From 4900837068acfc28b6bb9354a2fba190ff6192a5 Mon Sep 17 00:00:00 2001 From: sneak Date: Fri, 16 Oct 2026 04:06:52 +0000 Subject: [PATCH] Test blocked_networks on both forms of an IPv6 source host holding IPv4 Both image routes: [::203.0.113.5] must answer 403 when blocked_networks lists ::/96, and [::ffff:203.0.113.5] when it lists ::ffff:0:0/96 or 203.0.113.0/24. The ::/96 and ::ffff:0:0/96 cases fail on this branch: isBlockedIP matches such an address only by the IPv4 address it holds. Model: opus-5-5 --- internal/server/source_url_internal_test.go | 30 ++++++++++++++++----- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/internal/server/source_url_internal_test.go b/internal/server/source_url_internal_test.go index 1411602..4257a6f 100644 --- a/internal/server/source_url_internal_test.go +++ b/internal/server/source_url_internal_test.go @@ -592,14 +592,21 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T) // IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a // signature and through an encrypted URL, with the fetcher pixad uses. // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215), -// answers 403. [::203.0.113.5] holds a public IPv4 address in the -// IPv4-compatible form (::/96). It answers 403 when blocked_networks lists -// 203.0.113.0/24. When blocked_networks is empty it is not refused: the -// fetcher tries to connect to it, finds nothing there, and the request fails -// with another status. +// answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4 +// address in the IPv4-compatible form (::/96) and in the IPv4-mapped form +// (::ffff:0:0/96). Each answers 403 when blocked_networks lists +// 203.0.113.0/24, and when it lists the range of its own form. When +// blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries +// to connect to it, finds nothing there, and the request fails with another +// status. func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { t.Parallel() + const ( + ipv4CompatibleHost = "[::203.0.113.5]" + ipv4MappedHost = "[::ffff:203.0.113.5]" + ) + tests := []struct { name string sourceHost string @@ -608,10 +615,19 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { }{ {"local-use NAT64 form of 10.0.0.1", "[64:ff9b:1::a00:1]", nil, true}, {"IPv4-compatible form of an address in blocked_networks", - "[::203.0.113.5]", + ipv4CompatibleHost, []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, + {"IPv4-compatible form with ::/96 in blocked_networks", + ipv4CompatibleHost, + []netip.Prefix{netip.MustParsePrefix("::/96")}, true}, + {"IPv4-mapped form of an address in blocked_networks", + ipv4MappedHost, + []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, + {"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks", + ipv4MappedHost, + []netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true}, {"IPv4-compatible form of an address with blocked_networks empty", - "[::203.0.113.5]", nil, false}, + ipv4CompatibleHost, nil, false}, } for _, tt := range tests {