qugalet/gotosocial
1
0
Fork 0
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2024-11-22 11:46:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[bugfix]: Fix IPv6 validation (#1150)

Browse source 
* [bugfix]: Fix IPv6 validation

The current code considers ff00::/8 valid, but contrary to the comment
that's not the global unicast range. ff-prefixes in IPv6 denote
multicast.

This adapts the code to take the same approach as IPv4, explicitly
blacklisting reserved internal/private ranges.

* [chore] Add missing 4 in IPv4Reserved doc comment
This commit is contained in:
Daniele Sluijters 2022-11-26 00:28:03 +01:00 committed by GitHub
parent 8b0c92ec41
commit e6cd81babc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
internal/netutil/validate.go
View file

@ -23,10 +23,17 @@
)
var (
// IPv6GlobalUnicast is the global IPv6 unicast IP prefix.
IPv6GlobalUnicast = netip.MustParsePrefix("ff00::/8")
// IPv6Reserved contains IPv6 reserved IP prefixes.
IPv6Reserved = [...]netip.Prefix{
netip.MustParsePrefix("::1/128"), // Loopback
netip.MustParsePrefix("fe80::/10"), // Link-local
netip.MustParsePrefix("fc00::/7"), // Unique Local
netip.MustParsePrefix("2001:db8::/32"), // Test, doc, examples
netip.MustParsePrefix("ff00::/8"), // Multicast
netip.MustParsePrefix("fec0::/10"), // Site-local, deprecated
}
// IPvReserved contains IPv4 reserved IP prefixes.
// IPv4Reserved contains IPv4 reserved IP prefixes.
IPv4Reserved = [...]netip.Prefix{
netip.MustParsePrefix("0.0.0.0/8"), // Current network
netip.MustParsePrefix("10.0.0.0/8"), // Private
@ -67,9 +74,14 @@ func ValidateIP(ip netip.Addr) bool {
}
return true
// IPv6: check if in global unicast (public internet)
// IPv6: check if IP in IPv6 reserved nets
case ip.Is6():
return IPv6GlobalUnicast.Contains(ip)
for _, reserved := range IPv6Reserved {
if reserved.Contains(ip) {
return false
}
}
return true
// Assume malicious by default
default: