scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-09 22:31:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 86

fix(rust): validate NAT64 embedded addresses

Browse source
This commit is contained in:
Yujong Lee 2026-08-29 10:05:04 -07:00 • committed by ishaan-berri
parent 8170d9b071
commit 3c644f02ac
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
litellm-rust/crates/core/src/http_utils/safe_fetch.rs
View file

@ -142,6 +142,10 @@ fn is_public_ipv4(ip: Ipv4Addr) -> bool {
fn is_public_ipv6(ip: Ipv6Addr) -> bool {
let segments = ip.segments();
if matches!(segments, [0x0064, 0xff9b, 0, 0, 0, 0, _, _]) {
let embedded_ipv4 = Ipv4Addr::from((u32::from(segments[6]) << 16) | u32::from(segments[7]));
return is_public_ipv4(embedded_ipv4);
}
let value = u128::from_be_bytes(ip.octets());
let is_ietf_assignment = segments[0] == 0x2001
&& segments[1] < 0x0200
@ -348,6 +352,7 @@ mod tests {
"fe80::1",
"2001:db8::1",
"::ffff:169.254.169.254",
"64:ff9b::a00:1",
] {
assert!(!is_public_ip(blocked.parse().unwrap()), "allowed {blocked}");
}
@ -356,6 +361,7 @@ mod tests {
"1.1.1.1",
"2001:4860:4860::8888",
"::ffff:8.8.8.8",
"64:ff9b::808:808",
] {
assert!(is_public_ip(public.parse().unwrap()), "blocked {public}");
}