IPv4 и IPv6

<?php

declare(strict_types=1);

/**
 * IP address and subnet utilities.
 * Useful for network planning in System Design.
 */
final class SubnetCalculator
{
    /**
     * Calculate subnet details from CIDR notation.
     *
     * @return array{
     *     network: string,
     *     broadcast: string,
     *     netmask: string,
     *     hosts: int,
     *     first_host: string,
     *     last_host: string
     * }
     */
    public static function calculate(string $cidr): array
    {
        [$ip, $prefix] = explode('/', $cidr);
        $prefix = (int) $prefix;

        $ipLong = ip2long($ip);
        $netmask = -1 << (32 - $prefix);
        $network = $ipLong & $netmask;
        $broadcast = $network | ~$netmask;

        $hostCount = (1 << (32 - $prefix)) - 2;
        if ($hostCount < 0) {
            $hostCount = 0;
        }

        return [
            'network' => long2ip($network),
            'broadcast' => long2ip($broadcast),
            'netmask' => long2ip($netmask),
            'hosts' => $hostCount,
            'first_host' => long2ip($network + 1),
            'last_host' => long2ip($broadcast - 1),
        ];
    }

    /**
     * Check if an IP is in a given subnet.
     * Common task for ACL and security rules.
     */
    public static function isInSubnet(string $ip, string $cidr): bool
    {
        [$subnet, $prefix] = explode('/', $cidr);
        $prefix = (int) $prefix;

        $ipLong = ip2long($ip);
        $subnetLong = ip2long($subnet);
        $mask = -1 << (32 - $prefix);

        return ($ipLong & $mask) === ($subnetLong & $mask);
    }

    /**
     * Plan VPC subnets for a multi-tier architecture.
     *
     * @return array<string, array{cidr: string, hosts: int, purpose: string}>
     */
    public static function planVpcSubnets(string $vpcCidr = '10.0.0.0/16'): array
    {
        return [
            'public_a' => [
                'cidr' => '10.0.1.0/24',
                'hosts' => 254,
                'purpose' => 'Load balancers, NAT gateways (AZ-a)',
            ],
            'public_b' => [
                'cidr' => '10.0.2.0/24',
                'hosts' => 254,
                'purpose' => 'Load balancers, NAT gateways (AZ-b)',
            ],
            'app_a' => [
                'cidr' => '10.0.10.0/24',
                'hosts' => 254,
                'purpose' => 'Application servers (AZ-a)',
            ],
            'app_b' => [
                'cidr' => '10.0.11.0/24',
                'hosts' => 254,
                'purpose' => 'Application servers (AZ-b)',
            ],
            'db_a' => [
                'cidr' => '10.0.20.0/24',
                'hosts' => 254,
                'purpose' => 'Database servers (AZ-a)',
            ],
            'db_b' => [
                'cidr' => '10.0.21.0/24',
                'hosts' => 254,
                'purpose' => 'Database servers (AZ-b)',
            ],
        ];
    }
}

// Example: calculate subnet
$result = SubnetCalculator::calculate('192.168.1.0/24');
// network: 192.168.1.0, broadcast: 192.168.1.255, hosts: 254

// Check IP in subnet
$inSubnet = SubnetCalculator::isInSubnet('10.0.10.50', '10.0.10.0/24');
// true

package subnet

import (
	"encoding/binary"
	"fmt"
	"net"
	"strconv"
	"strings"
)

// SubnetInfo holds calculated subnet details.
type SubnetInfo struct {
	Network   string
	Broadcast string
	Netmask   string
	Hosts     int
	FirstHost string
	LastHost  string
}

// Calculate returns subnet details from CIDR notation.
func Calculate(cidr string) (SubnetInfo, error) {
	_, ipNet, err := net.ParseCIDR(cidr)
	if err != nil {
		return SubnetInfo{}, fmt.Errorf("parse CIDR: %w", err)
	}

	ones, bits := ipNet.Mask.Size()
	hostCount := (1 << (bits - ones)) - 2
	if hostCount < 0 {
		hostCount = 0
	}

	network := ipNet.IP.To4()
	mask := net.IP(ipNet.Mask).To4()

