Skip to content

Commit 2f15e83

Browse files
authored
Merge pull request #34160 from nextcloud/fix/detect-weird-local-ips
Detect weird local ips
2 parents 938bc57 + 7532859 commit 2f15e83

File tree

6 files changed

+45
-20
lines changed

6 files changed

+45
-20
lines changed

build/stubs/intl.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -4622,7 +4622,7 @@ function idn_to_ascii($domain, $options = 0, $variant = INTL_IDNA_VARIANT_2003,
46224622
* @param int $variant [optional] <p>
46234623
* Either INTL_IDNA_VARIANT_2003 for IDNA 2003 or INTL_IDNA_VARIANT_UTS46 for UTS #46.
46244624
* </p>
4625-
* @param int &$idna_info [optional] <p>
4625+
* @param array &$idna_info [optional] <p>
46264626
* This parameter can be used only if INTL_IDNA_VARIANT_UTS46 was used for variant.
46274627
* In that case, it will be filled with an array with the keys 'result',
46284628
* the possibly illegal result of the transformation, 'isTransitionalDifferent',
@@ -4634,7 +4634,7 @@ function idn_to_ascii($domain, $options = 0, $variant = INTL_IDNA_VARIANT_2003,
46344634
* RFC 3490 4.2 states though "ToUnicode never fails. If any step fails, then the original input
46354635
* sequence is returned immediately in that step."
46364636
*/
4637-
function idn_to_utf8($domain, $options = 0, $variant = INTL_IDNA_VARIANT_2003, array &$idna_info) { }
4637+
function idn_to_utf8($domain, $options = 0, $variant = INTL_IDNA_VARIANT_2003, array &$idna_info = null) { }
46384638

46394639
/**
46404640
* (PHP 5 &gt;=5.5.0 PECL intl &gt;= 3.0.0a1)<br/>

lib/private/Http/Client/DnsPinMiddleware.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ public function addDnsPinning() {
125125
$ports[] = (string)$port;
126126
}
127127

128-
$targetIps = $this->dnsResolve($hostName, 0);
128+
$targetIps = $this->dnsResolve(idn_to_utf8($hostName), 0);
129129

130130
$curlResolves = [];
131131

lib/private/Http/Client/LocalAddressChecker.php

+19-14
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
*/
2626
namespace OC\Http\Client;
2727

28+
use IPLib\Address\IPv6;
29+
use IPLib\Factory;
30+
use IPLib\ParseStringFlag;
2831
use OCP\Http\Client\LocalServerException;
2932
use Psr\Log\LoggerInterface;
3033
use Symfony\Component\HttpFoundation\IpUtils;
@@ -37,6 +40,21 @@ public function __construct(LoggerInterface $logger) {
3740
}
3841

3942
public function ThrowIfLocalIp(string $ip) : void {
43+
$parsedIp = Factory::parseAddressString(
44+
$ip,
45+
ParseStringFlag::IPV4_MAYBE_NON_DECIMAL | ParseStringFlag::IPV4ADDRESS_MAYBE_NON_QUAD_DOTTED
46+
);
47+
if ($parsedIp === null) {
48+
/* Not an IP */
49+
return;
50+
}
51+
/* Replace by normalized form */
52+
if ($parsedIp instanceof IPv6) {
53+
$ip = (string)($parsedIp->toIPv4() ?? $parsedIp);
54+
} else {
55+
$ip = (string)$parsedIp;
56+
}
57+
4058
$localRanges = [
4159
'100.64.0.0/10', // See RFC 6598
4260
'192.0.0.0/24', // See RFC 6890
@@ -50,19 +68,6 @@ public function ThrowIfLocalIp(string $ip) : void {
5068
$this->logger->warning("Host $ip was not connected to because it violates local access rules");
5169
throw new LocalServerException('Host violates local access rules');
5270
}
53-
54-
// Also check for IPv6 IPv4 nesting, because that's not covered by filter_var
55-
if ((bool)filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && substr_count($ip, '.') > 0) {
56-
$delimiter = strrpos($ip, ':'); // Get last colon
57-
$ipv4Address = substr($ip, $delimiter + 1);
58-
59-
if (
60-
!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
61-
IpUtils::checkIp($ip, $localRanges)) {
62-
$this->logger->warning("Host $ip was not connected to because it violates local access rules");
63-
throw new LocalServerException('Host violates local access rules');
64-
}
65-
}
6671
}
6772

6873
public function ThrowIfLocalAddress(string $uri) : void {
@@ -72,7 +77,7 @@ public function ThrowIfLocalAddress(string $uri) : void {
7277
throw new LocalServerException('Could not detect any host');
7378
}
7479

75-
$host = strtolower($host);
80+
$host = idn_to_utf8(strtolower(urldecode($host)));
7681
// Remove brackets from IPv6 addresses
7782
if (strpos($host, '[') === 0 && substr($host, -1) === ']') {
7883
$host = substr($host, 1, -1);

tests/lib/Http/Client/ClientTest.php

+1
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,7 @@ public function dataPreventLocalAddress():array {
161161
['another-host.local'],
162162
['service.localhost'],
163163
['!@#$'], // test invalid url
164+
['normal.host.com'],
164165
];
165166
}
166167

tests/lib/Http/Client/LocalAddressCheckerTest.php

+21-2
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ public function dataInternalIPs() : array {
9191
return [
9292
['192.168.0.1'],
9393
['fe80::200:5aee:feaa:20a2'],
94-
['0:0:0:0:0:0:10.0.0.1'],
94+
['0:0:0:0:0:ffff:10.0.0.1'],
9595
['0:0:0:0:0:ffff:127.0.0.0'],
9696
['10.0.0.1'],
9797
['::'],
@@ -112,7 +112,7 @@ public function dataPreventLocalAddress():array {
112112
['172.16.42.1'],
113113
['[fdf8:f53b:82e4::53]/secret.ics'],
114114
['[fe80::200:5aee:feaa:20a2]/secret.ics'],
115-
['[0:0:0:0:0:0:10.0.0.1]/secret.ics'],
115+
['[0:0:0:0:0:ffff:10.0.0.1]/secret.ics'],
116116
['[0:0:0:0:0:ffff:127.0.0.0]/secret.ics'],
117117
['10.0.0.1'],
118118
['another-host.local'],
@@ -121,6 +121,25 @@ public function dataPreventLocalAddress():array {
121121
['100.100.100.200'],
122122
['192.0.0.1'],
123123
['randomdomain.internal'],
124+
['0177.0.0.9'],
125+
['⑯⑨。②⑤④。⑯⑨。②⑤④'],
126+
['127。②⑤④。⑯⑨.②⑤④'],
127+
['127.0.00000000000000000000000000000000001'],
128+
['127.1'],
129+
['127.000.001'],
130+
['0177.0.0.01'],
131+
['0x7f.0x0.0x0.0x1'],
132+
['0x7f000001'],
133+
['2130706433'],
134+
['00000000000000000000000000000000000000000000000000177.1'],
135+
['0x7f.1'],
136+
['127.0x1'],
137+
['[0000:0000:0000:0000:0000:0000:0000:0001]'],
138+
['[0:0:0:0:0:0:0:1]'],
139+
['[0:0:0:0::0:0:1]'],
140+
['%31%32%37%2E%30%2E%30%2E%31'],
141+
['%31%32%37%2E%30%2E%30.%31'],
142+
['[%3A%3A%31]'],
124143
];
125144
}
126145

0 commit comments

Comments
 (0)