From 079c99a659425c58aeb7d388f96e6909310d241d Mon Sep 17 00:00:00 2001 From: dawn Date: Wed, 22 Jul 2026 11:57:29 +0300 Subject: [PATCH] spindle/engines/microvm: fix ipv4 read cache blocking Signed-off-by: dawn --- spindle/engines/microvm/read_cache_proxy.go | 9 +++++++++ spindle/engines/microvm/read_cache_proxy_test.go | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/spindle/engines/microvm/read_cache_proxy.go b/spindle/engines/microvm/read_cache_proxy.go index 2d1d749f..65d838c5 100644 --- a/spindle/engines/microvm/read_cache_proxy.go +++ b/spindle/engines/microvm/read_cache_proxy.go @@ -252,7 +252,16 @@ func refuseSpecialPurposeAddrs(network, address string, _ syscall.RawConn) error if ip == nil { return fmt.Errorf("refusing to dial non-IP address %q", host) } + bits := 128 + if ip4 := ip.To4(); ip4 != nil { + ip = ip4 + bits = 32 + } for _, ipnet := range blockedNamespaceNets { + _, blockedBits := ipnet.Mask.Size() + if blockedBits != bits { + continue + } if ipnet.Contains(ip) { return fmt.Errorf("refusing to dial %s: %s is blocked for workflow caches", ip, ipnet) } diff --git a/spindle/engines/microvm/read_cache_proxy_test.go b/spindle/engines/microvm/read_cache_proxy_test.go index 9b92b137..9ec84325 100644 --- a/spindle/engines/microvm/read_cache_proxy_test.go +++ b/spindle/engines/microvm/read_cache_proxy_test.go @@ -122,6 +122,12 @@ func TestCacheProxyJoinsSubpathQueryAndAuth(t *testing.T) { } } +func TestCacheProxyGuardAllowsPublicIPv4(t *testing.T) { + if err := refuseSpecialPurposeAddrs("tcp", "104.26.13.82:443", nil); err != nil { + t.Fatalf("public IPv4 address was blocked: %v", err) + } +} + func TestCacheProxyGuardedUpstreamCannotReachBlockedRanges(t *testing.T) { // httptest listens on 127.0.0.1, which is in the blocked ranges; reaching // it would mean a workflow-defined cache can hit the host's loopback -- 2.51.2