sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Match the mapped form against blocked_networks only as IPv4
check / check (push) Canceled after 0s
Details

Browse Source 
isBlockedIP again matches an IPv4-mapped address (::ffff:0:0/96) only
as the IPv4 address it holds, as on next: Go keeps a plain IPv4 address
in that form, so matching it as written let an IPv6 entry such as ::/0
refuse every IPv4 address. An IPv4-compatible address (::/96) is still
matched both as written and as the IPv4 address it holds.
ipv6AndIPv4Forms is gone. README.md says the mapped form is matched as
IPv4 only.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-16 04:25:45 +00:00
parent a5088a69a1
commit 19113ffa2f
3 changed files with 27 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/httpfetcher/httpfetcher.go
+15 -22
View File
@@ -599,39 +599,32 @@ func isPrivateIP(ip net.IP) bool {
}
// isBlockedIP reports whether ip is refused, either by the built-in
// internal-range check or by one of the operator-supplied prefixes. An IPv6
// address that holds an IPv4 address is refused when a prefix contains the
// address as written or the IPv4 address it holds.
// internal-range check or by one of the operator-supplied prefixes. An
// IPv4-compatible address (in ::/96) is refused when a prefix contains the
// address as written or the IPv4 address it holds. An IPv4-mapped address (in
// ::ffff:0:0/96) is matched only as the IPv4 address it holds: Go keeps a
// plain IPv4 address in that form too, and an IPv6 prefix such as ::/0 must
// not refuse every IPv4 address.
func isBlockedIP(ip net.IP, blocked []netip.Prefix) bool {
if isPrivateIP(ip) {
return true
}
asIPv6, asIPv4 := ipv6AndIPv4Forms(ip)
if !asIPv6.IsValid() {
addr, ok := netip.AddrFromSlice(ip)
if !ok {
return true
}
return slices.ContainsFunc(blocked, func(prefix netip.Prefix) bool {
return prefix.Contains(asIPv6) || prefix.Contains(asIPv4)
})
}
// ipv6AndIPv4Forms returns ip as an IPv6 address and, when it holds an IPv4
// address in the IPv4-mapped form (::ffff:0:0/96) or the IPv4-compatible form
// (::/96), that IPv4 address. Otherwise the IPv4 form is the zero netip.Addr,
// which no prefix contains. Go keeps a plain IPv4 address in the mapped form,
// so the IPv6 form of 203.0.113.5 is ::ffff:203.0.113.5. An ip that is not 4
// or 16 bytes long gives two zero addresses.
func ipv6AndIPv4Forms(ip net.IP) (netip.Addr, netip.Addr) {
asIPv6, ok := netip.AddrFromSlice(ip.To16())
if !ok {
return netip.Addr{}, netip.Addr{}
}
addr = addr.Unmap()
// ip read as IPv4 where it is or holds an IPv4 address, otherwise the
// zero netip.Addr, which no prefix contains. It differs from addr only
// for an IPv4-compatible address.
asIPv4, _ := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip).To4())
return asIPv6, asIPv4
return slices.ContainsFunc(blocked, func(prefix netip.Prefix) bool {
return prefix.Contains(addr) || prefix.Contains(asIPv4)
})
}
// ipv4CompatibleToIPv4 returns the IPv4 address that an IPv4-compatible IPv6