85.0.29', FILTER_VALIDATE_IP, FILTER_FLAG_GLOBAL_RANGE));
var_dump(filter_var('64:ff9b::', FILTER_VALIDATE_IP, FILTER_FLAG_GLOBAL_RANGE));
var_dump(filter_var('64:ff9b::ffff', FILTER_VALIDATE_IP, FILTER_FLAG_GLOBAL_RANGE));

?>
--EXPECT--
string(9) "0.0.0.0/8"
bool(false)
bool(false)
string(10) "10.0.0.0/8"
bool(false)
bool(false)
string(13) "100.64.0.0/10"
bool(false)
bool(false)
string(11) "127.0.0.0/8"
bool(false)
bool(false)
string(14) "169.254.0.0/16"
bool(false)
bool(false)
string(13) "172.16.0.0/12"
bool(false)
bool(false)
string(12) "192.0.0.0/24"
bool(false)
bool(false)
string(12) "192.0.2.0/24"
bool(false)
bool(false)
string(14) "192.168.0.0/16"
bool(false)
bool(false)
string(13) "198.18.0.0/15"
bool(false)
bool(false)
string(15) "198.51.100.0/24"
bool(false)
bool(false)
string(14) "203.0.113.0/24"
bool(false)
bool(false)
string(11) "240.0.0.0/4"
bool(false)
bool(false)
string(6) "::/128"
bool(false)
bool(false)
string(7) "::1/128"
bool(false)
bool(false)
string(13) "::ffff:0:0/96"
bool(false)
bool(false)
string(8) "100::/64"
bool(false)
bool(false)
string(9) "2001::/23"
bool(false)
bool(false)
string(11) "2001:2::/48"
bool(false)
bool(false)
string(13) "2001:db8::/32"
bool(false)
bool(false)
string(12) "2001:10::/28"
bool(false)
bool(false)
string(8) "fc00::/7"
bool(false)
bool(false)
string(9) "fe80::/10"
bool(false)
bool(false)
string(11) "185.85.0.29"
string(9) "64:ff9b::"
string(13) "64:ff9b::ffff"