private_address_check 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b4f39e178d7ce144d60df00537f65b9a506037a6fb15aaae625ac156ec6a23b
-  data.tar.gz: dc61b3d2e5a3cde94d4801f8ac746a9761a0501280e109ffbe535d4057db22a6
+  metadata.gz: ca4c176629d7fe2c0be2be0f113d51e0a03449cbf4c564387b7950f4500994a3
+  data.tar.gz: 1ca594143b83be4ebba2a0a5825b79bf81dfae0b015adbb5994d637a227d9c02
 SHA512:
-  metadata.gz: 18cd0a4e01f064df93b47ff721e3deee8337c19ea829c4c8d38aea23a5e0e342be261e1728dca6bd01824e4b9073f59c2a175c7f4745635411f5c860b08e0d02
-  data.tar.gz: 8e4b63a2986997385b4b4261d92d50da3044455648f7f06e1f8306b4a69b7d6628dde55c30b7923d53a14bc7b98eff243725bda571cb41c902cd72a87bf24f86
+  metadata.gz: 95e99d25ee1a57352a61be412cae4505f968e958515e9ffa1fb79688f30a2e6c966cc61971111af1636e4abd7055fc3b2168c48d2c55311e77c1eaa7e99cc3a3
+  data.tar.gz: ad87ec9e56d459434ad6b9602807d67414bfa79fe9f6cddbab73a6158f3f95b837e6e16cb100c09e4ad87afbfa7119c4e6afbf825910fed98bd274a1d8367d88

data/lib/private_address_check/version.rb

@@ -1,3 +1,3 @@
 module PrivateAddressCheck
-  VERSION = "0.7.0".freeze
+  VERSION = "0.8.0".freeze
 end

data/lib/private_address_check.rb

@@ -7,10 +7,8 @@ module PrivateAddressCheck
   module_function
 
   # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
-  # https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
-  CIDR_LIST = [
+  IPV4_CIDRS = [
     IPAddr.new("127.0.0.0/8"),     # Loopback
-    IPAddr.new("::1/128"),         # Loopback
     IPAddr.new("0.0.0.0/8"),       # Current network (only valid as source address)
     IPAddr.new("169.254.0.0/16"),  # Link-local
     IPAddr.new("10.0.0.0/8"),      # Private network
@@ -18,26 +16,52 @@ module PrivateAddressCheck
     IPAddr.new("172.16.0.0/12"),   # Private network
     IPAddr.new("192.0.0.0/24"),    # IETF Protocol Assignments
     IPAddr.new("192.0.2.0/24"),    # TEST-NET-1, documentation and examples
-    IPAddr.new("192.88.99.0/24"),  # IPv6 to IPv4 relay (includes 2002::/16)
+    IPAddr.new("192.88.99.0/24"),  # IPv6 to IPv4 relay anycast (RFC 7526, deprecated)
     IPAddr.new("192.168.0.0/16"),  # Private network
     IPAddr.new("198.18.0.0/15"),   # Network benchmark tests
     IPAddr.new("198.51.100.0/24"), # TEST-NET-2, documentation and examples
     IPAddr.new("203.0.113.0/24"),  # TEST-NET-3, documentation and examples
     IPAddr.new("224.0.0.0/4"),     # IP multicast (former Class D network)
-    IPAddr.new("240.0.0.0/4"),     # Reserved (former Class E network)
-    IPAddr.new("255.255.255.255"), # Broadcast
-    IPAddr.new("64:ff9b::/96"),    # IPv4/IPv6 translation (RFC 6052)
+    IPAddr.new("240.0.0.0/4")      # Reserved (former Class E network, covers 255.255.255.255)
+  ].freeze
+
+  # https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
+  IPV6_CIDRS = [
+    IPAddr.new("::/128"),          # Unspecified address (RFC 4291)
+    IPAddr.new("::1/128"),         # Loopback
+    IPAddr.new("64:ff9b:1::/48"),  # IPv4/IPv6 translation, local use (RFC 8215)
     IPAddr.new("100::/64"),        # Discard prefix (RFC 6666)
+    IPAddr.new("100:0:0:1::/64"),  # Dummy IPv6 Prefix (RFC 9780)
     IPAddr.new("2001::/32"),       # Teredo tunneling
+    IPAddr.new("2001:2::/48"),     # Benchmarking (RFC 5180)
     IPAddr.new("2001:10::/28"),    # Deprecated (previously ORCHID)
     IPAddr.new("2001:20::/28"),    # ORCHIDv2
     IPAddr.new("2001:db8::/32"),   # Addresses used in documentation and example source code
-    IPAddr.new("2002::/16"),       # 6to4
+    IPAddr.new("3fff::/20"),       # Documentation (RFC 9637)
+    IPAddr.new("5f00::/16"),       # Segment Routing (SRv6) SIDs (RFC 9602)
     IPAddr.new("fc00::/7"),        # Unique local address
     IPAddr.new("fe80::/10"),       # Link-local address
     IPAddr.new("ff00::/8")         # Multicast
   ].freeze
 
