(t *testing.T)
| 11 | ) |
| 12 | |
| 13 | func TestIsPrivateIP(t *testing.T) { |
| 14 | t.Parallel() |
| 15 | cases := []struct { |
| 16 | name string |
| 17 | ip string |
| 18 | blocked bool |
| 19 | }{ |
| 20 | {"loopback v4", "127.0.0.1", true}, |
| 21 | {"loopback v6", "::1", true}, |
| 22 | {"link local v4 (azure metadata)", "169.254.169.254", true}, |
| 23 | {"link local v6", "fe80::1", true}, |
| 24 | {"rfc1918 10/8", "10.0.0.1", true}, |
| 25 | {"rfc1918 172.16/12", "172.16.0.1", true}, |
| 26 | {"rfc1918 192.168/16", "192.168.0.1", true}, |
| 27 | {"ipv6 ula", "fc00::1", true}, |
| 28 | {"unspecified v4", "0.0.0.0", true}, |
| 29 | {"unspecified v6", "::", true}, |
| 30 | {"this-network 0.0.0.0/8", "0.1.2.3", true}, |
| 31 | {"cgnat 100.64/10", "100.64.0.1", true}, |
| 32 | {"benchmarking 198.18/15", "198.18.0.1", true}, |
| 33 | {"multicast v4", "224.0.0.1", true}, |
| 34 | {"ipv6 nat64 well-known", "64:ff9b:1::1", true}, |
| 35 | {"ipv6 discard-only", "100::1", true}, |
| 36 | {"ipv6 benchmarking", "2001:2::1", true}, |
| 37 | {"ipv6 documentation", "2001:db8::1", true}, |
| 38 | // IPv4-mapped IPv6: must canonicalize to v4 before |
| 39 | // classification, otherwise an attacker could bypass |
| 40 | // the metadata block via ::ffff:169.254.169.254. |
| 41 | {"ipv4-mapped metadata", "::ffff:169.254.169.254", true}, |
| 42 | {"ipv4-mapped rfc1918", "::ffff:10.0.0.1", true}, |
| 43 | |
| 44 | {"public v4", "8.8.8.8", false}, |
| 45 | {"public v6", "2606:4700:4700::1111", false}, |
| 46 | } |
| 47 | for _, tc := range cases { |
| 48 | t.Run(tc.name, func(t *testing.T) { |
| 49 | t.Parallel() |
| 50 | ip := net.ParseIP(tc.ip) |
| 51 | require.NotNil(t, ip, "parse %q", tc.ip) |
| 52 | require.Equal(t, tc.blocked, isPrivateIP(ip)) |
| 53 | }) |
| 54 | } |
| 55 | } |
| 56 | |
| 57 | // TestCertFetchClientRejectsLoopback proves the dialer refuses |
| 58 | // to connect even when the URL itself would have passed an |
nothing calls this directly
no test coverage detected