X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=includes%2FIP.php;h=1828249889bfc025f791674df91b36cbe48a0e82;hb=39853ea6774694106900638d19b0d65e770b85bf;hp=b2f4874eba1ff6b6e7ae898fbb1e1cf2da7d34df;hpb=ff84f68f6a394b08384e2c78618fe755872224fa;p=lhc%2Fweb%2Fwiklou.git

diff --git a/includes/IP.php b/includes/IP.php
index b2f4874eba..1828249889 100644
--- a/includes/IP.php
+++ b/includes/IP.php
@@ -18,42 +18,52 @@
  * http://www.gnu.org/copyleft/gpl.html
  *
  * @file
- * @author Ashar Voultoiz <hashar at free dot fr>, Aaron Schulz
+ * @author Antoine Musso <hashar at free dot fr>, Aaron Schulz
  */
 
 // Some regex definition to "play" with IP address and IP address blocks
 
-// An IP is made of 4 bytes from x00 to xFF which is d0 to d255
+// An IPv4 address is made of 4 bytes from x00 to xFF which is d0 to d255
 define( 'RE_IP_BYTE', '(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|0?[0-9]?[0-9])' );
-define( 'RE_IP_ADD' , RE_IP_BYTE . '\.' . RE_IP_BYTE . '\.' . RE_IP_BYTE . '\.' . RE_IP_BYTE );
+define( 'RE_IP_ADD', RE_IP_BYTE . '\.' . RE_IP_BYTE . '\.' . RE_IP_BYTE . '\.' . RE_IP_BYTE );
 // An IPv4 block is an IP address and a prefix (d1 to d32)
 define( 'RE_IP_PREFIX', '(3[0-2]|[12]?\d)' );
 define( 'RE_IP_BLOCK', RE_IP_ADD . '\/' . RE_IP_PREFIX );
-// For IPv6 canonicalization (NOT for strict validation; these are quite lax!)
+
+// An IPv6 address is made up of 8 words (each x0000 to xFFFF).
+// However, the "::" abbreviation can be used on consecutive x0000 words.
 define( 'RE_IPV6_WORD', '([0-9A-Fa-f]{1,4})' );
-define( 'RE_IPV6_GAP', ':(?:0+:)*(?::(?:0+:)*)?' );
-define( 'RE_IPV6_V4_PREFIX', '0*' . RE_IPV6_GAP . '(?:ffff:)?' );
-// An IPv6 block is an IP address and a prefix (d1 to d128)
 define( 'RE_IPV6_PREFIX', '(12[0-8]|1[01][0-9]|[1-9]?\d)');
-// An IPv6 address is made up of 8 octets. However, the "::" abbreviations can be used.
 define( 'RE_IPV6_ADD',
-	'(' . // starts with "::" (includes the address "::")
-		'(::|:(:' . RE_IPV6_WORD . '){1,7})' .
-	'|' . // ends with "::" (not including the address "::")
-		RE_IPV6_WORD . '(:' . RE_IPV6_WORD . '){0,6}::' .
-	'|' . // has no "::"
-		RE_IPV6_WORD . '(:' . RE_IPV6_WORD . '){7}' .
-	'|' . // contains one "::" in the middle ("^" check always fails if no "::" found)
-		RE_IPV6_WORD . '(:(?P<abbr>(?(abbr)|:))?' . RE_IPV6_WORD . '){1,6}(?(abbr)|^)' .
+	'(?:' . // starts with "::" (including "::")
+		':(?::|(?::' . RE_IPV6_WORD . '){1,7})' .
+	'|' . // ends with "::" (except "::")
+		RE_IPV6_WORD . '(?::' . RE_IPV6_WORD . '){0,6}::' .
+	'|' . // contains one "::" in the middle, ending in "::WORD"
+		RE_IPV6_WORD . '(?::' . RE_IPV6_WORD . '){0,5}' . '::' . RE_IPV6_WORD .
+	'|' . // contains one "::" in the middle, not ending in "::WORD" (regex for PCRE 4.0+)
+		RE_IPV6_WORD . '(?::(?P<abn>:(?P<iabn>))?' . RE_IPV6_WORD . '(?!:(?P=abn))){1,5}' .
+			':' . RE_IPV6_WORD . '(?P=iabn)' .
+		// NOTE: (?!(?P=abn)) fails iff "::" used twice; (?P=iabn) passes iff a "::" was found.
+	'|' . // contains no "::"
+		RE_IPV6_WORD . '(?::' . RE_IPV6_WORD . '){7}' .
 	')'
+	// NOTE: With PCRE 7.2+, we can combine the two '"::" in the middle' cases into:
+	//		RE_IPV6_WORD . '(?::((?(-1)|:))?' . RE_IPV6_WORD . '){1,6}(?(-2)|^)'
+	// This also improves regex concatenation by using relative references.
 );
+// An IPv6 block is an IP address and a prefix (d1 to d128)
 define( 'RE_IPV6_BLOCK', RE_IPV6_ADD . '\/' . RE_IPV6_PREFIX );
+// For IPv6 canonicalization (NOT for strict validation; these are quite lax!)
+define( 'RE_IPV6_GAP', ':(?:0+:)*(?::(?:0+:)*)?' );
+define( 'RE_IPV6_V4_PREFIX', '0*' . RE_IPV6_GAP . '(?:ffff:)?' );
+
 // This might be useful for regexps used elsewhere, matches any IPv6 or IPv6 address or network
 define( 'IP_ADDRESS_STRING',
 	'(?:' .
-		RE_IP_ADD . '(\/' . RE_IP_PREFIX . '|)' . // IPv4
+		RE_IP_ADD . '(?:\/' . RE_IP_PREFIX . ')?' . // IPv4
 	'|' .
-		RE_IPV6_ADD . '(\/' . RE_IPV6_PREFIX . '|)' . // IPv6
+		RE_IPV6_ADD . '(?:\/' . RE_IPV6_PREFIX . ')?' . // IPv6
 	')'
 );
 
