Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 02:15 UTC
logging: Reject out-of-range `ip_mask` CIDRs (#8241)
Jay Hemnani committed
Oct 19, 2026 at 11:50 UTC
e3649f2536b73e473c0bf5057f255d8aa707a1c6
2 files changed
+29
modules/logging/filters.go
+7
@@ -224,6 +224,13 @@ func (m *IPMaskFilter) UnmarshalCaddyfile(d *caddyfile.Dispenser) error {
224
225
// Provision parses m's IP masks, from integers.
226
func (m *IPMaskFilter) Provision(ctx caddy.Context) error {
227
+ if m.IPv4MaskRaw < 0 || m.IPv4MaskRaw > 32 {
228
+ return fmt.Errorf("invalid IPv4 mask: %d (must be between 0 and 32)", m.IPv4MaskRaw)
229
+ }
230
+ if m.IPv6MaskRaw < 0 || m.IPv6MaskRaw > 128 {
231
+ return fmt.Errorf("invalid IPv6 mask: %d (must be between 0 and 128)", m.IPv6MaskRaw)
232
+ }
233
+
234
parseRawToMask := func(rawField int, bitLen int) net.IPMask {
235
if rawField == 0 {
236
return nil
modules/logging/filters_test.go
+22
@@ -31,6 +31,28 @@ func TestIPMaskSingleValue(t *testing.T) {
31
}
32
}
33
34
+func TestIPMaskInvalidCIDR(t *testing.T) {
35
+ for _, f := range []IPMaskFilter{
36
+ {IPv4MaskRaw: 33},
37
+ {IPv4MaskRaw: -1},
38
+ {IPv6MaskRaw: 129},
39
+ {IPv6MaskRaw: -8},
40
+ } {
41
+ if err := f.Provision(caddy.Context{}); err == nil {
42
+ t.Errorf("expected error for ipv4=%d ipv6=%d", f.IPv4MaskRaw, f.IPv6MaskRaw)
43
+ }
44
+ }
45
+
46
+ f := IPMaskFilter{IPv4MaskRaw: 32, IPv6MaskRaw: 128}
47
+ if err := f.Provision(caddy.Context{}); err != nil {
48
+ t.Fatalf("unexpected error: %v", err)
49
+ }
50
+ out := f.Filter(zapcore.Field{String: "1.2.3.4, 2001:db8::1"})
51
+ if out.String != "1.2.3.4, 2001:db8::1" {
52
+ t.Fatalf("field changed with full masks: %s", out.String)
53
+ }
54
+}
55
+
56
func TestIPMaskCommaValue(t *testing.T) {
57
f := IPMaskFilter{IPv4MaskRaw: 16, IPv6MaskRaw: 32}
58
f.Provision(caddy.Context{})