go-proxyproto icon indicating copy to clipboard operation
go-proxyproto copied to clipboard

Allow IPv6 compat addresses when parsing TCPv6 in V1 header

Open emersion opened this issue 5 years ago • 5 comments

Addresses like 0:0:0:0:0:ffff:7f00:1 should be allowed when parsing IPv6 protocols.


Not sure how to make this work, so submitting as a draft so that we're at least aware of the issue...

emersion avatar Oct 28 '20 14:10 emersion

Wait, didn't #49 fix this?

pires avatar Oct 28 '20 19:10 pires

Ah, this is about IP4to6 where an IPv4 address can be encoded in IPv6, as the example you show up above. I think this is a good-to-have and not blocking 0.3.0 on it.

pires avatar Oct 28 '20 19:10 pires

Yes, I agree

emersion avatar Oct 28 '20 20:10 emersion

How about logic along these lines?

func parseV1IPAddress(v6 bool, addr string) (ip net.IP, err error) {
	ip := net.ParseIP(addr)
	tryV4 := ip.To4()
	hasDot := (strings.Index(addr, ".") != -1)
	hasColon := (strings.Index(addr, ":") != -1)
	if (!v6 && (tryV4 == nil || hasColon)) || (v6 && hasDot) {
		err = errors.New("no good")
	}
	return
}

Which give these results:

addr                 error with v6=false?     error with v6=true?
8912:adfb::0124      yes                      no
10.10.0.10           no                       yes
::ffff:0a0a:0a0a     yes                      no
::ffff:10.10.10.10   yes                      yes

The ParseIP() and To4() outputs:

addr                 ParseIP                                       To4
8912:adfb::0124      len=16  ip=8912adfb000000000000000000000124   len=0  ip=
10.10.0.10           len=16  ip=00000000000000000000ffff0a0a000a   len=4  ip=0a0a000a
::ffff:0a0a:0a0a     len=16  ip=00000000000000000000ffff0a0a0a0a   len=4  ip=0a0a0a0a
::ffff:10.10.10.10   len=16  ip=00000000000000000000ffff0a0a0a0a   len=4  ip=0a0a0a0a

The ::ffff:10.10.10.10 is legal IPv6 text but not supported by the proxy protocol standard, as I read it.

If you agree, I can work up a PR.

isedev avatar Mar 02 '21 02:03 isedev

On similar note, HeaderProxyFromAddrs will silently assume TCP4 if given a IP4to6 address as source. Not convinced that's proper behaviour. Can't see how to change that though without also changing function signature...

isedev avatar Mar 02 '21 02:03 isedev