@@ -63,10 +73,12 @@ define( 'IP_ADDRESS_STRING',
  */
 class IP {
 	/**
-	 * Given a string, determine if it as valid IP.
-	 * Note: Unlike isValid(), this looks for networks too.
-	 * @param string $ip possible IP address
-	 * @return bool
+	 * Determine if a string is as valid IP address or network (CIDR prefix).
+	 * SIIT IPv4-translated addresses are rejected.
+	 * Note: canonicalize() tries to convert translated addresses to IPv4.
+	 *
+	 * @param $ip String: possible IP address
+	 * @return Boolean
 	 */
 	public static function isIPAddress( $ip ) {
 		return (bool)preg_match( '/^' . IP_ADDRESS_STRING . '$/', $ip );
@@ -75,69 +87,58 @@ class IP {
 	/**
 	 * Given a string, determine if it as valid IP in IPv6 only.
 	 * Note: Unlike isValid(), this looks for networks too.
-	 * @param string $ip possible IP address
-	 * @return bool
+	 *
+	 * @param $ip String: possible IP address
+	 * @return Boolean
 	 */
 	public static function isIPv6( $ip ) {
-		return (bool)preg_match( '/^' . RE_IPV6_ADD . '(\/' . RE_IPV6_PREFIX . '|)$/', $ip );
+		return (bool)preg_match( '/^' . RE_IPV6_ADD . '(?:\/' . RE_IPV6_PREFIX . ')?$/', $ip );
 	}
 
 	/**
 	 * Given a string, determine if it as valid IP in IPv4 only.
 	 * Note: Unlike isValid(), this looks for networks too.
-	 * @param string $ip possible IP address
-	 * @return bool
+	 *
+	 * @param $ip String: possible IP address
+	 * @return Boolean
 	 */
 	public static function isIPv4( $ip ) {
-		return (bool)preg_match( '/^' . RE_IP_ADD . '(\/' . RE_IP_PREFIX . '|)$/', $ip );
+		return (bool)preg_match( '/^' . RE_IP_ADD . '(?:\/' . RE_IP_PREFIX . ')?$/', $ip );
 	}
 
 	/**
-	 * Given an IP address in dotted-quad notation, returns an IPv6 octet.
-	 * See http://www.answers.com/topic/ipv4-compatible-address
-	 * IPs with the first 92 bits as zeros are reserved from IPv6
-	 * @param string $ip quad-dotted IP address.
-	 * @return string
+	 * Validate an IP address. Ranges are NOT considered valid.
+	 * SIIT IPv4-translated addresses are rejected.
+	 * Note: canonicalize() tries to convert translated addresses to IPv4.
+	 *
+	 * @param $ip String
+	 * @return Boolean: True if it is valid.
 	 */
-	public static function IPv4toIPv6( $ip ) {
-		if ( !$ip ) {
-			return null;
-		}
-		// Convert only if needed
-		if ( self::isIPv6( $ip ) ) {
-			return $ip;
-		}
-		// IPv4 address with CIDR
-		if ( strpos( $ip, '/' ) !== false ) {
-			$parts = explode( '/', $ip, 2 );
-			if ( count( $parts ) != 2 ) {
-				return false;
-			}
-			list( $network, $bits ) = $parts;
-			$network = self::toUnsigned( $network );
-			if ( $network !== false && is_numeric( $bits ) && $bits >= 0 && $bits <= 32 ) {
-				$bits += 96;
-				return self::toOctet( $network ) . "/$bits";
-			} else {
-				return false;
-			}
-		}
-		return self::toOctet( self::toUnsigned( $ip ) );
+	public static function isValid( $ip ) {
+		return ( preg_match( '/^' . RE_IP_ADD . '$/', $ip )
+			|| preg_match( '/^' . RE_IPV6_ADD . '$/', $ip ) );
 	}
 
