lee/container
1
0
Fork 0
mirror of https://github.com/apple/container.git synced 2026-09-22 15:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix RequestScheme formatting. (#1473)

Browse Source 
## Type of Change
- [x] Bug fix
- [ ] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
`main` build broke with last commit.

## Testing
- [ ] Tested locally
- [ ] Added/updated tests
- [ ] Added/updated docs

---------

Signed-off-by: Kathryn Baldauf <k_baldauf@apple.com>
Co-authored-by: Kathryn Baldauf <k_baldauf@apple.com>
This commit is contained in:
J Logan
2026-04-29 15:04:24 -07:00
committed by GitHub
co-authored by Kathryn Baldauf
parent 601f5f113a
commit 4e390d6aa8
2 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Sources/Services/ContainerAPIService/Client/RequestScheme.swift
+7 -7
View File
@@ -49,20 +49,20 @@ public enum RequestScheme: String, Sendable {
case .http, .https:
return self
case .auto:
return Self.isInternalHost(host: host) ? .http : .https
return Self.isInternalHost(host: host, dnsDomain: DefaultsStore.getOptional(key: .defaultDNSDomain)) ? .http : .https
}
}
/// Checks if the given `host` string is a private IP address
/// or a domain typically reachable only on the local system.
private static func isInternalHost(host: String) -> Bool {
internal static func isInternalHost(host: String, dnsDomain: String? = nil) -> Bool {
// The localhost hostname is private.
if host == "localhost" {
return true
}
// If it corresponds to our default domain name, treat it as private.
if let dnsDomain = DefaultsStore.getOptional(key: .defaultDNSDomain) {
// If hostname uses the provided DNS domain, treat it as private.
if let dnsDomain {
if host.hasSuffix(".\(dnsDomain)") {
return true
}
@@ -76,17 +76,17 @@ public enum RequestScheme: String, Sendable {
let ipv4Value = ipv4Address.value
// 10.0.0.0/8 and 127.0.0.0/8 are private CIDRs.
if (ipv4Value & 0xff000000 == 0x0a000000) || (ipv4Value & 0xff000000 == 0x7f000000) {
if (ipv4Value & 0xff00_0000 == 0x0a00_0000) || (ipv4Value & 0xff00_0000 == 0x7f00_0000) {
return true
}
// 192.168.0.0/16 is a private CIDR.
if ipv4Value & 0xffff0000 == 0xc0a80000 {
if ipv4Value & 0xffff_0000 == 0xc0a8_0000 {
return true
}
// 172.16.0.0/12 is a private CIDR.
if ipv4Value & 0xfff00000 == 0xac100000 {
if ipv4Value & 0xfff0_0000 == 0xac10_0000 {
return true
}
Tests/ContainerAPIClientTests/RequestSchemeTests.swift
+6 -7
View File
@@ -22,8 +22,6 @@ import Testing
@testable import ContainerAPIClient
struct RequestSchemeTests {
static let defaultDnsDomain = DefaultsStore.get(key: .defaultDNSDomain)
internal struct TestArg {
let scheme: String
let host: String
@@ -37,25 +35,20 @@ struct RequestSchemeTests {
TestArg(scheme: "https", host: "localhost", expected: .https),
TestArg(scheme: "http", host: "localhost", expected: .http),
TestArg(scheme: "auto", host: "localhost", expected: .http),
// localhost prefix must not match other hostnames (regression: hasPrefix("localhost"))
TestArg(scheme: "auto", host: "localhost.evil.com", expected: .https),
TestArg(scheme: "http", host: "127.0.0.1", expected: .http),
TestArg(scheme: "https", host: "127.0.0.1", expected: .https),
TestArg(scheme: "auto", host: "127.0.0.1", expected: .http),
TestArg(scheme: "auto", host: "127.255.255.255", expected: .http),
// 127.x.x.x prefix must not match hostnames (regression: hasPrefix("127."))
TestArg(scheme: "auto", host: "127.0.0.1.evil.com", expected: .https),
TestArg(scheme: "https", host: "10.3.4.1", expected: .https),
TestArg(scheme: "auto", host: "10.3.4.1", expected: .http),
TestArg(scheme: "auto", host: "10.255.255.255", expected: .http),
// 10.x.x.x prefix must not match hostnames (regression: hasPrefix("10."))
TestArg(scheme: "auto", host: "10.0.0.1.evil.com", expected: .https),
TestArg(scheme: "auto", host: "192.168.0.1", expected: .http),
TestArg(scheme: "auto", host: "192.168.255.255", expected: .http),
TestArg(scheme: "auto", host: "192.169.0.1", expected: .https),
// 192.168.x.x prefix must not match hostnames (regression: hasPrefix("192.168."))
TestArg(scheme: "auto", host: "192.168.1.1.evil.com", expected: .https),
TestArg(scheme: "auto", host: "some-dns-name.io.\(Self.defaultDnsDomain)", expected: .http),
TestArg(scheme: "auto", host: "some-dns-name.io", expected: .https),
TestArg(scheme: "auto", host: "172.32.0.1", expected: .https),
TestArg(scheme: "auto", host: "172.22.23.61", expected: .http),
@@ -74,4 +67,10 @@ struct RequestSchemeTests {
_ = try requestScheme.schemeFor(host: "")
}
}
@Test func testIsInternalHostWithDefaultDNSDomain() throws {
let defaultDnsDomain = DefaultsStore.get(key: .defaultDNSDomain)
let hostName = "some-dns-name.io.\(defaultDnsDomain)"
#expect(RequestScheme.isInternalHost(host: hostName, dnsDomain: defaultDnsDomain))
}
}