Review fixes for 4.1.0: NAT64 unwrap + trust caveats in docs - #29
Merged
Merged
Conversation
…Forwarded trust caveats - parse_ip unwraps 64:ff9b::/96 (RFC 6052) to the embedded IPv4 client; it was rejected as reserved, a regression vs v3. - README/CHANGELOG: the first public hop may be an upstream proxy (set proxy_count/proxy_list for private clients); Forwarded now resolves above CDN headers and is client-forgeable like X-Forwarded-For. - ip_tier docstring notes classification follows the running Python's ipaddress tables (6to4 differs 3.11 vs 3.12+).
|
coverage: 97.085% (+0.04%) from 97.05% — fix/review-nat64-docs into main |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #28. #28 was merged before these review fixes were pushed, so they are not on
mainyet.What changed
64:ff9b::/96(RFC 6052 well-known prefix) addresses were rejected as reserved, so modern returnedNonewhere v3 returned an address.parse_ipnow unwraps them to the embedded IPv4 client, the same way it handles::ffff:IPv4-mapped addresses. Trusted-proxy matching uses the unwrapped IPv4.proxy_count/proxy_list, the first public hop may be an upstream proxy, so set them if you need to identify private (intranet/VPN) clients;Forwardednow resolves above the CDN headers and a client can forge it, just likeX-Forwarded-For, so behind a CDN you should pass an explicitprecedence.ip_tierdocstring: classification follows the running Python'sipaddresstables. For example, 6to42002::/16is global on 3.11 and private on 3.12+.These come from an independent review of #28. Its verdict was approve with nits, with no blockers.
Verified locally
ruff check .is clean.No tag has been pushed, so nothing is published.
🚀 Generated with Dojo ⛩️