Ip address validation

[massa-bot]

In GitLab by @flipchan

Verify that there is no invalid ip addresses in the file, so that someone can't "fool" the program to submit bad/invalid ips

[massa-bot]

In GitLab by @flipchan

support for ipv6?

[massa-bot]

In GitLab by @flipchan

rfc 1918?

[massa-bot]

In GitLab by @flipchan

https://tools.ietf.org/html/rfc1918

[massa-bot]

In GitLab by @flipchan

blacklisted ips:

0.0.0.0
127.0.0.1
0:0:0:0:0:0:0:1
::1
255.255.255.255

[massa-bot]

In GitLab by @flipchan

ip validation regex would be good to have

[massa-bot]

In GitLab by @damip

@flipchan let's avoid regexes and manual blacklists. How about this stuff ?

• generic: https://doc.rust-lang.org/std/net/enum.IpAddr.html#method.is_global
• documentation for ipv4: https://doc.rust-lang.org/std/net/struct.Ipv4Addr.html#method.is_global
• documentation for ipv6: https://doc.rust-lang.org/std/net/struct.Ipv6Addr.html#method.is_global

Can you check if this is what we want and that there are no corner cases ?

[massa-bot]

In GitLab by @damip

assigned to @flipchan

[massa-bot]

In GitLab by @damip

@flipchan can you also check if it would consider docker network IPs as global by default ? And if not, what should we do in our docker compose to emulate a global IP range ?

[massa-bot]

In GitLab by @flipchan

@damip

Sample

use std::net::IpAddr;

fn validate_ip(ip: IpAddr) -> bool {
    !ip.is_loopback() && !ip.is_unspecified() && !ip.is_multicast()
}

fn main() {
let testipv6: IpAddr = "0000:0000:0000:0000:0000:0000:0000:0001".parse().unwrap();
let testipv4: IpAddr = "127.0.0.1".parse().unwrap();
 validate_ip(testipv6);//false
validate_ip(testipv4);//false
}

https://doc.rust-lang.org/std/net/enum.IpAddr.html#method.is_multicast

[massa-bot]

In GitLab by @flipchan

https://doc.rust-lang.org/std/net/enum.IpAddr.html

[massa-bot]

In GitLab by @flipchan

facebooks implementation of ip validation: https://github.com/libra/libra/blob/dae0c936bddb7d841b34dc3f4620d1fa9a579e21/config/management/src/validator_config.rs#L106

[massa-bot]

In GitLab by @damip

@flipchan IpAddr already validates the syntax when it is created. After that, IpAddr.is_global() checks if the IP is globally routable.

[massa-bot]

In GitLab by @flipchan

@damip is_global is in nightly

[massa-bot]

In GitLab by @flipchan

    #[rustc_const_unstable(feature = "const_ip", issue = "76205")]
    pub const fn is_global(&self) -> bool {
        match self {
            IpAddr::V4(ip) => ip.is_global(),
            IpAddr::V6(ip) => ip.is_global(),
        }
    }

    #[rustc_const_unstable(feature = "const_ipv4", issue = "76205")]
    pub const fn is_global(&self) -> bool {
        // check if this address is 192.0.0.9 or 192.0.0.10. These addresses are the only two
        // globally routable addresses in the 192.0.0.0/24 range.
        if u32::from_be_bytes(self.octets()) == 0xc0000009
            || u32::from_be_bytes(self.octets()) == 0xc000000a
        {
            return true;
        }
        !self.is_private()
            && !self.is_loopback()
            && !self.is_link_local()
            && !self.is_broadcast()
            && !self.is_documentation()
            && !self.is_shared()
            && !self.is_ietf_protocol_assignment()
            && !self.is_reserved()
            && !self.is_benchmarking()
            // Make sure the address is not in 0.0.0.0/8
            && self.octets()[0] != 0
    }

[massa-bot]

In GitLab by @flipchan

is_global is still under dev rust-lang/rust#76205

[massa-bot]

In GitLab by @damip

@flipchan we are using nightly :) just need to activate the ip flag:

#![feature(ip)]

[massa-bot]

In GitLab by @flipchan

the ci system is building the stable release, https://gitlab.com/massalabs/massa-network/-/blob/master/.gitlab-ci.yml

[massa-bot]

In GitLab by @damip

@flipchan Does it compile with the current CI ? If the ip feature is absent from rust:latest which we are currently using, we can switch to this: https://hub.docker.com/r/rustlang/rust/

[massa-bot]

In GitLab by @flipchan

hmm.. maybe? It should because of the release flag(--release), doe removing --release might compile it as nightly, not sure

[massa-bot]

In GitLab by @flipchan

@damip is_global calls is_private, so if there is a node on the same local network it will not work :/

[massa-bot]

In GitLab by @damip

@flipchan that was the point of the question I asked you 4 days ago (see above):

"can you also check if it would consider docker network IPs as global by default ? And if not, what should we do in our docker compose to emulate a global IP range ?"

[massa-bot]

In GitLab by @flipchan

what is an invalid ip address?

• non routable
• multicast

[massa-bot]

In GitLab by @flipchan

https://doc.rust-lang.org/nightly/std/net/struct.Ipv4Addr.html#method.is_unspecified

[massa-bot]

In GitLab by @flipchan

created merge request !10 to address this issue

[massa-bot]

In GitLab by @flipchan

mentioned in merge request !10

[massa-bot]

In GitLab by @flipchan

best recommended action seems to be: try to connect, if it fails, it fails

But still should validate that its not a multicast/broadcast address, if its a public ip addr and not routable by the gateway/system/firewall, socket will fail to connect and it will raise a failure in PeerInfo

[massa-bot]

In GitLab by @damip

is_global is enough, just need to activate the "ip" feature at crate level.

[massa-bot]

In GitLab by @flipchan

@damip if someone wants to connect to nodes listening on 127.0.0.1 it wont work when using is_global