	// Calculate broadcast: network | ~mask
	broadcast := make(net.IP, 4)
	for i := range 4 {
		broadcast[i] = network[i] | ^mask[i]
	}

	firstHost := incrementIP(network)
	lastHost := decrementIP(broadcast)

	return SubnetInfo{
		Network:   network.String(),
		Broadcast: broadcast.String(),
		Netmask:   mask.String(),
		Hosts:     hostCount,
		FirstHost: firstHost.String(),
		LastHost:  lastHost.String(),
	}, nil
}

// IsInSubnet checks if an IP is within a given CIDR range.
func IsInSubnet(ip, cidr string) (bool, error) {
	_, ipNet, err := net.ParseCIDR(cidr)
	if err != nil {
		return false, fmt.Errorf("parse CIDR: %w", err)
	}
	parsedIP := net.ParseIP(ip)
	if parsedIP == nil {
		return false, fmt.Errorf("invalid IP: %s", ip)
	}
	return ipNet.Contains(parsedIP), nil
}

// VPCSubnet describes a planned VPC subnet.
type VPCSubnet struct {
	CIDR    string
	Hosts   int
	Purpose string
}

// PlanVPCSubnets returns a multi-tier VPC subnet plan.
func PlanVPCSubnets() map[string]VPCSubnet {
	return map[string]VPCSubnet{
		"public_a": {CIDR: "10.0.1.0/24", Hosts: 254, Purpose: "Load balancers, NAT gateways (AZ-a)"},
		"public_b": {CIDR: "10.0.2.0/24", Hosts: 254, Purpose: "Load balancers, NAT gateways (AZ-b)"},
		"app_a":    {CIDR: "10.0.10.0/24", Hosts: 254, Purpose: "Application servers (AZ-a)"},
		"app_b":    {CIDR: "10.0.11.0/24", Hosts: 254, Purpose: "Application servers (AZ-b)"},
		"db_a":     {CIDR: "10.0.20.0/24", Hosts: 254, Purpose: "Database servers (AZ-a)"},
		"db_b":     {CIDR: "10.0.21.0/24", Hosts: 254, Purpose: "Database servers (AZ-b)"},
	}
}

func incrementIP(ip net.IP) net.IP {
	result := make(net.IP, len(ip))
	copy(result, ip)
	n := binary.BigEndian.Uint32(result) + 1
	binary.BigEndian.PutUint32(result, n)
	return result
}

func decrementIP(ip net.IP) net.IP {
	result := make(net.IP, len(ip))
	copy(result, ip)
	n := binary.BigEndian.Uint32(result) - 1
	binary.BigEndian.PutUint32(result, n)
	return result
}

// Suppress unused import warnings
var _ = strconv.Itoa
var _ = strings.Split

using System.Buffers.Binary;
using System.Net;

namespace Networking.Addressing;

public readonly record struct SubnetInfo(
    string Network,
    string Broadcast,
    string Netmask,
    long Hosts,
    string FirstHost,
    string LastHost);

public readonly record struct VpcSubnet(string Cidr, int Hosts, string Purpose);

/// <summary>
/// IP address and subnet utilities.
/// Useful for network planning in System Design.
/// </summary>
public static class SubnetCalculator
{
    /// <summary>Calculate subnet details from CIDR notation.</summary>
    public static SubnetInfo Calculate(string cidr)
    {
        // IPNetwork parses and validates CIDR in one step
        var network = IPNetwork.Parse(cidr);

        if (network.BaseAddress.AddressFamily != System.Net.Sockets.AddressFamily.InterNetwork)
        {
            throw new ArgumentException("IPv4 CIDR expected", nameof(cidr));
        }

        var networkValue = ToUInt32(network.BaseAddress);
        var netmask = network.PrefixLength == 0 ? 0u : uint.MaxValue << (32 - network.PrefixLength);
        var broadcastValue = networkValue | ~netmask;

        var hostCount = Math.Max(0L, (1L << (32 - network.PrefixLength)) - 2);

        return new SubnetInfo(
            Network: network.BaseAddress.ToString(),
            Broadcast: FromUInt32(broadcastValue).ToString(),
            Netmask: FromUInt32(netmask).ToString(),
            Hosts: hostCount,
            FirstHost: FromUInt32(networkValue + 1).ToString(),
            LastHost: FromUInt32(broadcastValue - 1).ToString());
    }

