public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-08-20 22:13:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

Re-check the IPv4 embedded in local-use NAT64 instead of blocking outright

Browse Source 
Matches the fizzy guard: the local-use NAT64 prefix (64:ff9b:1::/48,
RFC 8215) embeds an IPv4 target in its low 32 bits just like the
well-known prefix, so run it through the same embedded-IPv4 recheck.
Local-use NAT64 to a public address now resolves (keeping unfurls
working for self-hosters on such networks) while local-use NAT64 to an
internal address stays blocked.
This commit is contained in:
Donal McBreen
2026-07-20 17:13:18 +01:00
parent 9085adcbb3
commit 4cfcc2a370
2 changed files with 18 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/lib/restricted_http/private_network_guard_test.rb
+6 -3
View File
@@ -74,9 +74,12 @@ class RestrictedHTTP::PrivateNetworkGuardTest < ActiveSupport::TestCase
assert_private_ip "64:ff9b::a00:5" # NAT64 -> 10.0.0.5
end
test "private_ip? returns true for local-use NAT64 addresses (RFC8215)" do
assert_private_ip "64:ff9b:1:fffe::a00:1" # local-use NAT64 embedding 10.0.0.1
assert_private_ip "64:ff9b:1::808:808" # blocked even when embedding a public IP
test "private_ip? returns true for local-use NAT64 addresses embedding a private IPv4 (RFC8215)" do
assert_private_ip "64:ff9b:1::a00:1" # local-use NAT64 -> 10.0.0.1
end
test "private_ip? returns false for local-use NAT64 addresses embedding a public IPv4 (RFC8215)" do
assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("64:ff9b:1::808:808") # -> 8.8.8.8
end
test "private_ip? returns false for NAT64 addresses embedding a public IPv4" do