sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 75 Packages Projects Releases Wiki Activity

Test that an IPv6 entry in blocked_networks does not refuse a plain IPv4 source
check / check (push) Canceled after 0s
Details

Browse Source 
Both image routes: the plain IPv4 source host 203.0.113.5 must not be
refused when blocked_networks lists ::/0. It fails on this branch: Go
keeps a plain IPv4 address in the mapped form, and isBlockedIP matches
that form as written. The case that expected [::ffff:203.0.113.5]
refused with ::ffff:0:0/96 listed, added earlier on this branch, is
dropped: the mapped form is matched only as the IPv4 address it holds.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-16 04:24:19 +00:00
parent 8fceeca202
commit a5088a69a1
1 changed files with 13 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/server/source_url_internal_test.go
+13 -11
View File
@@ -589,16 +589,18 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T)
} }
// TestImageRoutesCheckIPv4AddressInIPv6SourceHost requests ipv6SourcePath on // TestImageRoutesCheckIPv4AddressInIPv6SourceHost requests ipv6SourcePath on
// IPv6 source hosts that hold an IPv4 address, through a /v1/image/ URL with a // source hosts that hold an IPv4 address, through a /v1/image/ URL with a
// signature and through an encrypted URL, with the fetcher pixad uses. // signature and through an encrypted URL, with the fetcher pixad uses.
// [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215), // [64:ff9b:1::a00:1], in the local-use NAT64 range (64:ff9b:1::/48, RFC 8215),
// answers 403. [::203.0.113.5] and [::ffff:203.0.113.5] hold a public IPv4 // answers 403. [::203.0.113.5] holds the public address 203.0.113.5 in the
// address in the IPv4-compatible form (::/96) and in the IPv4-mapped form // IPv4-compatible form (::/96) and answers 403 when blocked_networks lists
// (::ffff:0:0/96). Each answers 403 when blocked_networks lists // 203.0.113.0/24 or ::/96. [::ffff:203.0.113.5] holds it in the IPv4-mapped
// 203.0.113.0/24, and when it lists the range of its own form. When // form (::ffff:0:0/96) and answers 403 when blocked_networks lists
// blocked_networks is empty [::203.0.113.5] is not refused: the fetcher tries // 203.0.113.0/24. Go keeps the plain address 203.0.113.5 in the mapped form
// to connect to it, finds nothing there, and the request fails with another // too, and an IPv6 range must not refuse it: with ::/0 listed it is not
// status. // refused. Neither is [::203.0.113.5] with blocked_networks empty. Where a
// host is not refused, the fetcher tries to connect to it, finds nothing
// there, and the request fails with another status.
func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) { func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
t.Parallel() t.Parallel()
@@ -623,9 +625,9 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
{"IPv4-mapped form of an address in blocked_networks", {"IPv4-mapped form of an address in blocked_networks",
ipv4MappedHost, ipv4MappedHost,
[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true}, []netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
{"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks", {"plain IPv4 address with ::/0 in blocked_networks",
ipv4MappedHost, "203.0.113.5",
[]netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true}, []netip.Prefix{netip.MustParsePrefix("::/0")}, false},
{"IPv4-compatible form of an address with blocked_networks empty", {"IPv4-compatible form of an address with blocked_networks empty",
ipv4CompatibleHost, nil, false}, ipv4CompatibleHost, nil, false},
} }