md5 (?) encoded ip addresses (Page 1 of 2)

I have started working on this. In register.php and functions.php changed get_remote_address to sha1(get_remote_address) ant it works fine, but there is one problem: when I am trying to ban encoded ip, it just doesnt work. Ban put, but you can register from that ip again.

Still facing same problem
I think it's fine (function.php):

//
// Check whether the connecting user is banned (and delete any expired bans while we're at it)
//
function check_bans()
{
    global $db, $pun_config, $lang_common, $pun_user, $pun_bans;

    // Admins aren't affected
    if ($pun_user['g_id'] == PUN_ADMIN || !$pun_bans)
        return;

    // Add a dot at the end of the IP address to prevent banned address 192.168.0.5 from matching e.g. 192.168.0.50
    $user_ip = sha1(get_remote_address());

All IPs in ban table are sha1 encrypted.

Ok, I've changed $cur_ban_ips[$i] = $cur_ban_ips[$i].'.'; to į $cur_ban_ips[$i] = $cur_ban_ips[$i]; and it seems work fine.

First of all, I encoded old data in registration_ip, poster_ip, and ip (bans table) and changed VARCHAR lenght of those rows to 40. Even ip row in bans table, because baning range of sha1 encoded IP adresses is not possible (IMO). Then in registrer.php changed both get_remote_address() to sha1(get)remote_address(). In funtions.php also changed all get_remote_address() to sha1(get)remote_address() except for the

 function get_remote_address()

at line 725. Changing $cur_ban_ips[$i] = $cur_ban_ips[$i].'.'; to į $cur_ban_ips[$i] = $cur_ban_ips[$i]; was done in punbb 1.2.21. In 1.3.2 it's changed already. In search_funtions.php also all get_remote_address() changed to sha1(get_remote_address()). Than in admin/bans.php
at line 279 removed those lines:

                    if ($c > 3 || !ctype_digit($octets[$c]) || intval($octets[$c]) > 255)
                        message($lang_admin_bans['Invalid IP message']);

and at line 190:

                        <span class="fld-input"><input type="text" id="fld<?php echo $forum_page['fld_count'] ?>" name="ban_ip" size="45" maxlength="255" value="<?php if (isset($ban_ip)) echo $ban_ip; ?>" /></span>

changed to

                    
                       <span class="fld-input"><input type="text" id="fld<?php echo $forum_page['fld_count'] ?>" name="ban_ip" size="43" maxlength="40" value="<?php if (isset($ban_ip)) echo $ban_ip; ?>" /></span>

And I think that's it for basic stuff. Other changes are "cosmetical", because sha1 encoded IP addresses are 40 symbols long, so for exampe in viewtopic.php it would be out of range.

1) Wouldn't it be better to simply implement a hook for fn_get_remote_address_start that returns sha1($_SERVER['REMOTE_ADDR'])?

2) As it is now, it is pretty pointless to actually hash the addresses - it does not prevent people from detecting the IP address (IP address space is so small it is quite feasible to simply hash all possible values until you get the right hash). You would need to use either IPv6 or domain names for this modification to have a significant effect.

That wouldn't solve anything. The reason why hashes are considered "safe" for private data is that there are usually way to many possible inputs to try them all - stored hash of a password is difficult to break because there are so many possible passwords. With IPv4 addresses there are only 2**32 addresses at most, quite a few of whose can't appear. If I wanted to discover real IP address from the hash, I could simply start with 0.0.0.0, do a MD5 (or SHA1, or SHA1(MD5)), or whatever) and compare the hashes; if not found, increase the address and try again. In worst case, I would need 2**32 hash operations; the slowest benchmarks I found cite something around 100000 checks per second on modern hardware - I would need 12 hours to find the IP address.

Yes. But if you used the hooks, you could avoid any change in the source files - your modification would hqave a form of extension then.
extensions/HashedIP/manifest.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE extension SYSTEM "ext-1.0.dtd">
    <extension engine="1.0">
    <id>HashedIP</id>
    <title>HashedIP</title>
    <version>0.1</version>
    <description>Don't store IP addresses but their hashes.</description>
    <author>Head_Lice</author>
    <minversion>1.3dev</minversion>
    <maxtestedon>1.3</maxtestedon>
    <hooks>
        <hook id="fn_get_remote_address_start"><![CDATA[
return md5(sha1(gethostbyaddr($_SERVER['REMOTE_ADDR'])));
        ]]></hook>
    </hooks>
</extension>

I would like to encode the ip adresses in database too, but i dont understand what above posts are about.

can some one please make a detailed explanation on how to do that.

Is that it, do i don't need to edit anything else, do i. And what about old users ip adress, will their ip adress be changed automathecally.

And To Core Developers: This should be added to Core i think For Security Purpose.

How do u expect me to understand the php stuff without having courses or something like that. i do understand html and css a little, but php is very hard to understand.

Why do you think that the current code is unsecure?

I specifically wrote:

As I said above, this doesn't increase security significantly.

How about studying it? There are literally millions of tutorials on the net.

You may want to add "computer security" to your list of subjects to study. This is pretty much a nonsense (it may happen in the right circumstances, but the chances are very low - it would be far more economical from the attacker's point of view to simply try all possible addresses than finding an address from a forum...)

Most computer languages are very similar. If you learn one, you can at least read most others.