An entry such as ::ffff:10.0.0.0/104 in trusted_proxies was accepted but trusted nothing, because the client address is matched as the IPv4 address an IPv4-mapped address holds (#303). Such an entry is now read as the IPv4 range it covers (10.0.0.0/8), and one shorter than /96 stops startup with an error naming trusted_proxies.
blocked_networks has done this since #302, in a separate parseBlockedNetworks. I moved that conversion into parseCIDRList, which reads both settings, and removed parseBlockedNetworks; the error names whichever setting is being read. The trusted_proxies default list and how internal/clientip matches are unchanged.
README.md describes the mapped form under trusted_proxies in the words it uses for blocked_networks.
The first commit adds the two new tests, which fail on next; the second is the fix. The blocked_networks tests are unchanged.
Judgement call: the too-short error now quotes the entry as the operator wrote it (::ffff:0:0/95) rather than as Go prints it (::ffff:0.0.0.0/95), like the invalid-CIDR error next to it. This also changes the blocked_networks message for such an entry.
Model: opus-5-5
An entry such as `::ffff:10.0.0.0/104` in `trusted_proxies` was accepted but trusted nothing, because the client address is matched as the IPv4 address an IPv4-mapped address holds (https://git.eeqj.de/sneak/pixa/issues/303). Such an entry is now read as the IPv4 range it covers (`10.0.0.0/8`), and one shorter than `/96` stops startup with an error naming `trusted_proxies`.
`blocked_networks` has done this since https://git.eeqj.de/sneak/pixa/pulls/302, in a separate `parseBlockedNetworks`. I moved that conversion into `parseCIDRList`, which reads both settings, and removed `parseBlockedNetworks`; the error names whichever setting is being read. The `trusted_proxies` default list and how `internal/clientip` matches are unchanged.
`README.md` describes the mapped form under `trusted_proxies` in the words it uses for `blocked_networks`.
The first commit adds the two new tests, which fail on `next`; the second is the fix. The `blocked_networks` tests are unchanged.
Judgement call: the too-short error now quotes the entry as the operator wrote it (`::ffff:0:0/95`) rather than as Go prints it (`::ffff:0.0.0.0/95`), like the invalid-CIDR error next to it. This also changes the `blocked_networks` message for such an entry.
Model: opus-5-5
These tests fail on next: ::ffff:10.0.0.0/104 is kept as written and so
never matches, and ::ffff:0:0/95 loads without an error. The fix follows
in the next commit.
Model: opus-5-5
The client address is matched against trusted_proxies as the IPv4 address
an IPv4-mapped address holds, so an entry such as ::ffff:10.0.0.0/104
trusted nothing. parseCIDRList, which reads both trusted_proxies and
blocked_networks, now keeps such an entry as the IPv4 range it covers and
refuses one shorter than /96 naming the setting it reads.
parseBlockedNetworks, which did this for blocked_networks alone, is gone.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
An entry such as
::ffff:10.0.0.0/104intrusted_proxieswas accepted but trusted nothing, because the client address is matched as the IPv4 address an IPv4-mapped address holds (#303). Such an entry is now read as the IPv4 range it covers (10.0.0.0/8), and one shorter than/96stops startup with an error namingtrusted_proxies.blocked_networkshas done this since #302, in a separateparseBlockedNetworks. I moved that conversion intoparseCIDRList, which reads both settings, and removedparseBlockedNetworks; the error names whichever setting is being read. Thetrusted_proxiesdefault list and howinternal/clientipmatches are unchanged.README.mddescribes the mapped form undertrusted_proxiesin the words it uses forblocked_networks.The first commit adds the two new tests, which fail on
next; the second is the fix. Theblocked_networkstests are unchanged.Judgement call: the too-short error now quotes the entry as the operator wrote it (
::ffff:0:0/95) rather than as Go prints it (::ffff:0.0.0.0/95), like the invalid-CIDR error next to it. This also changes theblocked_networksmessage for such an entry.Model: opus-5-5
Review passed.
Model: opus-5-5
547bdf11eftoa14c5a1ba0