From aca3ee0ac8cc6b389bcae2b767c0289ba21c8bf0 Mon Sep 17 00:00:00 2001
From: Dirk Engling <erdgeist@erdgeist.org>
Date: Sun, 31 Mar 2024 13:36:26 +0200
Subject: Prevent proxied ips of the wrong flavour to poison our clients

---
 ot_http.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/ot_http.c b/ot_http.c
index 35f88b1..88b4261 100644
--- a/ot_http.c
+++ b/ot_http.c
@@ -420,9 +420,17 @@ static ssize_t http_handle_announce( const int64 sock, struct ot_workstruct *ws,
   if( accesslist_is_blessed( cookie->ip, OT_PERMISSION_MAY_PROXY ) ) {
     ot_ip6 proxied_ip;
     char *fwd = http_header( ws->request, ws->header_size, "x-forwarded-for" );
-    if( fwd && scan_ip6( fwd, proxied_ip ) )
+    if( fwd && scan_ip6( fwd, proxied_ip ) ) {
+      /* If proxy reports an ipv6 address but we can only handle v4 (or vice versa), bail out */
+#ifndef WANT_V6
+      if( !ip6_isv4mapped(proxied_ip) )
+#else
+      if( ip6_isv4mapped(proxied_ip) )
+#endif
+        HTTPERROR_400_PARAM;
+
       OT_SETIP( &ws->peer, proxied_ip );
-    else
+    } else
       OT_SETIP( &ws->peer, cookie->ip );
   } else
 #endif
-- 
cgit v1.2.3