networkpolicy_test.go

package networkpolicy

import (
	"log"
	"net"
	"net/netip"
	"regexp"
	"testing"

	"github.com/gaissmai/bart"
	"github.com/stretchr/testify/require"
	"github.com/yl2chen/cidranger"
)

func TestValidateAddress(t *testing.T) {
	var npOptions Options
	npOptions.DenyList = append(npOptions.DenyList, "127.0.0.0/8")
	np, err := New(npOptions)
	if err != nil {
		log.Fatal(err)
	}
	ok := np.ValidateAddress("127.0.0.1")
	require.Equal(t, false, ok, "Unexpected positive result")
	ok = np.ValidateAddress("192.168.1.1")
	require.Equal(t, true, ok, "Unexpected negative result")
}

func TestValidatePort(t *testing.T) {
	testCases := []struct {
		name     string
		options  Options
		port     int
		expected bool
	}{
		{"no port lists", Options{DenyList: []string{"10.0.0.0/8"}}, 443, true},
		{"allowed port", Options{AllowPortList: []int{443}}, 443, true},
		{"not in allow list", Options{AllowPortList: []int{443}}, 80, false},
		{"denied port", Options{DenyPortList: []int{22}}, 22, false},
		{"not in deny list", Options{DenyPortList: []int{22}}, 443, true},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			np, err := New(tc.options)
			require.NoError(t, err)
			require.Equal(t, tc.expected, np.ValidatePort(tc.port))
			require.Equal(t, tc.expected, np.ValidateAddressWithPort("192.168.1.1", tc.port))
		})
	}
}

func Test_ValidateV6Address(t *testing.T) {
	np, err := New(DefaultOptions)
	if err != nil {
		log.Fatal(err)
	}

	ok := np.ValidateAddress("::1")
	require.Equal(t, false, ok, "IPv6 localhost should be denied")

	ok = np.ValidateAddress("2404:6800:4002:81c::200e")
	require.Equal(t, true, ok, "Non-localhost IPv6 should be allowed")

	t.Run("validate", func(t *testing.T) {
		ok := np.Validate("::1")
		require.Equal(t, false, ok, "IPv6 localhost should be denied")
	})
}

func TestMultipleCases(t *testing.T) {
	var testCases = []struct {
		address       string
		expectedValid bool
	}{
		{"projectdiscovery.io", false},
		{"projectdiscovery.io:80", false},
		{"http://scanme.sh", false},
		{"scanme.sh:8080", true},
	}

	var npOptions Options
	npOptions.DenyList = append(npOptions.DenyList,
		"projectdiscovery.io",
		"projectdiscovery.io:80",
		"http://scanm.\\.sh",
		"honey\\.scanme\\.sh",
	)

	np, err := New(npOptions)
	if err != nil {
		log.Fatal(err)
	}

	for _, tc := range testCases {
		ok := np.Validate(tc.address)
		require.Equal(t, tc.expectedValid, ok, "Unexpected result for address: "+tc.address)
	}
}

func Benchmark_Networkpolicy_CIDRRanger(b *testing.B) {
	for i := 0; i < b.N; i++ {
		ranger := cidranger.NewPCTrieRanger()
		for _, r := range DefaultIPv4DenylistRanges {
			_, cidr, _ := net.ParseCIDR(r)
			_ = ranger.Insert(cidranger.NewBasicRangerEntry(*cidr))
		}
		contains, err := ranger.Contains(net.ParseIP("127.0.0.1"))
		if err != nil || !contains {
			b.Fatalf("unexpected error: %v %v", err, contains)
		}
	}
}

func Benchmark_Networkpolicy_BartAlgorithm(b *testing.B) {
	for i := 0; i < b.N; i++ {
		rtbl := new(bart.Table[net.IP])
		for _, r := range DefaultIPv4DenylistRanges {
			parsed, _ := netip.ParsePrefix(r)
			rtbl.Insert(parsed, nil)
		}

