Horizontal42/netsleuth
1
0
Fork 0
mirror of https://github.com/Horizontal42/netsleuth.git synced 2026-11-10 19:12:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

cli: force ipv4 for the egress_v4 identity lookup

Browse source 
the shared http client has no address family pinned, so on a dual-stack
host the 'egress_v4' gather could connect over ipv6 (os/happy-eyeballs
preference) and hand back an ipv6 literal labeled as egress_v4, with a
mismatched ip_version pulled from a different provider's own record.
mirror the existing egress_v6 forcing so each slot can only resolve
its own protocol. caught live during the --quick smoke test: the
report was analyzing an unrelated ipv6 asn instead of the real isp.
This commit is contained in:
Andrew Pimenov 2026-08-09 03:43:54 +03:00
parent 10c5939bcb
commit be03dd4f04
1 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
src/netcheck/cli.py
View file

@ -102,6 +102,24 @@ def _dedupe(findings: list[Finding]) -> list[Finding]:
async def _identity(client: httpx.AsyncClient, settings: Settings, options: Options, raw: dict) -> dict: async def _identity(client: httpx.AsyncClient, settings: Settings, options: Options, raw: dict) -> dict:
token = settings.ipinfo_token.get_secret_value() if settings.ipinfo_token else None token = settings.ipinfo_token.get_secret_value() if settings.ipinfo_token else None
lookup = options.target_value if options.target_kind in ("ip", "domain") else None lookup = options.target_value if options.target_kind in ("ip", "domain") else None
if options.target_kind is None:
# The shared client has no address family pinned, so on a dual-stack host it can
# silently connect over IPv6 (OS/happy-eyeballs preference) and hand back an IPv6
# literal mislabeled as egress_v4. Force IPv4 here the same way egress_v6 is forced
# below, so the two slots can never both resolve to the same protocol.
try:
transport = httpx.AsyncHTTPTransport(local_address="0.0.0.0")
async with httpx.AsyncClient(
transport=transport, timeout=settings.timeouts.http_seconds
) as v4_client:
merged, cf, flags, payloads = await gather_identity(
v4_client, settings.providers, ip=lookup, ipinfo_token=token
)
except (httpx.HTTPError, OSError):
merged, cf, flags, payloads = await gather_identity(
client, settings.providers, ip=lookup, ipinfo_token=token
)
else:
merged, cf, flags, payloads = await gather_identity( merged, cf, flags, payloads = await gather_identity(
client, settings.providers, ip=lookup, ipinfo_token=token client, settings.providers, ip=lookup, ipinfo_token=token
) )