Paths

Table of Contentst

Differential D16986

Add IPv6 reserved addresses to the default outbound blacklist
ClosedPublic
Actions

Authored by epriestley on Dec 5 2016, 6:05 PM.

Tags

None

Referenced Files

	Unknown Object (File)
	Mon, Dec 30, 5:28 PM

	Unknown Object (File)
	Sat, Dec 28, 2:15 PM

	Unknown Object (File)
	Thu, Dec 26, 8:45 PM

	Unknown Object (File)
	Thu, Dec 26, 3:16 PM

	Unknown Object (File)
	Thu, Dec 26, 3:16 PM

	Unknown Object (File)
	Thu, Dec 26, 3:16 PM

	Unknown Object (File)
	Thu, Dec 26, 9:14 AM

	Unknown Object (File)
	Dec 12 2024, 11:44 PM

Subscribers

None

Details

Reviewers

Maniphest Tasks

T11939: IPv6 Support

Commits

rP5a060b34df81: Add IPv6 reserved addresses to the default outbound blacklist

Summary

Ref T11939. Depends on D16984. Now that CIDRLists can contain IPv6 addresses, blacklist all of the reserved IPv6 space.

This reserved blacklist is used to prevent users from accessing internal services via "Import Calendar" or "Add Macro".

They can't actually reach IPv6 addresses via these mechanisms yet because we need to do more work to support outbound IPv6 requests, but make sure reserved IPv6 space is blacklisted already when that support eventaully arrives.

Also, clean up some error messages (e.g., for trying to hit a bad URI in "Add Macro").

Test Plan

Loaded pages with default blacklist.
Tried to make requests into IPv6 space.
Currently, this is impossible because of parse_url() and gethostynamel() calls.

Diff Detail

Repository

Branch

blacklist

Lint

Lint Passed

Unit

Tests Passed

Build Status

Buildable 14752
Build 19283: Run Core Tests
Build 19282: arc lint + arc unit

Event Timeline

epriestley updated this revision to Diff 40866.Dec 5 2016, 6:05 PM

epriestley retitled this revision from to Add IPv6 reserved addresses to the default outbound blacklist.

epriestley updated this object.

epriestley edited the test plan for this revision. (Show Details)

epriestley added a reviewer: chad.

epriestley added a task: T11939: IPv6 Support.

epriestley added a parent revision: D16984: Support IPv6 in CIDR block lists.

chad accepted this revision.Dec 5 2016, 6:41 PM

chad edited edge metadata.

This revision is now accepted and ready to land.Dec 5 2016, 6:41 PM

Closed by commit rP5a060b34df81: Add IPv6 reserved addresses to the default outbound blacklist (authored by epriestley, committed by epriestley). · Explain WhyDec 5 2016, 7:20 PM

This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Path

Size

src/

applications/

config/

option/

PhabricatorSecurityConfigOptions.php

17 lines

infrastructure/

env/

PhabricatorEnv.php

14 lines

Diff 40866

src/applications/config/option/PhabricatorSecurityConfigOptions.php

Loading...

src/infrastructure/env/PhabricatorEnv.php

Loading...