sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Test blocked_networks on both forms of an IPv6 source host holding IPv4

Browse Source 
Both image routes: [::203.0.113.5] must answer 403 when blocked_networks
lists ::/96, and [::ffff:203.0.113.5] when it lists ::ffff:0:0/96 or
203.0.113.0/24. The ::/96 and ::ffff:0:0/96 cases fail on this branch:
isBlockedIP matches such an address only by the IPv4 address it holds.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-16 04:14:20 +00:00
parent 294474a2cd
commit 4900837068
1 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/source_url_internal_test.go
+23 -7
View File
@@ -592,14 +592,21 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T)
// IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a // IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a
// signature and through an encrypted URL, with the fetcher pixad uses. // signature and through an encrypted URL, with the fetcher pixad uses.
// [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215), // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215),
// answers 403. [::203.0.113.5] holds a public IPv4 address in the // answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4
// IPv4-compatible form (::/96). It answers 403 when blocked_networks lists // address in the IPv4-compatible form (::/96) and in the IPv4-mapped form
// 203.0.113.0/24. When blocked_networks is empty it is not refused: the // (::ffff:0:0/96). Each answers 403 when blocked_networks lists
// fetcher tries to connect to it, finds nothing there, and the request fails // 203.0.113.0/24, and when it lists the range of its own form. When
// with another status. // blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries
// to connect to it, finds nothing there, and the request fails with another
// status.
func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
t.Parallel() t.Parallel()
const (
ipv4CompatibleHost = "[::203.0.113.5]"
ipv4MappedHost = "[::ffff:203.0.113.5]"
)
tests := []struct { tests := []struct {
name string name string
sourceHost string sourceHost string
@@ -608,10 +615,19 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
}{ }{
{"local-use NAT64 form of 10.0.0.1", "[64:ff9b:1::a00:1]", nil, true}, {"local-use NAT64 form of 10.0.0.1", "[64:ff9b:1::a00:1]", nil, true},
{"IPv4-compatible form of an address in blocked_networks", {"IPv4-compatible form of an address in blocked_networks",
"[::203.0.113.5]", ipv4CompatibleHost,
[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
{"IPv4-compatible form with ::/96 in blocked_networks",
ipv4CompatibleHost,
[]netip.Prefix{netip.MustParsePrefix("::/96")}, true},
{"IPv4-mapped form of an address in blocked_networks",
ipv4MappedHost,
[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
{"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks",
ipv4MappedHost,
[]netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true},
{"IPv4-compatible form of an address with blocked_networks empty", {"IPv4-compatible form of an address with blocked_networks empty",
"[::203.0.113.5]", nil, false}, ipv4CompatibleHost, nil, false},
} }
for _, tt := range tests { for _, tt := range tests {