public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-09-18 22:34:56 +09:00
Code Issues Packages Projects Releases Wiki Activity

Block IPv6 encapsulation and CGNAT ranges in SSRF guard

Browse Source 
Add NAT64 (64:ff9b::/96), 6to4 (2002::/16), and CGNAT shared address
space (100.64.0.0/10) to the private-network guard. These ranges can
smuggle requests toward internal networks and were not covered by the
existing predicates, leaving an SSRF bypass. Introduce DISALLOWED_RANGES
and OR it into private_ip?, preserving LOCAL_IP behavior.

Ref: weekend run #3873122 (IPv6 encapsulation SSRF ranges)
This commit is contained in:
Jeremy Daer
2026-07-20 02:17:12 -07:00
parent df5ed25e14
commit ae7a34113f
2 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/lib/restricted_http/private_network_guard_test.rb
+20
View File
@@ -64,6 +64,26 @@ class RestrictedHTTP::PrivateNetworkGuardTest < ActiveSupport::TestCase
assert_private_ip "::93.184.216.34"
end
# IPv6/encapsulation and shared-address ranges (SSRF bypass prevention)
test "private_ip? returns true for NAT64 addresses" do
assert_private_ip "64:ff9b::a00:1" # NAT64-embedded 10.0.0.1
end
test "private_ip? returns true for 6to4 addresses" do
assert_private_ip "2002::1"
assert_private_ip "2002:0a00:0001::" # 6to4-embedded 10.0.0.1
end
test "private_ip? returns true for CGNAT / shared address space" do
assert_private_ip "100.64.0.1"
assert_private_ip "100.127.255.255"
end
test "private_ip? returns false for public addresses outside the new ranges" do
assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("93.184.216.34")
end
test "private_ip? returns true for invalid addresses" do
assert RestrictedHTTP::PrivateNetworkGuard.private_ip?("not-an-ip")
assert RestrictedHTTP::PrivateNetworkGuard.private_ip?("")