From 38b40098771bf6e207bf1a79d4647ad2c39fed5c Mon Sep 17 00:00:00 2001
From: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
Date: Wed, 26 Jul 2023 20:21:17 +0200
Subject: [PATCH] Simplify IP address normalizer with IP masks

Remove dead code

Signed-off-by: Benjamin Gaussorgues <benjamin.gaussorgues@nextcloud.com>
---
 lib/private/Security/Normalizer/IpAddress.php | 80 ++++---------------
 1 file changed, 17 insertions(+), 63 deletions(-)

diff --git a/lib/private/Security/Normalizer/IpAddress.php b/lib/private/Security/Normalizer/IpAddress.php
index 98d85ce07a145..449066ea8a10c 100644
--- a/lib/private/Security/Normalizer/IpAddress.php
+++ b/lib/private/Security/Normalizer/IpAddress.php
@@ -37,43 +37,18 @@
  * @package OC\Security\Normalizer
  */
 class IpAddress {
-	/** @var string */
-	private $ip;
-
 	/**
-	 * @param string $ip IP to normalized
+	 * @param string $ip IP to normalize
 	 */
-	public function __construct(string $ip) {
-		$this->ip = $ip;
-	}
-
-	/**
-	 * Return the given subnet for an IPv4 address and mask bits
-	 *
-	 * @param string $ip
-	 * @param int $maskBits
-	 * @return string
-	 */
-	private function getIPv4Subnet(string $ip, int $maskBits = 32): string {
-		$binary = \inet_pton($ip);
-		for ($i = 32; $i > $maskBits; $i -= 8) {
-			$j = \intdiv($i, 8) - 1;
-			$k = \min(8, $i - $maskBits);
-			$mask = (0xff - ((2 ** $k) - 1));
-			$int = \unpack('C', $binary[$j]);
-			$binary[$j] = \pack('C', $int[1] & $mask);
-		}
-		return \inet_ntop($binary).'/'.$maskBits;
+	public function __construct(
+		private string $ip,
+	) {
 	}
 
 	/**
-	 * Return the given subnet for an IPv6 address and mask bits
-	 *
-	 * @param string $ip
-	 * @param int $maskBits
-	 * @return string
+	 * Return the given subnet for an IPv6 address (64 first bits)
 	 */
-	private function getIPv6Subnet(string $ip, int $maskBits = 48): string {
+	private function getIPv6Subnet(string $ip): string {
 		if ($ip[0] === '[' && $ip[-1] === ']') { // If IP is with brackets, for example [::1]
 			$ip = substr($ip, 1, strlen($ip) - 2);
 		}
@@ -81,15 +56,11 @@ private function getIPv6Subnet(string $ip, int $maskBits = 48): string {
 		if ($pos !== false) {
 			$ip = substr($ip, 0, $pos - 1);
 		}
+
 		$binary = \inet_pton($ip);
-		for ($i = 128; $i > $maskBits; $i -= 8) {
-			$j = \intdiv($i, 8) - 1;
-			$k = \min(8, $i - $maskBits);
-			$mask = (0xff - ((2 ** $k) - 1));
-			$int = \unpack('C', $binary[$j]);
-			$binary[$j] = \pack('C', $int[1] & $mask);
-		}
-		return \inet_ntop($binary).'/'.$maskBits;
+		$mask = inet_pton('FFFF:FFFF:FFFF:FFFF::');
+
+		return inet_ntop($binary & $mask).'/64';
 	}
 
 	/**
@@ -103,24 +74,13 @@ private function getEmbeddedIpv4(string $ipv6): ?string {
 		if (!$binary) {
 			return null;
 		}
-		for ($i = 0; $i <= 9; $i++) {
-			if (unpack('C', $binary[$i])[1] !== 0) {
-				return null;
-			}
-		}
-
-		for ($i = 10; $i <= 11; $i++) {
-			if (unpack('C', $binary[$i])[1] !== 255) {
-				return null;
-			}
-		}
 
-		$binary4 = '';
-		for ($i = 12; $i < 16; $i++) {
-			$binary4 .= $binary[$i];
+		$mask = inet_pton('::FFFF:FFFF');
+		if (($binary & ~$mask) !== inet_pton('::FFFF:0.0.0.0')) {
+			return null;
 		}
 
-		return inet_ntop($binary4);
+		return inet_ntop(substr($binary, -4));
 	}
 
 
@@ -130,19 +90,13 @@ private function getEmbeddedIpv4(string $ipv6): ?string {
 	 * @return string
 	 */
 	public function getSubnet(): string {
-		if (\preg_match('/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/', $this->ip)) {
-			return $this->getIPv4Subnet(
-				$this->ip,
-				32
-			);
+		if (filter_var($this->ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+			return $this->ip.'/32';
 		}
 
 		$ipv4 = $this->getEmbeddedIpv4($this->ip);
 		if ($ipv4 !== null) {
-			return $this->getIPv4Subnet(
-				$ipv4,
-				32
-			);
+			return $ipv4.'/32';
 		}
 
 		return $this->getIPv6Subnet(