sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Test blocked_networks on both forms of an IPv6 source host holding IPv4
check / check (push) Canceled after 0s
Details

Browse Source 
Both image routes: [::203.0.113.5] must answer 403 when blocked_networks
lists ::/96, and [::ffff:203.0.113.5] when it lists ::ffff:0:0/96 or
203.0.113.0/24. The ::/96 and ::ffff:0:0/96 cases fail on this branch:
isBlockedIP matches such an address only by the IPv4 address it holds.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-16 04:06:52 +00:00
parent 294474a2cd
commit 0e9949afbc
1 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/source_url_internal_test.go
+16 -5
View File
@@ -592,11 +592,13 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T)
// IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a // IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a
// signature and through an encrypted URL, with the fetcher pixad uses. // signature and through an encrypted URL, with the fetcher pixad uses.
// [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215), // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215),
// answers 403. [::203.0.113.5] holds a public IPv4 address in the // answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4
// IPv4-compatible form (::/96). It answers 403 when blocked_networks lists // address in the IPv4-compatible form (::/96) and in the IPv4-mapped form
// 203.0.113.0/24. When blocked_networks is empty it is not refused: the // (::ffff:0:0/96). Each answers 403 when blocked_networks lists
// fetcher tries to connect to it, finds nothing there, and the request fails // 203.0.113.0/24, and when it lists the range of its own form. When
// with another status. // blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries
// to connect to it, finds nothing there, and the request fails with another
// status.
func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
t.Parallel() t.Parallel()
@@ -610,6 +612,15 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
{"IPv4-compatible form of an address in blocked_networks", {"IPv4-compatible form of an address in blocked_networks",
"[::203.0.113.5]", "[::203.0.113.5]",
[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
{"IPv4-compatible form with ::/96 in blocked_networks",
"[::203.0.113.5]",
[]netip.Prefix{netip.MustParsePrefix("::/96")}, true},
{"IPv4-mapped form of an address in blocked_networks",
"[::ffff:203.0.113.5]",
[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
{"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks",
"[::ffff:203.0.113.5]",
[]netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true},
{"IPv4-compatible form of an address with blocked_networks empty", {"IPv4-compatible form of an address with blocked_networks empty",
"[::203.0.113.5]", nil, false}, "[::203.0.113.5]", nil, false},
} }