-	private static function toUnsigned6( $ip ) {
-		if ( self::isIPv6( $ip ) ) {
-			return wfBaseConvert( self::IPv6ToRawHex( $ip ), 16, 10 );
-		}
-		return false;
+	/**
+	 * Validate an IP Block (valid address WITH a valid prefix).
+	 * SIIT IPv4-translated addresses are rejected.
+	 * Note: canonicalize() tries to convert translated addresses to IPv4.
+	 *
+	 * @param $ipblock String
+	 * @return Boolean: True if it is valid.
+	 */
+	public static function isValidBlock( $ipblock ) {
+		return ( preg_match( '/^' . RE_IPV6_BLOCK . '$/', $ipblock )
+			|| preg_match( '/^' . RE_IP_BLOCK . '$/', $ipblock ) );
 	}
 
 	/**
-	 * Convert an IP into a nice standard form.
-	 * IPv6 addresses in octet notation are expanded to 8 octets.
+	 * Convert an IP into a verbose, uppercase, normalized form.
+	 * IPv6 addresses in octet notation are expanded to 8 words.
 	 * IPv4 addresses are just trimmed.
-	 * @param string $ip IP address in quad or octet form (CIDR or not).
-	 * @return string
+	 *
+	 * @param $ip String: IP address in quad or octet form (CIDR or not).
+	 * @return String
 	 */
 	public static function sanitizeIP( $ip ) {
 		$ip = trim( $ip );
@@ -159,12 +160,12 @@ class IP {
 				? $CIDRStart - 1
 				: strlen( $ip ) - 1;
 			// If the '::' is at the beginning...
-			if( $abbrevPos == 0 ) {
+			if ( $abbrevPos == 0 ) {
 				$repeat = '0:';
 				$extra = ( $ip == '::' ) ? '0' : ''; // for the address '::'
 				$pad = 9; // 7+2 (due to '::')
 			// If the '::' is at the end...
-			} elseif( $abbrevPos == ( $addressEnd - 1 ) ) {
+			} elseif ( $abbrevPos == ( $addressEnd - 1 ) ) {
 				$repeat = ':0';
 				$extra = '';
 				$pad = 9; // 7+2 (due to '::')
@@ -180,24 +181,143 @@ class IP {
 			);
 		}
 		// Remove leading zereos from each bloc as needed
-		$ip = preg_replace( '/(^|:)0+' . RE_IPV6_WORD . '/', '$1$2', $ip );
+		$ip = preg_replace( '/(^|:)0+(' . RE_IPV6_WORD . ')/', '$1$2', $ip );
 		return $ip;
 	}
 