    /// <summary>
    /// Check if an IP is in a given subnet.
    /// Common task for ACL and security rules.
    /// </summary>
    public static bool IsInSubnet(string ip, string cidr) =>
        IPNetwork.Parse(cidr).Contains(IPAddress.Parse(ip));

    /// <summary>Plan VPC subnets for a multi-tier architecture.</summary>
    public static IReadOnlyDictionary<string, VpcSubnet> PlanVpcSubnets() =>
        new Dictionary<string, VpcSubnet>
        {
            ["public_a"] = new("10.0.1.0/24", 254, "Load balancers, NAT gateways (AZ-a)"),
            ["public_b"] = new("10.0.2.0/24", 254, "Load balancers, NAT gateways (AZ-b)"),
            ["app_a"] = new("10.0.10.0/24", 254, "Application servers (AZ-a)"),
            ["app_b"] = new("10.0.11.0/24", 254, "Application servers (AZ-b)"),
            ["db_a"] = new("10.0.20.0/24", 254, "Database servers (AZ-a)"),
            ["db_b"] = new("10.0.21.0/24", 254, "Database servers (AZ-b)"),
        };

    private static uint ToUInt32(IPAddress address) =>
        BinaryPrimitives.ReadUInt32BigEndian(address.GetAddressBytes());

    private static IPAddress FromUInt32(uint value)
    {
        Span<byte> bytes = stackalloc byte[4];
        BinaryPrimitives.WriteUInt32BigEndian(bytes, value);

        return new IPAddress(bytes);
    }
}

// Example: calculate subnet
var result = SubnetCalculator.Calculate("192.168.1.0/24");
// network: 192.168.1.0, broadcast: 192.168.1.255, hosts: 254

// Check IP in subnet
var inSubnet = SubnetCalculator.IsInSubnet("10.0.10.50", "10.0.10.0/24");
// true

from __future__ import annotations

import ipaddress
from typing import NamedTuple

class SubnetInfo(NamedTuple):
    network: str
    broadcast: str
    netmask: str
    hosts: int
    first_host: str
    last_host: str

class VpcSubnet(NamedTuple):
    cidr: str
    hosts: int
    purpose: str

def calculate(cidr: str) -> SubnetInfo:
    """Calculate subnet details from CIDR notation.

    The stdlib ipaddress module does the bit arithmetic, so no manual
    masking is needed - and it validates the input at the same time.
    """
    network = ipaddress.IPv4Network(cidr, strict=False)
    host_count = max(0, network.num_addresses - 2)

    return SubnetInfo(
        network=str(network.network_address),
        broadcast=str(network.broadcast_address),
        netmask=str(network.netmask),
        hosts=host_count,
        first_host=str(network.network_address + 1),
        last_host=str(network.broadcast_address - 1),
    )

def is_in_subnet(ip: str, cidr: str) -> bool:
    """Check if an IP is in a given subnet. Common task for ACL and security rules."""
    return ipaddress.ip_address(ip) in ipaddress.ip_network(cidr, strict=False)

def plan_vpc_subnets() -> dict[str, VpcSubnet]:
    """Plan VPC subnets for a multi-tier architecture."""
    return {
        "public_a": VpcSubnet("10.0.1.0/24", 254, "Load balancers, NAT gateways (AZ-a)"),
        "public_b": VpcSubnet("10.0.2.0/24", 254, "Load balancers, NAT gateways (AZ-b)"),
        "app_a": VpcSubnet("10.0.10.0/24", 254, "Application servers (AZ-a)"),
        "app_b": VpcSubnet("10.0.11.0/24", 254, "Application servers (AZ-b)"),
        "db_a": VpcSubnet("10.0.20.0/24", 254, "Database servers (AZ-a)"),
        "db_b": VpcSubnet("10.0.21.0/24", 254, "Database servers (AZ-b)"),
    }

