From 0e9949afbca4e074b0a7d343bc57f7118bbed710 Mon Sep 17 00:00:00 2001 From: sneak Date: Fri, 16 Oct 2026 04:06:52 +0000 Subject: [PATCH] Test blocked_networks on both forms of an IPv6 source host holding IPv4 Both image routes: [::203.0.113.5] must answer 403 when blocked_networks lists ::/96, and [::ffff:203.0.113.5] when it lists ::ffff:0:0/96 or 203.0.113.0/24. The ::/96 and ::ffff:0:0/96 cases fail on this branch: isBlockedIP matches such an address only by the IPv4 address it holds. Model: opus-5-5 --- internal/server/source_url_internal_test.go | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/internal/server/source_url_internal_test.go b/internal/server/source_url_internal_test.go index 1411602..ee1a210 100644 --- a/internal/server/source_url_internal_test.go +++ b/internal/server/source_url_internal_test.go @@ -592,11 +592,13 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T) // IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a // signature and through an encrypted URL, with the fetcher pixad uses. // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215), -// answers 403. [::203.0.113.5] holds a public IPv4 address in the -// IPv4-compatible form (::/96). It answers 403 when blocked_networks lists -// 203.0.113.0/24. When blocked_networks is empty it is not refused: the -// fetcher tries to connect to it, finds nothing there, and the request fails -// with another status. +// answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4 +// address in the IPv4-compatible form (::/96) and in the IPv4-mapped form +// (::ffff:0:0/96). Each answers 403 when blocked_networks lists +// 203.0.113.0/24, and when it lists the range of its own form. When +// blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries +// to connect to it, finds nothing there, and the request fails with another +// status. func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { t.Parallel() @@ -610,6 +612,15 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { {"IPv4-compatible form of an address in blocked_networks", "[::203.0.113.5]", []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, + {"IPv4-compatible form with ::/96 in blocked_networks", + "[::203.0.113.5]", + []netip.Prefix{netip.MustParsePrefix("::/96")}, true}, + {"IPv4-mapped form of an address in blocked_networks", + "[::ffff:203.0.113.5]", + []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, + {"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks", + "[::ffff:203.0.113.5]", + []netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true}, {"IPv4-compatible form of an address with blocked_networks empty", "[::203.0.113.5]", nil, false}, }