Merge pull request #33031 from nextcloud/fix/improve-local-ip-detection

Improve local IP detection

Author: come-nc

lib/private/Http/Client/LocalAddressChecker.php

@@ -27,6 +27,7 @@
 
 use OCP\Http\Client\LocalServerException;
 use Psr\Log\LoggerInterface;
+use Symfony\Component\HttpFoundation\IpUtils;
 
 class LocalAddressChecker {
 	private LoggerInterface $logger;
@@ -36,7 +37,16 @@ public function __construct(LoggerInterface $logger) {
 	}
 
 	public function ThrowIfLocalIp(string $ip) : void {
-		if ((bool)filter_var($ip, FILTER_VALIDATE_IP) && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+		$localRanges = [
+			'100.64.0.0/10', // See RFC 6598
+			'192.0.0.0/24', // See RFC 6890
+		];
+		if (
+			(bool)filter_var($ip, FILTER_VALIDATE_IP) &&
+			(
+				!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
+				IpUtils::checkIp($ip, $localRanges)
+			)) {
 			$this->logger->warning("Host $ip was not connected to because it violates local access rules");
 			throw new LocalServerException('Host violates local access rules');
 		}
@@ -46,7 +56,9 @@ public function ThrowIfLocalIp(string $ip) : void {
 			$delimiter = strrpos($ip, ':'); // Get last colon
 			$ipv4Address = substr($ip, $delimiter + 1);
 
-			if (!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+			if (
+				!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
+				IpUtils::checkIp($ip, $localRanges)) {
 				$this->logger->warning("Host $ip was not connected to because it violates local access rules");
 				throw new LocalServerException('Host violates local access rules');
 			}

tests/lib/Http/Client/LocalAddressCheckerTest.php

@@ -96,6 +96,8 @@ public function dataInternalIPs() : array {
 			['10.0.0.1'],
 			['::'],
 			['::1'],
+			['100.100.100.200'],
+			['192.0.0.1'],
 		];
 	}
 
@@ -116,6 +118,9 @@ public function dataPreventLocalAddress():array {
 			['another-host.local'],
 			['service.localhost'],
 			['!@#$'], // test invalid url
+			['100.100.100.200'],
+			['192.0.0.1'],
+			['randomdomain.internal'],
 		];
 	}