+9

spindle/engines/microvm/read_cache_proxy.go

View file Reviewed

··· 252 252 if ip == nil { 253 253 return fmt.Errorf("refusing to dial non-IP address %q", host) 254 254 } 255 255 + bits := 128 256 256 + if ip4 := ip.To4(); ip4 != nil { 257 257 + ip = ip4 258 258 + bits = 32 259 259 + } 255 260 for _, ipnet := range blockedNamespaceNets { 261 261 + _, blockedBits := ipnet.Mask.Size() 262 262 + if blockedBits != bits { 263 263 + continue 264 264 + } 256 265 if ipnet.Contains(ip) { 257 266 return fmt.Errorf("refusing to dial %s: %s is blocked for workflow caches", ip, ipnet) 258 267 }

+6

spindle/engines/microvm/read_cache_proxy_test.go

View file Reviewed

··· 122 122 } 123 123 } 124 124 125 125 + func TestCacheProxyGuardAllowsPublicIPv4(t *testing.T) { 126 126 + if err := refuseSpecialPurposeAddrs("tcp", "104.26.13.82:443", nil); err != nil { 127 127 + t.Fatalf("public IPv4 address was blocked: %v", err) 128 128 + } 129 129 + } 130 130 + 125 131 func TestCacheProxyGuardedUpstreamCannotReachBlockedRanges(t *testing.T) { 126 132 // httptest listens on 127.0.0.1, which is in the blocked ranges; reaching 127 133 // it would mean a workflow-defined cache can hit the host's loopback