fix(requester): normalize hex-form IPv4-compatible IPv6 in isAddressRestricted - #1558
Open
tilak-patel-postman wants to merge 3 commits into
Open
fix(requester): normalize hex-form IPv4-compatible IPv6 in isAddressRestricted#1558tilak-patel-postman wants to merge 3 commits into
tilak-patel-postman wants to merge 3 commits into
Conversation
…estricted isAddressRestricted() only recognised IPv4-compatible IPv6 addresses in their dotted form (::a.b.c.d). The equivalent hex form (e.g. ::7f00:1) is reported by ipaddr.js as a generic 'unicast' address, so it was not reduced to its embedded IPv4 and therefore did not match a configured IPv4 restrictedAddresses entry the way the dotted form does. Normalize it consistently: when the first six hextet groups are zero and the seventh is non-zero, match on the embedded IPv4 (the last four bytes). The parts[6] !== 0 guard leaves ::1 to the existing loopback/exact handling and does not affect ordinary IPv6 addresses. The existing rfc6052/ rfc6145/6to4 handling is unchanged. Teredo (2001::/32) is left as-is because it carries the relay server's address rather than the destination. Also broadens restrictedAddresses test coverage: more special-use IPv4 ranges, alternate IPv4 literal encodings, additional IPv6 ranges, and DNS/redirect resolution cases (multiple A records, AAAA, wildcard DNS, 0.0.0.0, redirect chains), plus a scoped integration runner for the restricted-addresses suite.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #1558 +/- ##
===========================================
+ Coverage 77.54% 77.63% +0.08%
===========================================
Files 51 51
Lines 4338 4350 +12
Branches 1223 1228 +5
===========================================
+ Hits 3364 3377 +13
Misses 731 731
+ Partials 243 242 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
isAddressRestricted()recognised IPv4-compatible IPv6 addresses only in their dotted form (::a.b.c.d). The equivalent hex form (e.g.::7f00:1) is reported byipaddr.jsas a genericunicastaddress, so it was not reduced to its embedded IPv4 and therefore did not match a configured IPv4restrictedAddressesentry the way the dotted form does — an inconsistency in address normalization.Change
::1(parts[6] === 0) and ordinary IPv6 addresses (parts[0] !== 0) are unaffected; the existingrfc6052/rfc6145/6to4handling is unchanged. Teredo (2001::/32) is intentionally left as-is because it carries the relay server's address rather than the destination.restrictedAddressestest coverage: additional special-use IPv4 ranges, alternate IPv4 literal encodings, more IPv6 ranges, and DNS/redirect resolution cases (multiple A records, AAAA, wildcard DNS,0.0.0.0, redirect chains), plus a scoped integration runner for the restricted-addresses suite.Tests
test/unit/requester-core.test.js): 122 passing