 	/**
-	 * Given an unsigned integer, returns an IPv6 address in octet notation
-	 * @param string $ip_int IP address.
+	 * Prettify an IP for display to end users.
+	 * This will make it more compact and lower-case.
+	 *
+	 * @param $ip string
+	 * @return string
+	 */
+	public static function prettifyIP( $ip ) {
+		$ip = self::sanitizeIP( $ip ); // normalize (removes '::')
+		if ( self::isIPv6( $ip ) ) {
+			// Split IP into an address and a CIDR
+			if ( strpos( $ip, '/' ) !== false ) {
+				list( $ip, $cidr ) = explode( '/', $ip, 2 );
+			} else {
+				list( $ip, $cidr ) = array( $ip, '' );
+			}
+			// Get the largest slice of words with multiple zeros
+			$offset = 0;
+			$longest = $longestPos = false;
+			while ( preg_match(
+				'!(?:^|:)0(?::0)+(?:$|:)!', $ip, $m, PREG_OFFSET_CAPTURE, $offset
+			) ) {
+				list( $match, $pos ) = $m[0]; // full match
+				if ( strlen( $match ) > strlen( $longest ) ) {
+					$longest = $match;
+					$longestPos = $pos;
+				}
+				$offset += ( $pos + strlen( $match ) ); // advance
+			}
+			if ( $longest !== false ) {
+				// Replace this portion of the string with the '::' abbreviation
+				$ip = substr_replace( $ip, '::', $longestPos, strlen( $longest ) );
+			}
+			// Add any CIDR back on
+			if ( $cidr !== '' ) {
+				$ip = "{$ip}/{$cidr}";
+			}
+			// Convert to lower case to make it more readable
+			$ip = strtolower( $ip );
+		}
+		return $ip;
+	}
+
+	/**
+	 * Given a host/port string, like one might find in the host part of a URL
+	 * per RFC 2732, split the hostname part and the port part and return an
+	 * array with an element for each. If there is no port part, the array will
+	 * have false in place of the port. If the string was invalid in some way,
+	 * false is returned.
+	 *
+	 * This was easy with IPv4 and was generally done in an ad-hoc way, but
+	 * with IPv6 it's somewhat more complicated due to the need to parse the
+	 * square brackets and colons.
+	 *
+	 * A bare IPv6 address is accepted despite the lack of square brackets.
+	 *
+	 * @param $both string The string with the host and port
+	 * @return array
+	 */
+	public static function splitHostAndPort( $both ) {
+		if ( substr( $both, 0, 1 ) === '[' ) {
+			if ( preg_match( '/^\[(' . RE_IPV6_ADD . ')\](?::(?P<port>\d+))?$/', $both, $m ) ) {
+				if ( isset( $m['port'] ) ) {
+					return array( $m[1], intval( $m['port'] ) );
+				} else {
+					return array( $m[1], false );
+				}
+			} else {
+				// Square bracket found but no IPv6
+				return false;
+			}
+		}
+		$numColons = substr_count( $both, ':' );
+		if ( $numColons >= 2 ) {
+			// Is it a bare IPv6 address?
+			if ( preg_match( '/^' . RE_IPV6_ADD . '$/', $both ) ) {
+				return array( $both, false );
+			} else {
+				// Not valid IPv6, but too many colons for anything else
+				return false;
+			}
+		}
+		if ( $numColons >= 1 ) {
+			// Host:port?
+			$bits = explode( ':', $both );
+			if ( preg_match( '/^\d+/', $bits[1] ) ) {
+				return array( $bits[0], intval( $bits[1] ) );
+			} else {
+				// Not a valid port
+				return false;
+			}
+		}
+		// Plain hostname
+		return array( $both, false );
+	}
+
+	/**
+	 * Given a host name and a port, combine them into host/port string like
+	 * you might find in a URL. If the host contains a colon, wrap it in square
+	 * brackets like in RFC 2732. If the port matches the default port, omit
+	 * the port specification
+	 *
+	 * @param $host string
+	 * @param $port int
+	 * @param $defaultPort bool|int
 	 * @return string
 	 */
+	public static function combineHostAndPort( $host, $port, $defaultPort = false ) {
+		if ( strpos( $host, ':' ) !== false ) {
+			$host = "[$host]";
+		}
+		if ( $defaultPort !== false && $port == $defaultPort ) {
+			return $host;
+		} else {
+			return "$host:$port";
+		}
+	}
+
+	/**
+	 * Given an unsigned integer, returns an IPv6 address in octet notation
+	 *
+	 * @param $ip_int String: IP address.
+	 * @return String
+	 */
 	public static function toOctet( $ip_int ) {
-		$ip_hex = wfBaseConvert( $ip_int, 10, 16, 32, false ); // uppercase hex
-		return self::hexToOctet( $ip_hex );
+		return self::hexToOctet( wfBaseConvert( $ip_int, 10, 16, 32, false ) );
 	}
 
 	/**
 	 * Convert an IPv4 or IPv6 hexadecimal representation back to readable format
-	 * @param string $hex number, with "v6-" prefix if it is IPv6
-	 * @return string quad-dotted (IPv4) or octet notation (IPv6)
+	 *
+	 * @param $hex String: number, with "v6-" prefix if it is IPv6
+	 * @return String: quad-dotted (IPv4) or octet notation (IPv6)
 	 */
 	public static function formatHex( $hex ) {
 		if ( substr( $hex, 0, 3 ) == 'v6-' ) { // IPv6
@@ -209,29 +329,31 @@ class IP {
 
 	/**
 	 * Converts a hexadecimal number to an IPv6 address in octet notation
-	 * @param string $ip_hex pure hex (no v6- prefix)
-	 * @return string (of format a:b:c:d:e:f:g:h)
+	 *
+	 * @param $ip_hex String: pure hex (no v6- prefix)
+	 * @return String (of format a:b:c:d:e:f:g:h)
 	 */
 	public static function hexToOctet( $ip_hex ) {
-		// Convert to padded uppercase hex
+		// Pad hex to 32 chars (128 bits)
 		$ip_hex = str_pad( strtoupper( $ip_hex ), 32, '0', STR_PAD_LEFT );
-		// Separate into 8 octets
+		// Separate into 8 words
 		$ip_oct = substr( $ip_hex, 0, 4 );
 		for ( $n = 1; $n < 8; $n++ ) {
 			$ip_oct .= ':' . substr( $ip_hex, 4 * $n, 4 );
 		}
 		// NO leading zeroes
-		$ip_oct = preg_replace( '/(^|:)0+' . RE_IPV6_WORD . '/', '$1$2', $ip_oct );
+		$ip_oct = preg_replace( '/(^|:)0+(' . RE_IPV6_WORD . ')/', '$1$2', $ip_oct );
 		return $ip_oct;
 	}
 
