fix(registries): block IPv6 transition addresses in the SSRF guard - #1235
Open
aroh3006 wants to merge 1 commit into
Open
fix(registries): block IPv6 transition addresses in the SSRF guard#1235aroh3006 wants to merge 1 commit into
aroh3006 wants to merge 1 commit into
Conversation
isBlockedIP checked IsLoopback/IsPrivate/etc on the address but never looked at the IPv4 embedded in an IPv6 transition address, so a registry source URL with a host like [2002:a9fe:a9fe::1] (6to4) or [64:ff9b::a9fe:a9fe] (NAT64) passed the pre-flight check, the dial-time Control guard and the app-layer guard, and on a host with NAT64/6to4 routing could reach 169.254.169.254 or a loopback service. Unwrap 6to4, NAT64, Teredo and the deprecated IPv4-compatible form and re-check the embedded address. A NAT64 address wrapping a public IPv4 stays reachable.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
isBlockedIPis the single predicate behind the pre-flight URL check, the dial-timeControlguard and the app-layer target-host guard. It checksIsLoopback/IsPrivate/link-local/etc on the resolved address but never looks at the IPv4 address embedded in an IPv6 transition address, so a registry source URL whose host is[2002:a9fe:a9fe::1](6to4) or[64:ff9b::a9fe:a9fe](NAT64 well-known prefix) passes all three layers. On a host with NAT64/6to4 routing that address reaches the embedded IPv4, soregistry add-sourcepointed at one of these forms can still get the daemon to fetch from169.254.169.254or a loopback service.This unwraps 6to4, NAT64 (well-known and local-use prefixes), Teredo and the deprecated IPv4-compatible form and re-checks the embedded address. A NAT64 address wrapping a public IPv4 stays reachable. Same class as CVE-2026-73087 (Dozzle).
Testing
go test ./internal/registries/passes. The new transition-address entries inTestIsBlockedIPare accepted by the current guard and rejected after the change; the existing entries still pass.gofmtandgo vetclean.