Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[!!!][FEATURE] Add IP locking for IPv6
A new IpLocker class replaces the lock functionality in AbstractUserAuthentication. The new class is capable of locking to IPv4 and IPv6 addresses. Resolves: #21638 Releases: master Change-Id: I0075a9e49690e31c938abf7242c1f088c73bb37d Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/52947 Reviewed-by: Benni Mack <benni@typo3.org> Reviewed-by: Stefan Neufeind <typo3.neufeind@speedpartner.de> Reviewed-by: Markus Klein <markus.klein@typo3.org> Reviewed-by: Oliver Hader <oliver.hader@typo3.org> Tested-by: TYPO3com <noreply@typo3.com> Tested-by: Markus Klein <markus.klein@typo3.org> Tested-by: Oliver Hader <oliver.hader@typo3.org>
- Loading branch information
Showing
10 changed files
with
384 additions
and
41 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| <?php | ||
| declare(strict_types = 1); | ||
|
|
||
| namespace TYPO3\CMS\Core\Authentication; | ||
|
|
||
| /* | ||
| * This file is part of the TYPO3 CMS project. | ||
| * | ||
| * It is free software; you can redistribute it and/or modify it under | ||
| * the terms of the GNU General Public License, either version 2 | ||
| * of the License, or any later version. | ||
| * | ||
| * For the full copyright and license information, please read the | ||
| * LICENSE.txt file that was distributed with this source code. | ||
| * | ||
| * The TYPO3 project - inspiring people to share! | ||
| */ | ||
|
|
||
| use TYPO3\CMS\Core\Utility\MathUtility; | ||
|
|
||
| /** | ||
| * Handles the locking of sessions to IP addresses. | ||
| */ | ||
| class IpLocker | ||
| { | ||
| const DISABLED_LOCK_VALUE = '[DISABLED]'; | ||
|
|
||
| /** | ||
| * If set to 4, the session will be locked to the user's IP address (all four numbers). | ||
| * Reducing this to 1-3 means that only the given number of parts of the IP address is used. | ||
| * | ||
| * @var int | ||
| */ | ||
| protected $lockIPv4PartCount = 4; | ||
|
|
||
| /** | ||
| * Same setting as lockIP but for IPv6 addresses. | ||
| * | ||
| * @var int | ||
| */ | ||
| protected $lockIPv6PartCount = 8; | ||
|
|
||
| public function __construct(int $lockIPv4PartCount, int $lockIPv6PartCount) | ||
| { | ||
| $this->lockIPv4PartCount = $lockIPv4PartCount; | ||
| $this->lockIPv6PartCount = $lockIPv6PartCount; | ||
| } | ||
|
|
||
| public function getSessionIpLock(string $ipAddress, bool $enableLocking = true): string | ||
| { | ||
| if (!$enableLocking) { | ||
| return static::DISABLED_LOCK_VALUE; | ||
| } | ||
|
|
||
| if ($this->isIpv6Address($ipAddress)) { | ||
| return $this->getIpLockPartForIpv6Address($ipAddress); | ||
| } | ||
| return $this->getIpLockPartForIpv4Address($ipAddress); | ||
| } | ||
|
|
||
| public function validateRemoteAddressAgainstSessionIpLock(string $ipAddress, string $sessionIpLock): bool | ||
| { | ||
| if ($sessionIpLock === static::DISABLED_LOCK_VALUE) { | ||
| return true; | ||
| } | ||
|
|
||
| $ipToCompare = $this->isIpv6Address($sessionIpLock) | ||
| ? $this->getIpLockPartForIpv6Address($ipAddress) | ||
| : $this->getIpLockPartForIpv4Address($ipAddress); | ||
| return $ipToCompare === $sessionIpLock; | ||
| } | ||
|
|
||
| protected function getIpLockPart(string $ipAddress, int $numberOfParts, int $maxParts, string $delimiter): string | ||
| { | ||
| if ($numberOfParts >= $maxParts) { | ||
| return $ipAddress; | ||
| } | ||
|
|
||
| $numberOfParts = MathUtility::forceIntegerInRange($numberOfParts, 1, $maxParts); | ||
| $ipParts = explode($delimiter, $ipAddress); | ||
| for ($a = $maxParts; $a > $numberOfParts; $a--) { | ||
| $ipPartValue = $delimiter === '.' ? '0' : str_pad('', strlen($ipParts[$a - 1]), '0'); | ||
| $ipParts[$a - 1] = $ipPartValue; | ||
| } | ||
|
|
||
| return implode($delimiter, $ipParts); | ||
| } | ||
|
|
||
| protected function getIpLockPartForIpv4Address(string $ipAddress): string | ||
| { | ||
