Merge pull request #12 from doyensec/fix/expand-private-net-block

Updated Private Network Ranges Blocklist

Author: v1ktor0t

client_test.go

@@ -29,6 +29,14 @@ func TestBlockedIP(t *testing.T) {
 		"[::ffff:192.0.2.1]",
 		// ipv6
 		"[::]:80", "[0000::1]:80", "[::1]/server-status",
+		// ipv6 -> 169.254.169.254 translation (nat64 local-use prefix)
+		"[64:ff9b:1::a9fe:a9fe]",
+		// segment routing
+		"[5f00:5aa9:e79f:8940:a51a:be61:ef3b:bab9]",
+		// documentation
+		"[3fff:4e1:6fb3:f8a2:7948:ff06:258:486]",
+		// ipv6 dummy prefix
+		"[100::1:a442:286a:836e:da87]",
 	}
 
 	for _, ip := range ips {

ip.go

@@ -25,20 +25,24 @@ var privateNetworks = []net.IPNet{
 	parseCIDR("255.255.255.255/32"), /* Broadcast - RFC 919, Section 7 */
 	parseCIDR("100.64.0.0/10"),      /* Shared Address Space - RFC 6598 */
 	// ipv6 sourced from https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
-	parseCIDR("::/128"),        /* Unspecified Address - RFC 4291 */
-	parseCIDR("::1/128"),       /* Loopback - RFC 4291 */
-	parseCIDR("100::/64"),      /* Discard prefix - RFC 6666 */
-	parseCIDR("2001::/23"),     /* IETF Protocol Assignments - RFC 2928 */
-	parseCIDR("2001:2::/48"),   /* Benchmarking - RFC5180 */
-	parseCIDR("2001:db8::/32"), /* Addresses used in documentation and example source code - RFC 3849 */
-	parseCIDR("2001::/32"),     /* Teredo tunneling - RFC4380 - RFC8190 */
-	parseCIDR("fc00::/7"),      /* Unique local address - RFC 4193 - RFC 8190 */
-	parseCIDR("fe80::/10"),     /* Link-local address - RFC 4291 */
-	parseCIDR("ff00::/8"),      /* Multicast - RFC 3513 */
-	parseCIDR("2002::/16"),     /* 6to4 - RFC 3056 */
-	parseCIDR("64:ff9b::/96"),  /* IPv4/IPv6 translation - RFC 6052 */
-	parseCIDR("2001:10::/28"),  /* Deprecated (previously ORCHID) - RFC 4843 */
-	parseCIDR("2001:20::/28"),  /* ORCHIDv2 - RFC7343 */
+	parseCIDR("::/128"),         /* Unspecified Address - RFC 4291 */
+	parseCIDR("::1/128"),        /* Loopback - RFC 4291 */
+	parseCIDR("100::/64"),       /* Discard prefix - RFC 6666 */
+	parseCIDR("2001::/23"),      /* IETF Protocol Assignments - RFC 2928 */
+	parseCIDR("2001:2::/48"),    /* Benchmarking - RFC5180 */
+	parseCIDR("2001:db8::/32"),  /* Addresses used in documentation and example source code - RFC 3849 */
+	parseCIDR("2001::/32"),      /* Teredo tunneling - RFC4380 - RFC8190 */
+	parseCIDR("fc00::/7"),       /* Unique local address - RFC 4193 - RFC 8190 */
+	parseCIDR("fe80::/10"),      /* Link-local address - RFC 4291 */
+	parseCIDR("ff00::/8"),       /* Multicast - RFC 3513 */
+	parseCIDR("2002::/16"),      /* 6to4 - RFC 3056 */
+	parseCIDR("64:ff9b::/96"),   /* IPv4/IPv6 translation - RFC 6052 */
+	parseCIDR("64:ff9b:1::/48"), /* IPv4-IPv6 Translat. */
+	parseCIDR("5f00::/16"),      /*  Segment Routing (SRv6) SIDs */
+	parseCIDR("2001:10::/28"),   /* Deprecated (previously ORCHID) - RFC 4843 */
+	parseCIDR("2001:20::/28"),   /* ORCHIDv2 - RFC7343 */
+	parseCIDR("3fff::/20"),      /* Documentation */
+	parseCIDR("100:0:0:1::/64"), /* Dummy IPv6 Prefix */
 }
 
 func parseCIDR(network string) net.IPNet {
@@ -90,4 +94,4 @@ func isIPAllowed(ip net.IP, allowedIPs []net.IP, allowedIPsCIDR []net.IPNet) boo
 	}
 
 	return false
-}
+}