 	/**
 	 * Converts a hexadecimal number to an IPv4 address in quad-dotted notation
-	 * @param string $ip_hex pure hex
-	 * @return string (of format a.b.c.d)
+	 *
+	 * @param $ip_hex String: pure hex
+	 * @return String (of format a.b.c.d)
 	 */
 	public static function hexToQuad( $ip_hex ) {
-		// Convert to padded uppercase hex
+		// Pad hex to 8 chars (32 bits)
 		$ip_hex = str_pad( strtoupper( $ip_hex ), 8, '0', STR_PAD_LEFT );
 		// Separate into four quads
 		$s = '';
@@ -244,119 +366,13 @@ class IP {
 		return $s;
 	}
 
-	/**
-	 * Convert a network specification in IPv6 CIDR notation to an
-	 * integer network and a number of bits
-	 * @return array(string, int)
-	 */
-	private static function parseCIDR6( $range ) {
-		# Explode into <expanded IP,range>
-		$parts = explode( '/', IP::sanitizeIP( $range ), 2 );
-		if ( count( $parts ) != 2 ) {
-			return array( false, false );
-		}
-		list( $network, $bits ) = $parts;
-		$network = self::IPv6ToRawHex( $network );
-		if ( $network !== false && is_numeric( $bits ) && $bits >= 0 && $bits <= 128 ) {
-			if ( $bits == 0 ) {
-				$network = "0";
-			} else {
-				# Native 32 bit functions WONT work here!!!
-				# Convert to a padded binary number
-				$network = wfBaseConvert( $network, 16, 2, 128 );
-				# Truncate the last (128-$bits) bits and replace them with zeros
-				$network = str_pad( substr( $network, 0, $bits ), 128, 0, STR_PAD_RIGHT );
-				# Convert back to an integer
-				$network = wfBaseConvert( $network, 2, 10 );
-			}
-		} else {
-			$network = false;
-			$bits = false;
-		}
-		return array( $network, (int)$bits );
-	}
-
-	/**
-	 * Given a string range in a number of formats, return the
-	 * start and end of the range in hexadecimal. For IPv6.
-	 *
-	 * Formats are:
-	 *     2001:0db8:85a3::7344/96          			 CIDR
-	 *     2001:0db8:85a3::7344 - 2001:0db8:85a3::7344   Explicit range
-	 *     2001:0db8:85a3::7344/96             			 Single IP
-	 * @return array(string, int)
-	 */
-	private static function parseRange6( $range ) {
-		# Expand any IPv6 IP
-		$range = IP::sanitizeIP( $range );
-		// CIDR notation...
-		if ( strpos( $range, '/' ) !== false ) {
-			list( $network, $bits ) = self::parseCIDR6( $range );
-			if ( $network === false ) {
-				$start = $end = false;
-			} else {
-				$start = wfBaseConvert( $network, 10, 16, 32, false );
-				# Turn network to binary (again)
-				$end = wfBaseConvert( $network, 10, 2, 128 );
-				# Truncate the last (128-$bits) bits and replace them with ones
-				$end = str_pad( substr( $end, 0, $bits ), 128, 1, STR_PAD_RIGHT );
-				# Convert to hex
-				$end = wfBaseConvert( $end, 2, 16, 32, false );
-				# see toHex() comment
-				$start = "v6-$start";
-				$end = "v6-$end";
-			}
-		// Explicit range notation...
-		} elseif ( strpos( $range, '-' ) !== false ) {
-			list( $start, $end ) = array_map( 'trim', explode( '-', $range, 2 ) );
-			$start = self::toUnsigned6( $start );
-			$end = self::toUnsigned6( $end );
-			if ( $start > $end ) {
-				$start = $end = false;
-			} else {
-				$start = wfBaseConvert( $start, 10, 16, 32, false );
-				$end = wfBaseConvert( $end, 10, 16, 32, false );
-			}
-			# see toHex() comment
-			$start = "v6-$start";
-			$end = "v6-$end";
-		} else {
-			# Single IP
-			$start = $end = self::toHex( $range );
-		}
-		if ( $start === false || $end === false ) {
-			return array( false, false );
-		} else {
-			return array( $start, $end );
-		}
-	}
-
-	/**
-	 * Validate an IP address. Ranges are NOT considered valid.
-	 * @param string $ip
-	 * @return boolean True if it is valid.
-	 */
-	public static function isValid( $ip ) {
-		return ( preg_match( '/^' . RE_IP_ADD . '$/', $ip )
-			|| preg_match( '/^' . RE_IPV6_ADD . '$/', $ip ) );
-	}
-
-	/**
-	 * Validate an IP Block (valid address WITH a valid prefix).
-	 * @param string $ipblock
-	 * @return boolean True if it is valid.
-	 */
-	public static function isValidBlock( $ipblock ) {
-		return ( preg_match( '/^' . RE_IPV6_BLOCK . '$/', $ipblock )
-			|| preg_match( '/^' . RE_IPV4_BLOCK . '$/', $ipblock ) );
-	}
-
 	/**
 	 * Determine if an IP address really is an IP address, and if it is public,
 	 * i.e. not RFC 1918 or similar
 	 * Comes from ProxyTools.php
-	 * @param string $ip
-	 * @return bool
+	 *
+	 * @param $ip String
+	 * @return Boolean
 	 */
 	public static function isPublic( $ip ) {
 		if ( self::isIPv6( $ip ) ) {
@@ -369,7 +385,7 @@ class IP {
 
