Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-10 08:43:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(hostmacher): patch incorrect private list (#38170) (#38173)

Browse Source 
Backport #38170 by @TheFox0x7

regression from #38039

Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
This commit is contained in:
Giteabot
2026-06-19 14:50:01 -07:00
committed by GitHub
parent 42eb7945d1
commit b0eaf6c75b
2 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/hostmatcher/hostmatcher.go
+11 -10
View File
@@ -65,12 +65,9 @@ var reservedIPNets = sync.OnceValue(func() []*net.IPNet {
return nets
})
// isPrivateIP reports whether ip falls in a private (net.IP.IsPrivate) or reserved special-purpose
// isReservedIP reports whether ip falls in reserved special-purpose
// range (see reservedIPNets) that must not be considered a public/external destination.
func isPrivateIP(ip net.IP) bool {
if ip.IsPrivate() {
return true
}
func isReservedIP(ip net.IP) bool {
for _, ipNet := range reservedIPNets() {
if ipNet.Contains(ip) {
return true
@@ -153,18 +150,22 @@ func (hl *HostMatchList) checkPattern(host string) bool {
return false
}
func (hl *HostMatchList) checkIP(ip net.IP) bool {
// matchesIP determines if the given IP matches any of the configured rules
func (hl *HostMatchList) matchesIP(ip net.IP) bool {
if slices.Contains(hl.patterns, "*") {
return true
}
for _, builtin := range hl.builtins {
switch builtin {
case MatchBuiltinExternal:
if ip.IsGlobalUnicast() && !isPrivateIP(ip) {
// External address must be a global unicast, must not be in reserved range and must not be in private range
if ip.IsGlobalUnicast() && !isReservedIP(ip) && !ip.IsPrivate() {
return true
}
case MatchBuiltinPrivate:
if isPrivateIP(ip) {
// Private address must be global unicast, must not be in range we explicitly exclude for security reasons
// and must be in private range
if ip.IsGlobalUnicast() && !isReservedIP(ip) && ip.IsPrivate() {
return true
}
case MatchBuiltinLoopback:
@@ -195,7 +196,7 @@ func (hl *HostMatchList) MatchHostName(host string) bool {
return true
}
if ip := net.ParseIP(hostname); ip != nil {
return hl.checkIP(ip)
return hl.matchesIP(ip)
}
return false
}
@@ -206,7 +207,7 @@ func (hl *HostMatchList) MatchIPAddr(ip net.IP) bool {
return false
}
host := ip.String() // nil-safe, we will get "<nil>" if ip is nil
return hl.checkPattern(host) || hl.checkIP(ip)
return hl.checkPattern(host) || hl.matchesIP(ip)
}
// MatchHostOrIP checks if the host or IP matches an allow/deny(block) list