1915982 - isLocalIPv4 should consider 0.0.0.0/8 a local address per RFC1122

Status: RESOLVED FIXED

(Core :: Networking: DNS, defect, P2)

Description

[Maxime Thiebaut]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0

Steps to reproduce:

In the Browser Console, execute the following JavaScript:

Services.io.hostnameIsLocalIPAddress(Services.io.newURI(`http://0.0.0.0`))

Actual results:

The Browser Console returns false.

This impacts things like the DoH canary domain (use-application-dns.net) where a 0.0.0.0 response is incorrectly considered positive. As an example, OPNsense's Unbound DNS Blocklist returns by default the local 0.0.0.0 IP for blocked domains 1, which FireFox would fail to consider a negative result.

Expected results:

The Browser Console should return true for any IP within the 0.0.0.0/8 range as per RFC1122.

Currently only the 10/8 prefix (RFC 1918), 172.16/12 prefix (RFC 1918), 192.168/16 prefix (RFC 1918) and 169.254/16 prefix (Link Local) are considered local by isLocalIPv4.

Comment 1

[Maxime Thiebaut]

If this bug is considered valid, I would be happy to fix it as a first contribution.

Comment 2

[Daniel Veditz [:dveditz]]

Not that this specific address was likely to change use, but most of RFC 1122 has been updated and obsoleted over the past 35 years. For due diligence I'll note the IANA IPv4 Special-Purpose Address Registry confirms this block still has this meaning.

We will be blocking connections to 0.0.0.0 specifically in bug 1889130, but knowing it's local before we try could help in other cases. And this would be usefully correct for the unlikely case we encounter other 0.0.0.* addresses.

Comment 3

[Daniel Veditz [:dveditz]]

Valentin: is this a change your team would agree with?

Comment 4

[Valentin Gosu [:valentin] (he/him)]

Yes, I think this is something we should consider doing.

Comment 5

[Maxime Thiebaut]

Attachment: Bug 1915982 - Consider 0.0.0.0/8 as a local range. r=valentin

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/e45824d07bb5
Consider 0.0.0.0/8 as a local range. r=valentin,necko-reviewers

Comment 7

[Cristian Tuns]

Backed out for causing xpcshell failures

• Backout link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | netwerk/test/unit/test_dooh.js | xpcshell return code: 0
  TEST-UNEXPECTED-FAIL | netwerk/test/unit/test_dooh.js | test_no_retry_without_doh - [test_no_retry_without_doh : 1056] Expecting only one instance of NS_NET_STATUS_RESOLVED_HOST - "undefined" == 1
  TEST-UNEXPECTED-FAIL | netwerk/test/unit/test_trr.js | xpcshell return code: 0
  TEST-UNEXPECTED-FAIL | netwerk/test/unit/test_trr.js | test_no_retry_without_doh - [test_no_retry_without_doh : 1056] Expecting only one instance of NS_NET_STATUS_RESOLVED_HOST - "undefined" == 1

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/4b7aa2d914f7
Consider 0.0.0.0/8 as a local range. r=valentin,necko-reviewers

Comment 9

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/4b7aa2d914f7