+  # Embedded IPv4 representations in IPv6, generated from IPV4_CIDRS so that
+  # addresses like ::ffff:10.0.0.1 cannot bypass the private-address check.
+  IPV4_MAPPED_CIDRS = IPV4_CIDRS.flat_map do |cidr|
+    prefix = cidr.prefix + 96
+    ip = cidr.to_s
+    octets = ip.split(".").map(&:to_i)
+    v4_hex = format("%<high>04x:%<low>04x", high: (octets[0] << 8) | octets[1], low: (octets[2] << 8) | octets[3])
+    [
+      IPAddr.new("::#{ip}/#{prefix}"),                       # IPv4-compatible (deprecated)
+      IPAddr.new("::ffff:#{ip}/#{prefix}"),                  # IPv4-mapped (RFC 4291)
+      IPAddr.new("::ffff:0:#{ip}/#{prefix}"),                # IPv4-translated (RFC 2765)
+      IPAddr.new("64:ff9b::#{ip}/#{prefix}"),                # NAT64 well-known prefix (RFC 6052)
+      IPAddr.new("2002:#{v4_hex}::/#{cidr.prefix + 16}")     # 6to4 (RFC 3056)
+    ]
+  end.freeze
+
+  CIDR_LIST = (IPV4_CIDRS + IPV6_CIDRS + IPV4_MAPPED_CIDRS).freeze
+
   def private_address?(address)
     CIDR_LIST.any? do |cidr|
       cidr.include?(address)

data/test/private_address_check_test.rb

@@ -27,6 +27,56 @@ class PrivateAddressCheckTest < Minitest::Test
     assert PrivateAddressCheck.private_address?("169.254.2.5")
   end
 
+  def test_private_address_for_unspecified_ipv6
+    assert PrivateAddressCheck.private_address?("::")
+  end
+
+  def test_private_address_for_additional_ipv6_special_ranges
+    assert PrivateAddressCheck.private_address?("64:ff9b:1::1")
+    assert PrivateAddressCheck.private_address?("2001:2::1")
+    assert PrivateAddressCheck.private_address?("3fff::1")
+  end
+
+  def test_private_address_for_dummy_ipv6_prefix
+    assert PrivateAddressCheck.private_address?("100:0:0:1::1")
+  end
+
+  def test_private_address_for_srv6_sid_range
+    assert PrivateAddressCheck.private_address?("5f00::1")
+  end
+
+  def test_private_address_for_ipv4_mapped_ipv6_addresses
+    assert PrivateAddressCheck.private_address?("::ffff:127.0.0.1")
+    assert PrivateAddressCheck.private_address?("::ffff:10.0.0.1")
+    assert PrivateAddressCheck.private_address?("::ffff:169.254.169.254")
+  end
+
+  def test_private_address_for_alternate_ipv4_embeddings
+    assert PrivateAddressCheck.private_address?("::127.0.0.1")
+    assert PrivateAddressCheck.private_address?("::ffff:0:127.0.0.1")
+    assert PrivateAddressCheck.private_address?("64:ff9b::127.0.0.1")
+  end
+
+  def test_public_ipv4_mapped_ipv6_addresses_are_not_private
+    refute PrivateAddressCheck.private_address?("::ffff:8.8.8.8")
+    refute PrivateAddressCheck.private_address?("::ffff:1.1.1.1")
+  end
+
+  def test_public_nat64_and_6to4_addresses_are_not_private
+    refute PrivateAddressCheck.private_address?("64:ff9b::8.8.8.8")
+    refute PrivateAddressCheck.private_address?("2002:808:808::1")
+  end
+
+  def test_private_nat64_addresses_are_still_private
+    assert PrivateAddressCheck.private_address?("64:ff9b::10.0.0.1")
+  end
+
+  def test_private_6to4_addresses_are_private
+    assert PrivateAddressCheck.private_address?("2002:0a00:0001::1")
+    assert PrivateAddressCheck.private_address?("2002:7f00:0001::1")
+    assert PrivateAddressCheck.private_address?("2002:a9fe:a9fe::1")
+  end
+
   def test_private_hostname_for_public_addresses
     refute PrivateAddressCheck.resolves_to_private_address?("github.com")
     refute PrivateAddressCheck.resolves_to_private_address?("example.com")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: private_address_check
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.8.0
 platform: ruby
 authors:
 - John Downey
@@ -46,7 +46,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Prevent Server Side Request Forgery attacks by checking the destination
 test_files: []