Reject IPv4-mapped IPv6 addresses in IPAddr's IsLoopback and IsMulticast#157
Merged
kjamieson-sdm merged 1 commit intoJun 1, 2026
Conversation
kjamieson-sdm
force-pushed
the
kjamieson/is-loopback-exclude-4-in-6
branch
from
fc241d8 to
eae5d6e
Compare
…sMulticast The Rust standard library, and therefore the Cedar Rust implementation, has different behavior from Go's standard library with respect to IPv4-mapped IPv6 addresses. In Cedar Rust, an IPv4 loopback address encoded as an IPv4-mapped IPv6 address (such as ::ffff:127.0.0.1) is not considered to be a valid loopback address. Similarily, an IPv4 multicast address encoded as an IPv4-mapped IPv6 address (such as ::ffff:224.0.0.0) is not considered to be a valid multicast address. The Go standard library, in contrast, unwraps such addresses and therefore Cedar Go would consider those addresses to be valid loopback and multicast addresses, respectively. This patch modifies Cedar Go's IsLoopback and IsMulticast implementation to explicitly check for IPv4-mapped IPv6 addresses and reject those, to conform to the behavior of Cedar Rust. Signed-off-by: Kevin Jamieson <kevin.jamieson@delinea.com>
kjamieson-sdm
force-pushed
the
kjamieson/is-loopback-exclude-4-in-6
branch
from
eae5d6e to
9005ab6
Compare
patjakdev
approved these changes
Jun 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
#152
Description of changes:
This PR updates IPAddr's IsLoopback and IsMulticast methods to reject IPv4-mapped IPv6 addresses to conform to the behavior of Cedar Rust.
The Rust standard library, and therefore the Cedar Rust implementation, has different behavior from Go's standard library with respect to IPv4-mapped IPv6 addresses.
In Cedar Rust, an IPv4 loopback address encoded as an IPv4-mapped IPv6 address (such as ::ffff:127.0.0.1) is not considered to be a valid loopback address.
Similarily, an IPv4 multicast address encoded as an IPv4-mapped IPv6 address (such as ::ffff:224.0.0.0) is not considered to be a valid multicast address.
The Go standard library, in contrast, unwraps such addresses and therefore Cedar Go would consider those addresses to be valid loopback and multicast addresses, respectively.
This patch modifies Cedar Go's IsLoopback and IsMulticast implementation to explicitly check for IPv4-mapped IPv6 addresses and reject those, to conform to the behavior of Cedar Rust.