 		// ip2long accepts incomplete addresses, as well as some addresses
 		// followed by garbage characters. Check that it's really valid.
-		if( $ip != long2ip( $n ) ) {
+		if ( $ip != long2ip( $n ) ) {
 			return false;
 		}
 
@@ -397,15 +413,16 @@ class IP {
 	/**
 	 * Determine if an IPv6 address really is an IP address, and if it is public,
 	 * i.e. not RFC 4193 or similar
-	 * @param string $ip
-	 * @return bool
+	 *
+	 * @param $ip String
+	 * @return Boolean
 	 */
 	private static function isPublic6( $ip ) {
 		static $privateRanges = false;
 		if ( !$privateRanges ) {
 			$privateRanges = array(
-				array( 'fc::', 'fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff' ), # RFC 4193 (local)
-				array( '0:0:0:0:0:0:0:1', '0:0:0:0:0:0:0:1' ),  # loopback
+				array( 'fc00::', 'fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff' ), # RFC 4193 (local)
+				array( '0:0:0:0:0:0:0:1', '0:0:0:0:0:0:0:1' ), # loopback
 			);
 		}
 		$n = self::toHex( $ip );
@@ -427,8 +444,8 @@ class IP {
 	 * function for an IPv6 address will be prefixed with "v6-", a non-
 	 * hexadecimal string which sorts after the IPv4 addresses.
 	 *
-	 * @param string $ip Quad dotted/octet IP address.
-	 * @return string
+	 * @param $ip String: quad dotted/octet IP address.
+	 * @return String
 	 */
 	public static function toHex( $ip ) {
 		if ( self::isIPv6( $ip ) ) {
@@ -442,36 +459,11 @@ class IP {
 		return $n;
 	}
 
-	/**
-	 * Given an IP address in dotted-quad/octet notation, returns an unsigned integer.
-	 * Like ip2long() except that it actually works and has a consistent error return value.
-	 * Comes from ProxyTools.php
-	 * @param string $ip Quad dotted IP address.
-	 * @return mixed (string/int/false)
-	 */
-	public static function toUnsigned( $ip ) {
-		if ( self::isIPv6( $ip ) ) {
-			$n = wfBaseConvert( self::IPv6ToRawHex( $ip ), 16, 10 );
-		} else {
-			if ( $ip == '255.255.255.255' ) {
-				$n = -1;
-			} else {
-				$n = ip2long( $ip );
-				if ( $n == -1 || $n === false ) { # Return value on error depends on PHP version
-					$n = false;
-				}
-			}
-			if ( $n < 0 ) {
-				$n += pow( 2, 32 );
-			}
-		}
-		return $n;
-	}
-
 	/**
 	 * Given an IPv6 address in octet notation, returns a pure hex string.
-	 * @param string $ip octet ipv6 IP address.
-	 * @return string hex (uppercase)
+	 *
+	 * @param $ip String: octet ipv6 IP address.
+	 * @return String: pure hex (uppercase)
 	 */
 	private static function IPv6ToRawHex( $ip ) {
 		$ip = self::sanitizeIP( $ip );
@@ -486,34 +478,50 @@ class IP {
 	}
 
 	/**
-	 * Convert a dotted-quad IP to a signed integer
-	 * @param string $ip
-	 * @return mixed (string/false)
+	 * Given an IP address in dotted-quad/octet notation, returns an unsigned integer.
+	 * Like ip2long() except that it actually works and has a consistent error return value.
+	 * Comes from ProxyTools.php
+	 *
+	 * @param $ip String: quad dotted IP address.
+	 * @return Mixed: string/int/false
 	 */
-	public static function toSigned( $ip ) {
-		if ( $ip == '255.255.255.255' ) {
-			$n = -1;
+	public static function toUnsigned( $ip ) {
+		if ( self::isIPv6( $ip ) ) {
+			$n = self::toUnsigned6( $ip );
 		} else {
 			$n = ip2long( $ip );
-			if ( $n == -1 ) {
-				$n = false;
+			if ( $n < 0 ) {
+				$n += pow( 2, 32 );
 			}
 		}
 		return $n;
 	}
 