| if ($this->lockIPv4PartCount === 0) { | ||
| return static::DISABLED_LOCK_VALUE; | ||
| } | ||
|
|
||
| return $this->getIpLockPart($ipAddress, $this->lockIPv4PartCount, 4, '.'); | ||
| } | ||
|
|
||
| protected function getIpLockPartForIpv6Address(string $ipAddress): string | ||
| { | ||
| if ($this->lockIPv6PartCount === 0) { | ||
| return static::DISABLED_LOCK_VALUE; | ||
| } | ||
|
|
||
| // inet_pton also takes care of IPv4-mapped addresses (see https://en.wikipedia.org/wiki/IPv6_address#Representation) | ||
| $expandedAddress = rtrim(chunk_split(unpack('H*hex', inet_pton($ipAddress))['hex'], 4, ':'), ':'); | ||
| return $this->getIpLockPart($expandedAddress, $this->lockIPv6PartCount, 8, ':'); | ||
| } | ||
|
|
||
| protected function isIpv6Address(string $ipAddress): bool | ||
| { | ||
| return strpos($ipAddress, ':') !== false; | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
...xt/core/Documentation/Changelog/master/Breaking-21638-LockIPPropertyRemoved.rst
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| .. include:: ../../Includes.txt | ||
|
|
||
| ====================================================================== | ||
| Breaking: #21638 - AbstractUserAuthentication::lockIP property removed | ||
| ====================================================================== | ||
|
|
||
| See :issue:`21638` | ||
|
|
||
| Description | ||
| =========== | ||
|
|
||
| The IP-locking-functionality is extended from IPv4 only to now also support IPv6. A separate IpLocker-functionality was added. | ||
|
|
||
| The public property :php:`lockIP` in :php:`AbstractUserAuthentication` is now removed. It usually shouldn't have been accessed directly and supported IPv4 only. | ||
|
|
||
|
|
||
| Impact | ||
| ====== | ||
|
|
||
| Extensions relying on :php:`lockIP` won't be able to perform their task anymore. | ||
| This might for example be the case when "lockIP" was set dynamically, depending on the REMOTE_ADDR. | ||
|
|
||
|
|
||
| Affected Installations | ||
| ====================== | ||
|
|
||
| Every 3rd party extension depending on the formerly public :php:`lockIP` property is affected. | ||
|
|
||
|
|
||
| Migration | ||
| ========= | ||
|
|
||
| Set :php:`lockIP` and :php:`lockIPv6` in :php:`TYPO3_CONF_VARS` - for FE or BE depending on the usecase. | ||
| Use the new :php:`\TYPO3\CMS\Core\Authentication\IpLocker` API. | ||
|
|
||
| .. index:: Backend, Frontend, LocalConfiguration, NotScanned |
30 changes: 30 additions & 0 deletions
30
...ore/Documentation/Changelog/master/Feature-21638-IntroducedIpLockingForIpv6.rst
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| .. include:: ../../Includes.txt | ||
|
|
||
| ================================================ | ||
| Feature: #21638 - Introduced IP locking for IPv6 | ||
| ================================================ | ||
|
|
||
| See :issue:`21638` | ||
|
|
||
| Description | ||
| =========== | ||
|
|
||
| The IP-locking functionality has been extended to support IPv6 now as well. | ||
| This security feature enables binding of a user session (Backend or Frontend) to an IP address or a part of it. | ||
|
|
||
| The available configuration options with their default values for IP-locking are: | ||
|
|
||
| .. code-block:: typoscript | ||
| $GLOBALS['TYPO3_CONF_VARS']['FE']['lockIP'] = 2; | ||
| $GLOBALS['TYPO3_CONF_VARS']['FE']['lockIPv6'] = 2; | ||
| $GLOBALS['TYPO3_CONF_VARS']['BE']['lockIP'] = 4; | ||
| $GLOBALS['TYPO3_CONF_VARS']['BE']['lockIPv6'] = 2; | ||
| The configuration can be changed via the Admin Tools -> Settings menu. | ||
| The exact meaning of the numbers used for the configuration are documented there. | ||
|
|
||
| Code-wise a separate IpLocker class :php:`\TYPO3\CMS\Core\Authentication\IpLocker` has been added, which takes care of the IP-locking for both IP versions. | ||
|
|
||
| .. index:: Backend, Frontend, LocalConfiguration |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.