Blocking IP addresses using CIDR

[ayushnix]

There was an issue opened about this back in 2018 but it was closed and locked to prevent any further discussions on it. The issue also mentions that it was "closed this as completed on Jun 18, 2018" although I don't think that feature has been implemented yet.

I was reading about DNS rebinding protection and came across a paper that suggests blocking 224-239.* and IPv6 addresses like fe80::/10, fec0::/10 etc. I don't think it's unreasonable to say that writing IP addresses one by one in all of these ranges is pretty inconvenient. The example in the wiki about DNS rebinding protection also doesn't specify the entire list of IP addresses that should be blocked, something which software like dnsmasq and pfsense supports.

Is this feature desirable to implement?

[lifenjoiner]

Pros and Cons and solutions:
dnscrypt-proxy currently adopts prefix syntax. Straight, but could be a bit long list, just +1 with Excel for example.
CIDR syntax gives some convenient, but not omnipotent. Imagine 139.* - 239.*. The transformation would be complex to normal users. You may need a CIDR calculator.

[ayushnix]

Opinions I guess but I feel its inconvenient and unwieldy to manage a file with 172.16.0.0/12, 224.0.0.0/4, fe80::/10, fec0::/10, ff00::/8, fc00::/7, ::ffff:a00:0/104, ::ffff:ac10:0/108, ::ffff:a9fe:0/112, ::ffffc0a8:0/112 expanded into individual lines using only prefixes and wildcards.

[lifenjoiner]

Writing a tool to expand CIDR to string IP prefix patterns is a compromise way, without a breaking change.
I made one: iprefix.

BTW, IPv6 string prefix matching has a pitfall due to the :: representation shortening rules. For example:

1111:0000:0000:4444:5555:6666:7777:8888/64
= 1111::4444:5555:6666:7777:8888/64
= 1111::4444:* + 1111:0:0:4444:*

1111:0:0:4444:*
= 1111:0:0:4444::* + 1111:0:0:4444:not0::

1111:0:0:4444::*
= 1111:0:0:4444::8888/112
= 1111:0000:0000:4444:0000:0000:0000:8888/112

1111:0:0:4444:not0::
= 1111:0000:0000:4444:not0:0000:0000:0000

[jumpsmm7]

Obviously it might be helpful to have functions that can expand and possible compress ipv6 addresses.

package main
import (
"fmt"
"regexp"
"strconv"
"strings"
)
// hexToDec converts a hexadecimal string to a decimal integer.
func hexToDec(hex string) int {
dec, _ := strconv.ParseInt(hex, 16, 0)
return int(dec)
}
// expandIPv6 expands an IPv6 address.
func expandIPv6(ip string) string {
// Separate subnet and IP address
var subnet string
if strings.Contains(ip, "/") {
parts := strings.Split(ip, "/")
ip = parts[0]
subnet = "/" + parts[1]
}
// Prepend 0 if the IP address starts with ":"
if strings.HasPrefix(ip, ":") {
ip = "0" + ip
}
// Expand "::"
if strings.Contains(ip, "::") {
colons := len(regexp.MustCompile(":").FindAllString(ip, -1))
missing := strings.Repeat(":0000", 8-colons)
ip = strings.Replace(ip, "::", missing, 1)
}
// Split IP into blocks, convert hex to dec, and format as IPv6
blocks := strings.FieldsFunc(ip, func(r rune) bool { return r == ':' })
decBlocks := make([]int, len(blocks))
for i, block := range blocks {
decBlocks[i] = hexToDec(block)
}
expandedIP := fmt.Sprintf("%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x", decBlocks[0], decBlocks[1], decBlocks[2], decBlocks[3], decBlocks[4], decBlocks[5], decBlocks[6], decBlocks[7])
return expandedIP + subnet
}
func main() {
ip := "2001:db8::1/64"
expanded := expandIPv6(ip)
fmt.Println(expanded)
}