 	/**
-	 * Convert a network specification in CIDR notation to an integer network and a number of bits
-	 * @param string $range (CIDR IP)
-	 * @return array(int, int)
+	 * @param $ip
+	 * @return String
+	 */
+	private static function toUnsigned6( $ip ) {
+		return wfBaseConvert( self::IPv6ToRawHex( $ip ), 16, 10 );
+	}
+
+	/**
+	 * Convert a network specification in CIDR notation
+	 * to an integer network and a number of bits
+	 *
+	 * @param $range String: IP with CIDR prefix
+	 * @return array(int or string, int)
 	 */
 	public static function parseCIDR( $range ) {
+		if ( self::isIPv6( $range ) ) {
+			return self::parseCIDR6( $range );
+		}
 		$parts = explode( '/', $range, 2 );
 		if ( count( $parts ) != 2 ) {
 			return array( false, false );
 		}
 		list( $network, $bits ) = $parts;
-		$network = self::toSigned( $network );
+		$network = ip2long( $network );
 		if ( $network !== false && is_numeric( $bits ) && $bits >= 0 && $bits <= 32 ) {
 			if ( $bits == 0 ) {
 				$network = 0;
@@ -532,8 +540,8 @@ class IP {
 	}
 
 	/**
-	 * Given a string range in a number of formats, return the start and end of
-	 * the range in hexadecimal.
+	 * Given a string range in a number of formats,
+	 * return the start and end of the range in hexadecimal.
 	 *
 	 * Formats are:
 	 *     1.2.3.4/24          CIDR
@@ -543,16 +551,15 @@ class IP {
 	 *     2001:0db8:85a3::7344/96          			 CIDR
 	 *     2001:0db8:85a3::7344 - 2001:0db8:85a3::7344   Explicit range
 	 *     2001:0db8:85a3::7344             			 Single IP
-	 * @param string $range IP range
-	 * @return array(string, int)
+	 * @param $range String: IP range
+	 * @return array(string, string)
 	 */
 	public static function parseRange( $range ) {
-		// Use IPv6 functions if needed
-		if ( self::isIPv6( $range ) ) {
-			return self::parseRange6( $range );
-		}
+		// CIDR notation
 		if ( strpos( $range, '/' ) !== false ) {
-			# CIDR
+			if ( self::isIPv6( $range ) ) {
+				return self::parseRange6( $range );
+			}
 			list( $network, $bits ) = self::parseCIDR( $range );
 			if ( $network === false ) {
 				$start = $end = false;
@@ -560,10 +567,13 @@ class IP {
 				$start = sprintf( '%08X', $network );
 				$end = sprintf( '%08X', $network + pow( 2, ( 32 - $bits ) ) - 1 );
 			}
+		// Explicit range
 		} elseif ( strpos( $range, '-' ) !== false ) {
-			# Explicit range
 			list( $start, $end ) = array_map( 'trim', explode( '-', $range, 2 ) );
-			if( self::isIPAddress( $start ) && self::isIPAddress( $end ) ) {
+			if ( self::isIPv6( $start ) && self::isIPv6( $end ) ) {
+				return self::parseRange6( $range );
+			}
+			if ( self::isIPv4( $start ) && self::isIPv4( $end ) ) {
 				$start = self::toUnsigned( $start );
 				$end = self::toUnsigned( $end );
 				if ( $start > $end ) {
@@ -586,11 +596,105 @@ class IP {
 		}
 	}
 
