From a5088a69a113d6709a16d412ab50dd99e35b4f90 Mon Sep 17 00:00:00 2001 From: sneak Date: Fri, 16 Oct 2026 04:24:19 +0000 Subject: [PATCH] Test that an IPv6 entry in blocked_networks does not refuse a plain IPv4 source Both image routes: the plain IPv4 source host 203.0.113.5 must not be refused when blocked_networks lists ::/0. It fails on this branch: Go keeps a plain IPv4 address in the mapped form, and isBlockedIP matches that form as written. The case that expected [::ffff:203.0.113.5] refused with ::ffff:0:0/96 listed, added earlier on this branch, is dropped: the mapped form is matched only as the IPv4 address it holds. Model: opus-5-5 --- internal/server/source_url_internal_test.go | 24 +++++++++++---------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/internal/server/source_url_internal_test.go b/internal/server/source_url_internal_test.go index 4257a6f..27b963b 100644 --- a/internal/server/source_url_internal_test.go +++ b/internal/server/source_url_internal_test.go @@ -589,16 +589,18 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T) } // TestImageRoutesCheckIPv4AddressInIPv6SourceHost requests ipv6SourcePath on -// IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a +// source hosts that hold an IPv4 address, through a /v1/image/ URL with a // signature and through an encrypted URL, with the fetcher pixad uses. // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215), -// answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4 -// address in the IPv4-compatible form (::/96) and in the IPv4-mapped form -// (::ffff:0:0/96). Each answers 403 when blocked_networks lists -// 203.0.113.0/24, and when it lists the range of its own form. When -// blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries -// to connect to it, finds nothing there, and the request fails with another -// status. +// answers 403. [::203.0.113.5] holds the public address 203.0.113.5 in the +// IPv4-compatible form (::/96) and answers 403 when blocked_networks lists +// 203.0.113.0/24 or ::/96. [::ffff:203.0.113.5] holds it in the IPv4-mapped +// form (::ffff:0:0/96) and answers 403 when blocked_networks lists +// 203.0.113.0/24. Go keeps the plain address 203.0.113.5 in the mapped form +// too, and an IPv6 range must not refuse it: with ::/0 listed it is not +// refused. Neither is [::203.0.113.5] with blocked_networks empty. Where a +// host is not refused, the fetcher tries to connect to it, finds nothing +// there, and the request fails with another status. func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { t.Parallel() @@ -623,9 +625,9 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { {"IPv4-mapped form of an address in blocked_networks", ipv4MappedHost, []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, - {"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks", - ipv4MappedHost, - []netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true}, + {"plain IPv4 address with ::/0 in blocked_networks", + "203.0.113.5", + []netip.Prefix{netip.MustParsePrefix("::/0")}, false}, {"IPv4-compatible form of an address with blocked_networks empty", ipv4CompatibleHost, nil, false}, }