# Example: calculate subnet
result = calculate("192.168.1.0/24")
# network: 192.168.1.0, broadcast: 192.168.1.255, hosts: 254

# Check IP in subnet
in_subnet = is_in_subnet("10.0.10.50", "10.0.10.0/24")
# True

<?php

declare(strict_types=1);

/**
 * Working with IP addresses in PHP.
 * Support for both IPv4 and IPv6.
 */
final class IpAddressUtils
{
    /**
     * Validate and classify an IP address.
     *
     * @return array{valid: bool, version: int, type: string}
     */
    public static function analyze(string $ip): array
    {
        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
            return [
                'valid' => true,
                'version' => 4,
                'type' => self::classifyIpv4($ip),
            ];
        }

        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
            return [
                'valid' => true,
                'version' => 6,
                'type' => self::classifyIpv6($ip),
            ];
        }

        return ['valid' => false, 'version' => 0, 'type' => 'invalid'];
    }

    /**
     * Check if request comes from a private/internal network.
     * Useful for internal API endpoints that should not be public.
     */
    public static function isPrivate(string $ip): bool
    {
        return !filter_var(
            $ip,
            FILTER_VALIDATE_IP,
            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE,
        );
    }

    /**
     * Get client IP from request headers.
     * Handles proxy chains (X-Forwarded-For).
     *
     * @param array<string, string> $headers
     * @param string[] $trustedProxies
     */
    public static function getClientIp(
        array $headers,
        string $remoteAddr,
        array $trustedProxies = [],
    ): string {
        // Only trust X-Forwarded-For if request came from trusted proxy
        if (!in_array($remoteAddr, $trustedProxies, true)) {
            return $remoteAddr;
        }

        $forwardedFor = $headers['X-Forwarded-For'] ?? '';
        if ($forwardedFor === '') {
            return $remoteAddr;
        }

        // X-Forwarded-For: client, proxy1, proxy2
        // The leftmost IP is the original client
        $ips = array_map('trim', explode(',', $forwardedFor));

        // Find the first non-trusted IP from the right
        $ips = array_reverse($ips);
        foreach ($ips as $ip) {
            if (!in_array($ip, $trustedProxies, true)) {
                return $ip;
            }
        }

        return $remoteAddr;
    }

    private static function classifyIpv4(string $ip): string
    {
        $long = ip2long($ip);

        // Private ranges
        if (self::isInRange($long, '10.0.0.0', '10.255.255.255')) {
            return 'private (Class A)';
        }
        if (self::isInRange($long, '172.16.0.0', '172.31.255.255')) {
            return 'private (Class B)';
        }
        if (self::isInRange($long, '192.168.0.0', '192.168.255.255')) {
            return 'private (Class C)';
        }
        if (self::isInRange($long, '127.0.0.0', '127.255.255.255')) {
            return 'loopback';
        }
        if (self::isInRange($long, '169.254.0.0', '169.254.255.255')) {
            return 'link-local';
        }

        return 'public';
    }

    private static function classifyIpv6(string $ip): string
    {
        if (str_starts_with($ip, '::1')) {
            return 'loopback';
        }
        if (str_starts_with(strtolower($ip), 'fe80')) {
            return 'link-local';
        }
        if (str_starts_with(strtolower($ip), 'fc') || str_starts_with(strtolower($ip), 'fd')) {
            return 'unique-local (private)';
        }

        return 'global unicast';
    }

    private static function isInRange(int $ip, string $start, string $end): bool
    {
        return $ip >= ip2long($start) && $ip <= ip2long($end);
    }
}

package iputils

import (
	"net"
	"net/http"
	"slices"
	"strings"
)

