Add parsing of shorthand IPv4 addresses (compatible with inet_aton)#12
Open
Envek wants to merge 1 commit intoruby:masterfrom
Open
Add parsing of shorthand IPv4 addresses (compatible with inet_aton)#12Envek wants to merge 1 commit intoruby:masterfrom
inet_aton)#12Envek wants to merge 1 commit intoruby:masterfrom
Conversation
Many applications (like browsers, curl, and wget) and even Ruby's own Net::HTTP library accepts shorthand IPv4 addresses like 127.1 or 2130706433 for 127.0.0.1. It is confusing that IPAddr can't accept them.
Envek
force-pushed
the
feature/aton-compat
branch
from
9da923b to
70ef24a
Compare
|
Hi All! I created "pull request to this pull request" - Envek#1 (because my changes based on this PR changes) to support for IP addresses represented in hexadecimal, octal or even a combination, instead of the decimal encoding. This PR supports all of this formats: (Take any representation and use it in commands such as More info about IPFuscation - https://vincentyiu.co.uk/red-team/cve-exploitation/ipfuscation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implementation for Feature request #15734 from Ruby bug tracker.
Many applications (like browsers,
curl, andping) and even Ruby's ownNet::HTTPlibrary accepts shorthand IPv4 addresses like127.1or2130706433that both stands for127.0.0.1.But IPAddr can't accept such addresses, and it is really confusing:
This pull request makes parsing IPv4 to match the behavior of most well-known applications despite that isn't a standardized extension, but there is an RFC draft: Textual Representation of IPv4 and IPv6 Addresses.
Moreover, that mismatch in behavior could cause security vulnerabilities in Ruby applications that use network, allow users to provide URLs to access (like “Upload picture from URL”), and have incorrectly configured URL filtering. A malicious user then could provide a link like
http://2130706433/private_filewhich currently will not be recognized as loopback IP address butNet::HTTP.getwill happily query local host's web server for theprivate_file. This called an SSRF attack. Actually, I created this pull request because our security auditors reported such vulnerability in one of our applications.NOTE: There is no security flaw in ipaddr itself! It is just possible to create it when you're developing your own application.
See also:
inet_atonman page: https://linux.die.net/man/3/inet_aton