PublicIpPolicy
in package
FinalYes
Decides whether an IP address is publicly routable, for outgoing requests to addresses supplied by a user or an import (server-side request forgery).
FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE does not cover carrier-grade NAT 100.64.0.0/10,
benchmark 198.18.0.0/15, NAT64 64:ff9b::/96 or an IPv4 hidden in IPv6 (::ffff:127.0.0.1,
6to4 2002::/16). The policy therefore:
- normalizes the address (
inet_pton), extracts the IPv4 from mapped or embedded IPv6 and checks it; - applies
FILTER_FLAG_GLOBAL_RANGE(PHP 8.2 or newer); - also rejects the explicit list BLOCKED_CIDRS, a safeguard for ranges PHP treats as
global (the
IANAregistry lists NAT64 as globally reachable).
Table of Contents
Constants
- BLOCKED_CIDRS : array<string|int, mixed> = [ // IPv4 '0.0.0.0/8', '10.0.0.0/8', '100.64.0....
- Ranges that are never a target of an outgoing request (IPv4 and IPv6).
Methods
- isPublic() : bool
- extractEmbeddedIpv4() : string|null
- Extracts an IPv4 embedded in IPv6: mapped `::ffff:a.b.c.d`, compatible `::a.b.c.d`, NAT64 `64:ff9b::a.b.c.d` and 6to4 `2002:AABB:CCDD::`. Returns `null` when the address carries none.
- isInCidr() : bool
Constants
BLOCKED_CIDRS
Ranges that are never a target of an outgoing request (IPv4 and IPv6).
private
array<string|int, mixed>
BLOCKED_CIDRS
= [
// IPv4
'0.0.0.0/8',
'10.0.0.0/8',
'100.64.0.0/10',
'127.0.0.0/8',
'169.254.0.0/16',
'172.16.0.0/12',
'192.0.0.0/24',
'192.0.2.0/24',
'192.88.99.0/24',
'192.168.0.0/16',
'198.18.0.0/15',
'198.51.100.0/24',
'203.0.113.0/24',
'224.0.0.0/4',
'240.0.0.0/4',
'255.255.255.255/32',
// IPv6
'::/128',
'::1/128',
'::ffff:0:0/96',
'64:ff9b::/96',
'64:ff9b:1::/48',
'100::/64',
'2001::/23',
'2001:db8::/32',
'2002::/16',
'fc00::/7',
'fe80::/10',
'fec0::/10',
'ff00::/8',
]
Methods
isPublic()
public
static isPublic(string $ip) : bool
Parameters
- $ip : string
Return values
boolextractEmbeddedIpv4()
Extracts an IPv4 embedded in IPv6: mapped `::ffff:a.b.c.d`, compatible `::a.b.c.d`, NAT64 `64:ff9b::a.b.c.d` and 6to4 `2002:AABB:CCDD::`. Returns `null` when the address carries none.
private
static extractEmbeddedIpv4(string $packed) : string|null
Parameters
- $packed : string
Return values
string|nullisInCidr()
private
static isInCidr(string $packed, string $cidr) : bool
Parameters
- $packed : string
- $cidr : string