// IPInfo holds analysis results for an IP address.
type IPInfo struct {
	Valid   bool
	Version int
	Type    string
}

// Analyze validates and classifies an IP address (IPv4 or IPv6).
func Analyze(ipStr string) IPInfo {
	ip := net.ParseIP(ipStr)
	if ip == nil {
		return IPInfo{Valid: false, Version: 0, Type: "invalid"}
	}

	if ip.To4() != nil {
		return IPInfo{Valid: true, Version: 4, Type: classifyIPv4(ip)}
	}
	return IPInfo{Valid: true, Version: 6, Type: classifyIPv6(ip)}
}

// IsPrivate checks if an IP belongs to a private/internal network.
func IsPrivate(ipStr string) bool {
	ip := net.ParseIP(ipStr)
	if ip == nil {
		return false
	}
	return ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast()
}

// GetClientIP extracts the real client IP from X-Forwarded-For header.
// Only trusts the header if the request came from a trusted proxy.
func GetClientIP(r *http.Request, trustedProxies []string) string {
	remoteIP, _, _ := net.SplitHostPort(r.RemoteAddr)

	if !slices.Contains(trustedProxies, remoteIP) {
		return remoteIP
	}

	xff := r.Header.Get("X-Forwarded-For")
	if xff == "" {
		return remoteIP
	}

	// X-Forwarded-For: client, proxy1, proxy2
	ips := strings.Split(xff, ",")
	// Find the first non-trusted IP from the right
	for i := len(ips) - 1; i >= 0; i-- {
		ip := strings.TrimSpace(ips[i])
		if !slices.Contains(trustedProxies, ip) {
			return ip
		}
	}

	return remoteIP
}

func classifyIPv4(ip net.IP) string {
	switch {
	case ip.IsLoopback():
		return "loopback"
	case ip.IsLinkLocalUnicast():
		return "link-local"
	case ip.IsPrivate():
		return "private"
	default:
		return "public"
	}
}

func classifyIPv6(ip net.IP) string {
	switch {
	case ip.IsLoopback():
		return "loopback"
	case ip.IsLinkLocalUnicast():
		return "link-local"
	case ip.IsPrivate():
		return "unique-local (private)"
	default:
		return "global unicast"
	}
}

using System.Net;
using System.Net.Sockets;

namespace Networking.Addressing;

public readonly record struct IpInfo(bool Valid, int Version, string Type);

/// <summary>
/// Working with IP addresses. Supports both IPv4 and IPv6.
/// </summary>
public static class IpAddressUtils
{
    private static readonly IPNetwork[] PrivateIpv4Ranges =
    [
        IPNetwork.Parse("10.0.0.0/8"),
        IPNetwork.Parse("172.16.0.0/12"),
        IPNetwork.Parse("192.168.0.0/16"),
    ];

    /// <summary>Validate and classify an IP address.</summary>
    public static IpInfo Analyze(string ip)
    {
        if (!IPAddress.TryParse(ip, out var address))
        {
            return new IpInfo(false, 0, "invalid");
        }

        return address.AddressFamily switch
        {
            AddressFamily.InterNetwork => new IpInfo(true, 4, ClassifyIpv4(address)),
            AddressFamily.InterNetworkV6 => new IpInfo(true, 6, ClassifyIpv6(address)),
            _ => new IpInfo(false, 0, "invalid"),
        };
    }

    /// <summary>
    /// Check if the request comes from a private/internal network.
    /// Useful for internal API endpoints that should not be public.
    /// </summary>
    public static bool IsPrivate(string ip)
    {
        if (!IPAddress.TryParse(ip, out var address))
        {
            return false;
        }

        if (IPAddress.IsLoopback(address))
        {
            return true;
        }

        return address.AddressFamily == AddressFamily.InterNetworkV6
            ? address.IsIPv6LinkLocal || address.IsIPv6UniqueLocal
            : PrivateIpv4Ranges.Any(range => range.Contains(address))
              || IPNetwork.Parse("169.254.0.0/16").Contains(address);
    }

