From 4e390d6aa891990854cff382a8be45b5b531b7ae Mon Sep 17 00:00:00 2001 From: J Logan Date: Wed, 29 Apr 2026 15:04:24 -0700 Subject: [PATCH] Fix RequestScheme formatting. (#1473) ## Type of Change - [x] Bug fix - [ ] New feature - [ ] Breaking change - [ ] Documentation update ## Motivation and Context `main` build broke with last commit. ## Testing - [ ] Tested locally - [ ] Added/updated tests - [ ] Added/updated docs --------- Signed-off-by: Kathryn Baldauf Co-authored-by: Kathryn Baldauf --- .../ContainerAPIService/Client/RequestScheme.swift | 14 +++++++------- .../RequestSchemeTests.swift | 13 ++++++------- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/Sources/Services/ContainerAPIService/Client/RequestScheme.swift b/Sources/Services/ContainerAPIService/Client/RequestScheme.swift index c5bc15e4..54435ad7 100644 --- a/Sources/Services/ContainerAPIService/Client/RequestScheme.swift +++ b/Sources/Services/ContainerAPIService/Client/RequestScheme.swift @@ -49,20 +49,20 @@ public enum RequestScheme: String, Sendable { case .http, .https: return self case .auto: - return Self.isInternalHost(host: host) ? .http : .https + return Self.isInternalHost(host: host, dnsDomain: DefaultsStore.getOptional(key: .defaultDNSDomain)) ? .http : .https } } /// Checks if the given `host` string is a private IP address /// or a domain typically reachable only on the local system. - private static func isInternalHost(host: String) -> Bool { + internal static func isInternalHost(host: String, dnsDomain: String? = nil) -> Bool { // The localhost hostname is private. if host == "localhost" { return true } - // If it corresponds to our default domain name, treat it as private. - if let dnsDomain = DefaultsStore.getOptional(key: .defaultDNSDomain) { + // If hostname uses the provided DNS domain, treat it as private. + if let dnsDomain { if host.hasSuffix(".\(dnsDomain)") { return true } @@ -76,17 +76,17 @@ public enum RequestScheme: String, Sendable { let ipv4Value = ipv4Address.value // 10.0.0.0/8 and 127.0.0.0/8 are private CIDRs. - if (ipv4Value & 0xff000000 == 0x0a000000) || (ipv4Value & 0xff000000 == 0x7f000000) { + if (ipv4Value & 0xff00_0000 == 0x0a00_0000) || (ipv4Value & 0xff00_0000 == 0x7f00_0000) { return true } // 192.168.0.0/16 is a private CIDR. - if ipv4Value & 0xffff0000 == 0xc0a80000 { + if ipv4Value & 0xffff_0000 == 0xc0a8_0000 { return true } // 172.16.0.0/12 is a private CIDR. - if ipv4Value & 0xfff00000 == 0xac100000 { + if ipv4Value & 0xfff0_0000 == 0xac10_0000 { return true } diff --git a/Tests/ContainerAPIClientTests/RequestSchemeTests.swift b/Tests/ContainerAPIClientTests/RequestSchemeTests.swift index e3fa1dec..7ff0aa27 100644 --- a/Tests/ContainerAPIClientTests/RequestSchemeTests.swift +++ b/Tests/ContainerAPIClientTests/RequestSchemeTests.swift @@ -22,8 +22,6 @@ import Testing @testable import ContainerAPIClient struct RequestSchemeTests { - static let defaultDnsDomain = DefaultsStore.get(key: .defaultDNSDomain) - internal struct TestArg { let scheme: String let host: String @@ -37,25 +35,20 @@ struct RequestSchemeTests { TestArg(scheme: "https", host: "localhost", expected: .https), TestArg(scheme: "http", host: "localhost", expected: .http), TestArg(scheme: "auto", host: "localhost", expected: .http), - // localhost prefix must not match other hostnames (regression: hasPrefix("localhost")) TestArg(scheme: "auto", host: "localhost.evil.com", expected: .https), TestArg(scheme: "http", host: "127.0.0.1", expected: .http), TestArg(scheme: "https", host: "127.0.0.1", expected: .https), TestArg(scheme: "auto", host: "127.0.0.1", expected: .http), TestArg(scheme: "auto", host: "127.255.255.255", expected: .http), - // 127.x.x.x prefix must not match hostnames (regression: hasPrefix("127.")) TestArg(scheme: "auto", host: "127.0.0.1.evil.com", expected: .https), TestArg(scheme: "https", host: "10.3.4.1", expected: .https), TestArg(scheme: "auto", host: "10.3.4.1", expected: .http), TestArg(scheme: "auto", host: "10.255.255.255", expected: .http), - // 10.x.x.x prefix must not match hostnames (regression: hasPrefix("10.")) TestArg(scheme: "auto", host: "10.0.0.1.evil.com", expected: .https), TestArg(scheme: "auto", host: "192.168.0.1", expected: .http), TestArg(scheme: "auto", host: "192.168.255.255", expected: .http), TestArg(scheme: "auto", host: "192.169.0.1", expected: .https), - // 192.168.x.x prefix must not match hostnames (regression: hasPrefix("192.168.")) TestArg(scheme: "auto", host: "192.168.1.1.evil.com", expected: .https), - TestArg(scheme: "auto", host: "some-dns-name.io.\(Self.defaultDnsDomain)", expected: .http), TestArg(scheme: "auto", host: "some-dns-name.io", expected: .https), TestArg(scheme: "auto", host: "172.32.0.1", expected: .https), TestArg(scheme: "auto", host: "172.22.23.61", expected: .http), @@ -74,4 +67,10 @@ struct RequestSchemeTests { _ = try requestScheme.schemeFor(host: "") } } + + @Test func testIsInternalHostWithDefaultDNSDomain() throws { + let defaultDnsDomain = DefaultsStore.get(key: .defaultDNSDomain) + let hostName = "some-dns-name.io.\(defaultDnsDomain)" + #expect(RequestScheme.isInternalHost(host: hostName, dnsDomain: defaultDnsDomain)) + } }