Skip to content

Navigation Menu

Sign in
Appearance settings
Sign in
Sign up
Appearance settings

Commit 93fcc92

Browse filesBrowse the repository at this point in the historyBrowse files
nicolas-grekasnicolas-grekas
committed
feature #65390 [HttpFoundation] Expand PRIVATE_SUBNETS with five not-globally-reachable ranges (Synchro)
This PR was merged into the 8.2 branch. Discussion ---------- [HttpFoundation] Expand PRIVATE_SUBNETS with five not-globally-reachable ranges | Q | A | ------------- | --- | Branch? | 8.2 | Bug fix? | no | New feature? | yes | Deprecations? | no | Issues | - | License | MIT Split out of #65118, authored by `@Synchro`. That PR bundled this with a new `IpUtils::normalize()` method; this is the half we agreed on. Adds five ranges that IANA marks as not globally reachable: | range | | | --- | --- | | `192.0.0.0/24` | IETF Protocol Assignments (RFC 6890) | | `192.88.99.0/24` | 6to4 Relay Anycast (RFC 7526, deprecated) | | `224.0.0.0/4` | IPv4 multicast (RFC 5771) | | `100::/64` | Discard prefix (RFC 6666) | | `ff00::/8` | IPv6 multicast (RFC 4291) | 8.2 rather than a maintenance branch: none of these is an exploitable gap in `NoPrivateNetworkHttpClient`, since multicast and `100::/64` have no TCP semantics, `192.88.99.0/24` is a deprecated public relay and `192.0.0.0/24` needs ISP adjacency. Widening the constant also widens `trusted_proxies: private_ranges`, which is not a patch-branch change. One deliberate trade: `192.0.0.9` and `192.0.0.10`, the PCP and TURN anycast addresses, are marked globally reachable by IANA, so the `/24` over-blocks them. The alternative is `192.0.0.0/29`, which covers the assignments that matter and leaves those two reachable. I went with the `/24` because it matches the registry entry, but it is worth a second opinion. Not included from #65118: `IpUtils::normalize()`. `NoPrivateNetworkHttpClient` already resolves obfuscated literals through `gethostbynamel()`, the same resolver that dials, so a second parser in front of it would add a divergence rather than close a hole. Commits ------- 84aa1cb [HttpFoundation] Expand PRIVATE_SUBNETS with five not-globally-reachable ranges
2 parents bb0c01f + 84aa1cb commit 93fcc92
Copy full SHA for 93fcc92

3 files changed

+17Lines changed: 17 additions & 0 deletions

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md‎

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/CHANGELOG.md
+1Lines changed: 1 addition & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ CHANGELOG
44
8.2
55
---
66

7+
* Add five not-globally-reachable ranges to `IpUtils::PRIVATE_SUBNETS`: `192.0.0.0/24`, `192.88.99.0/24`, `224.0.0.0/4`, `100::/64` and `ff00::/8`
78
* Add `Response::cacheControl()` to set the targeted cache directives defined by RFC 9213, e.g. `CDN-Cache-Control`
89
* Deprecate not passing an expiry to `UriSigner::sign()`
910
* Add the `$defaultExpiration` argument to `UriSigner::__construct()`
Collapse file

‎src/Symfony/Component/HttpFoundation/IpUtils.php‎

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/IpUtils.php
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,27 +22,32 @@ class IpUtils
2222
'127.0.0.0/8', // RFC1700 (Loopback)
2323
'10.0.0.0/8', // RFC1918
2424
'192.168.0.0/16', // RFC1918
25+
'192.0.0.0/24', // IETF Protocol Assignments (RFC 6890)
2526
'192.0.2.0/24', // Documentation Ranges TEST-NET-1 (RFC 5737)
2627
'198.51.100.0/24', // Documentation Ranges TEST-NET-2 (RFC 5737)
2728
'203.0.113.0/24', // Documentation Ranges TEST-NET-3 (RFC 5737)
2829
'172.16.0.0/12', // RFC1918
2930
'169.254.0.0/16', // RFC3927
31+
'192.88.99.0/24', // 6to4 Relay Anycast (RFC 7526, deprecated)
3032
'198.18.0.0/15', // IPv4 Benchmarking (RFC 2544)
3133
'0.0.0.0/8', // RFC5735
3234
'240.0.0.0/4', // RFC1112
3335
'100.64.0.0/10', // RFC6598
36+
'224.0.0.0/4', // RFC5771 (IPv4 multicast)
3437
'::1/128', // Loopback
3538
'fc00::/7', // Unique Local Address
3639
'fe80::/10', // Link Local Address
3740
'::ffff:0:0/96', // IPv4-mapped IPv6 addresses (RFC 4291 section 2.5.5.2)
3841
'::/128', // Unspecified address
3942
'::/96', // IPv4-compatible IPv6 addresses (RFC 4291 section 2.5.5.1)
43+
'100::/64', // Discard prefix (RFC 6666)
4044
'2002::/16', // 6to4 (RFC 3056)
4145
'2001::/32', // Teredo tunneling (RFC 4380)
4246
'2001:db8::/32', // Documentation Ranges (RFC 3849)
4347
'2001:0002::/48', // IPv6 Benchmarking (RFC 5180 and corrections)
4448
'64:ff9b::/96', // NAT64 well-known prefix (RFC 6052)
4549
'64:ff9b:1::/48', // NAT64 local-use prefix (RFC 8215)
50+
'ff00::/8', // RFC4291 (IPv6 multicast)
4651
];
4752

4853
private static array $checkedIps = [];
Collapse file

‎src/Symfony/Component/HttpFoundation/Tests/IpUtilsTest.php‎

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Tests/IpUtilsTest.php
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -259,8 +259,19 @@ public static function getIsPrivateIpData(): array
259259
['2001:0002::1', true],
260260
['64:ff9b::7f00:1', true],
261261
['64:ff9b:1::7f00:1', true],
262+
['192.0.0.1', true],
263+
['192.0.0.8', true],
264+
['192.88.99.1', true],
265+
['224.0.0.1', true],
266+
['239.255.255.250', true],
267+
['233.1.1.1', true],
268+
['100::1', true],
269+
['ff02::1', true],
270+
['ff05::1', true],
271+
['ff0e::1', true],
262272

263273
// public
274+
['100:0:0:1::1', false],
264275
['104.26.14.6', false],
265276
['2606:4700:20::681a:e06', false],
266277
];

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.