    /// <summary>
    /// Get the client IP from request headers, handling proxy chains.
    /// In ASP.NET Core prefer ForwardedHeadersMiddleware with KnownProxies
    /// configured - it applies the same trust rules framework-wide.
    /// </summary>
    public static string GetClientIp(
        IHeaderDictionary headers,
        IPAddress remoteAddress,
        IReadOnlySet<IPAddress> trustedProxies)
    {
        // Only trust X-Forwarded-For if the request came from a trusted proxy
        if (!trustedProxies.Contains(remoteAddress))
        {
            return remoteAddress.ToString();
        }

        var forwardedFor = headers["X-Forwarded-For"].ToString();
        if (string.IsNullOrWhiteSpace(forwardedFor))
        {
            return remoteAddress.ToString();
        }

        // X-Forwarded-For: client, proxy1, proxy2
        // Walk from the right and return the first non-trusted hop -
        // everything a client can append is to the left and must not be trusted
        var hops = forwardedFor.Split(',', StringSplitOptions.TrimEntries);

        for (var i = hops.Length - 1; i >= 0; i--)
        {
            if (IPAddress.TryParse(hops[i], out var hop) && !trustedProxies.Contains(hop))
            {
                return hop.ToString();
            }
        }

        return remoteAddress.ToString();
    }

    private static string ClassifyIpv4(IPAddress address)
    {
        if (IPAddress.IsLoopback(address))
        {
            return "loopback";
        }

        if (IPNetwork.Parse("169.254.0.0/16").Contains(address))
        {
            return "link-local";
        }

        return PrivateIpv4Ranges.Any(range => range.Contains(address))
            ? "private"
            : "public";
    }

    private static string ClassifyIpv6(IPAddress address) => address switch
    {
        _ when IPAddress.IsLoopback(address) => "loopback",
        { IsIPv6LinkLocal: true } => "link-local",
        { IsIPv6UniqueLocal: true } => "unique-local (private)",
        _ => "global unicast",
    };
}

from __future__ import annotations

import ipaddress
from typing import NamedTuple

class IpInfo(NamedTuple):
    valid: bool
    version: int
    type: str

def analyze(ip: str) -> IpInfo:
    """Validate and classify an IP address (IPv4 or IPv6)."""
    try:
        address = ipaddress.ip_address(ip)
    except ValueError:
        return IpInfo(valid=False, version=0, type="invalid")

    return IpInfo(valid=True, version=address.version, type=_classify(address))

def is_private(ip: str) -> bool:
    """Check if the request comes from a private/internal network.

    Useful for internal API endpoints that should not be public.
    """
    try:
        address = ipaddress.ip_address(ip)
    except ValueError:
        return False

    return address.is_private or address.is_loopback or address.is_link_local

def get_client_ip(
    headers: dict[str, str],
    remote_addr: str,
    trusted_proxies: frozenset[str] = frozenset(),
) -> str:
    """Get the client IP from request headers, handling proxy chains."""
    # Only trust X-Forwarded-For if the request came from a trusted proxy
    if remote_addr not in trusted_proxies:
        return remote_addr

    forwarded_for = headers.get("X-Forwarded-For", "")
    if not forwarded_for:
        return remote_addr

    # X-Forwarded-For: client, proxy1, proxy2
    # Walk from the right and return the first non-trusted hop - everything
    # a client can append is to the left and must not be trusted
    hops = [hop.strip() for hop in forwarded_for.split(",")]

    for hop in reversed(hops):
        if hop and hop not in trusted_proxies:
            return hop

    return remote_addr

def _classify(address: ipaddress.IPv4Address | ipaddress.IPv6Address) -> str:
    """Classify an address by its reserved range."""
    if address.is_loopback:
        return "loopback"
    if address.is_link_local:
        return "link-local"
    if address.is_private:
        return "unique-local (private)" if address.version == 6 else "private"

    return "global unicast" if address.version == 6 else "public"