+	/**
+	 * Convert a network specification in IPv6 CIDR notation to an
+	 * integer network and a number of bits
+	 *
+	 * @param $range
+	 *
+	 * @return array(string, int)
+	 */
+	private static function parseCIDR6( $range ) {
+		# Explode into <expanded IP,range>
+		$parts = explode( '/', IP::sanitizeIP( $range ), 2 );
+		if ( count( $parts ) != 2 ) {
+			return array( false, false );
+		}
+		list( $network, $bits ) = $parts;
+		$network = self::IPv6ToRawHex( $network );
+		if ( $network !== false && is_numeric( $bits ) && $bits >= 0 && $bits <= 128 ) {
+			if ( $bits == 0 ) {
+				$network = "0";
+			} else {
+				# Native 32 bit functions WONT work here!!!
+				# Convert to a padded binary number
+				$network = wfBaseConvert( $network, 16, 2, 128 );
+				# Truncate the last (128-$bits) bits and replace them with zeros
+				$network = str_pad( substr( $network, 0, $bits ), 128, 0, STR_PAD_RIGHT );
+				# Convert back to an integer
+				$network = wfBaseConvert( $network, 2, 10 );
+			}
+		} else {
+			$network = false;
+			$bits = false;
+		}
+		return array( $network, (int)$bits );
+	}
+
+	/**
+	 * Given a string range in a number of formats, return the
+	 * start and end of the range in hexadecimal. For IPv6.
+	 *
+	 * Formats are:
+	 *     2001:0db8:85a3::7344/96          			 CIDR
+	 *     2001:0db8:85a3::7344 - 2001:0db8:85a3::7344   Explicit range
+	 *     2001:0db8:85a3::7344/96             			 Single IP
+	 *
+	 * @param $range
+	 *
+	 * @return array(string, string)
+	 */
+	private static function parseRange6( $range ) {
+		# Expand any IPv6 IP
+		$range = IP::sanitizeIP( $range );
+		// CIDR notation...
+		if ( strpos( $range, '/' ) !== false ) {
+			list( $network, $bits ) = self::parseCIDR6( $range );
+			if ( $network === false ) {
+				$start = $end = false;
+			} else {
+				$start = wfBaseConvert( $network, 10, 16, 32, false );
+				# Turn network to binary (again)
+				$end = wfBaseConvert( $network, 10, 2, 128 );
+				# Truncate the last (128-$bits) bits and replace them with ones
+				$end = str_pad( substr( $end, 0, $bits ), 128, 1, STR_PAD_RIGHT );
+				# Convert to hex
+				$end = wfBaseConvert( $end, 2, 16, 32, false );
+				# see toHex() comment
+				$start = "v6-$start";
+				$end = "v6-$end";
+			}
+		// Explicit range notation...
+		} elseif ( strpos( $range, '-' ) !== false ) {
+			list( $start, $end ) = array_map( 'trim', explode( '-', $range, 2 ) );
+			$start = self::toUnsigned6( $start );
+			$end = self::toUnsigned6( $end );
+			if ( $start > $end ) {
+				$start = $end = false;
+			} else {
+				$start = wfBaseConvert( $start, 10, 16, 32, false );
+				$end = wfBaseConvert( $end, 10, 16, 32, false );
+			}
+			# see toHex() comment
+			$start = "v6-$start";
+			$end = "v6-$end";
+		} else {
+			# Single IP
+			$start = $end = self::toHex( $range );
+		}
+		if ( $start === false || $end === false ) {
+			return array( false, false );
+		} else {
+			return array( $start, $end );
+		}
+	}
+
 	/**
 	 * Determine if a given IPv4/IPv6 address is in a given CIDR network
-	 * @param $addr The address to check against the given range.
-	 * @param $range The range to check the given address against.
-	 * @return bool Whether or not the given address is in the given range.
+	 *
+	 * @param $addr String: the address to check against the given range.
+	 * @param $range String: the range to check the given address against.
+	 * @return Boolean: whether or not the given address is in the given range.
 	 */
 	public static function isInRange( $addr, $range ) {
 		$hexIP = self::toHex( $addr );
@@ -606,36 +710,51 @@ class IP {
 	 * This currently only checks a few IPV4-to-IPv6 related cases.  More
 	 * unusual representations may be added later.
 	 *
-	 * @param $addr something that might be an IP address
-	 * @return valid dotted quad IPv4 address or null
+	 * @param $addr String: something that might be an IP address
+	 * @return String: valid dotted quad IPv4 address or null
 	 */
 	public static function canonicalize( $addr ) {
 		if ( self::isValid( $addr ) ) {
 			return $addr;
 		}
-
 		// Turn mapped addresses from ::ce:ffff:1.2.3.4 to 1.2.3.4
 		if ( strpos( $addr, ':' ) !== false && strpos( $addr, '.' ) !== false ) {
 			$addr = substr( $addr, strrpos( $addr, ':' ) + 1 );
-			if( self::isIPv4( $addr ) ) {
+			if ( self::isIPv4( $addr ) ) {
 				return $addr;
 			}
 		}
-
 		// IPv6 loopback address
 		$m = array();
 		if ( preg_match( '/^0*' . RE_IPV6_GAP . '1$/', $addr, $m ) ) {
-	   		return '127.0.0.1';
+			return '127.0.0.1';
 		}
-
 		// IPv4-mapped and IPv4-compatible IPv6 addresses
 		if ( preg_match( '/^' . RE_IPV6_V4_PREFIX . '(' . RE_IP_ADD . ')$/i', $addr, $m ) ) {
 			return $m[1];
 		}
-		if ( preg_match( '/^' . RE_IPV6_V4_PREFIX . RE_IPV6_WORD . ':' . RE_IPV6_WORD . '$/i', $addr, $m ) ) {
+		if ( preg_match( '/^' . RE_IPV6_V4_PREFIX . RE_IPV6_WORD .
+			':' . RE_IPV6_WORD . '$/i', $addr, $m ) )
+		{
 			return long2ip( ( hexdec( $m[1] ) << 16 ) + hexdec( $m[2] ) );
 		}
 
 		return null;  // give up
 	}
+
+	/**
+	 * Gets rid of uneeded numbers in quad-dotted/octet IP strings
+	 * For example, 127.111.113.151/24 -> 127.111.113.0/24
+	 * @param $range String: IP address to normalize
+	 * @return string
+	 */
+	public static function sanitizeRange( $range ) {
+		list( /*...*/, $bits ) = self::parseCIDR( $range );
+		list( $start, /*...*/ ) = self::parseRange( $range );
+		$start = self::formatHex( $start );
+		if ( $bits === false ) {
+			return $start; // wasn't actually a range
+		}
+		return "$start/$bits";
+	}
 }