firezone / firezone / 41559671885

80%

Build Type

push

github

Committed by web-flow

Commit Message

fix(gateway): cap proxy IPs per domain in AssignedIps (#16157)

The Client always assigns 4 IPv4 and / or 4 IPv6 proxy IPs to a DNS
resource domain. The Gateway accepted any number of them, and every one
of them ends up in its NAT state for the Client.

Proxy IPs are now a dedicated type that holds at most one set of 4
addresses per IP version, each within the reserved resource ranges and
kept sorted. Its wire format is unchanged, so old Clients and Gateways
remain compatible. When the proxy IPs of an `AssignedIps` event do not
fit this shape, the Gateway answers it with an inactive `DomainStatus`
instead of setting up NAT for the domain.

Related:
https://github.com/firezone/firezone/security/advisories/GHSA-j2vp-73ph-xcpm

---------

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

1371 of 2287 branches covered (59.95%)

Branch coverage included in aggregate %.

242 of 256 new or added lines in 7 files covered. (94.53%)

104 existing lines in 6 files now uncovered.

94567 of 117559 relevant lines covered (80.44%)

368971.14 hits per line