		_, contains := rtbl.Lookup(netip.MustParseAddr("127.0.0.1"))
		if !contains {
			b.Fatalf("expected to contain")
		}
	}
}

func TestAsCidr(t *testing.T) {
	tests := []struct {
		name     string
		input    string
		expected string
		wantErr  bool
	}{
		{
			name:     "IPv4 address",
			input:    "192.0.2.8",
			expected: "192.0.2.8/32",
			wantErr:  false,
		},
		{
			name:     "IPv6 address",
			input:    "3fff::",
			expected: "3fff::/128",
			wantErr:  false,
		},
		{
			name:     "IPv6 full address",
			input:    "3fff:1:beef:beef::beef",
			expected: "3fff:1:beef:beef::beef/128",
			wantErr:  false,
		},
		{
			name:     "IPv4 CIDR unchanged",
			input:    "192.0.2.0/24",
			expected: "192.0.2.0/24",
			wantErr:  false,
		},
		{
			name:     "IPv6 CIDR unchanged",
			input:    "3fff:1:beef:beef:beef:beef:beef:beef/96",
			expected: "3fff:1:beef:beef:beef:beef:beef:beef/96",
			wantErr:  false,
		},
		{
			name:     "invalid input",
			input:    "not-an-ip",
			expected: "",
			wantErr:  true,
		},
		{
			name:     "empty string",
			input:    "",
			expected: "",
			wantErr:  true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			result, err := asCidr(tt.input)
			if tt.wantErr {
				require.Error(t, err)
			} else {
				require.NoError(t, err)
				require.Equal(t, tt.expected, result.String())
			}
		})
	}
}

func TestDefaultOptionsContent(t *testing.T) {
	for _, scheme := range DefaultOptions.AllowSchemeList {
		require.True(t, schemePattern.MatchString(scheme), "Scheme %s doesn't match expected pattern protocol://", scheme)
	}

	// Test deny list entries are either valid IPs, CIDRs, or compilable regexes
	for _, entry := range DefaultOptions.DenyList {
		// Try parsing as IP
		if ip := net.ParseIP(entry); ip != nil {
			continue
		}

		// Try parsing as CIDR
		if _, _, err := net.ParseCIDR(entry); err == nil {
			continue
		}

		// Try compiling as regex
		if _, err := regexp.Compile(entry); err != nil {
			t.Errorf("Entry in DenyList is neither a valid IP, CIDR, nor a valid regex: %s", entry)
		}
	}
}

func TestValidateScheme(t *testing.T) {
	deny, err := New(Options{DenySchemeList: []string{"ftp"}})
	require.NoError(t, err)
	require.False(t, deny.Validate("ftp://example.com"))
	require.True(t, deny.Validate("https://example.com"))
	require.True(t, deny.Validate("example.com"))

	allow, err := New(Options{AllowSchemeList: []string{"https"}})
	require.NoError(t, err)
	require.True(t, allow.Validate("https://example.com"))
	require.False(t, allow.Validate("ws://example.com"))
	require.True(t, allow.Validate("example.com"))
	require.True(t, allow.Validate("example.com:443"))

	// schemes urlutil.Parse rejects
	for _, u := range []string{"gopher://example.com:70/_x", "dict://example.com:11211/", "file:///etc/passwd", "GOPHER://example.com"} {
		require.False(t, allow.Validate(u), u)
	}

	denyGopher, err := New(Options{DenySchemeList: []string{"gopher"}})
	require.NoError(t, err)
	require.False(t, denyGopher.Validate("gopher://example.com:70/_x"))

	ports, err := New(Options{DenyPortList: []int{6379}})
	require.NoError(t, err)
	require.False(t, ports.Validate("gopher://example.com:6379/_x"))
}

func TestValidateAddressForms(t *testing.T) {
	var denyList []string
	denyList = append(denyList, DefaultIPv4DenylistRanges...)
	denyList = append(denyList, DefaultIPv6DenylistRanges...)
	np, err := New(Options{DenyList: denyList})
	require.NoError(t, err)

	// IP literals that dial a denied IPv4 or IPv6 range
	for _, ip := range []string{
		"::ffff:127.0.0.1",
		"::ffff:7f00:1",
		"0:0:0:0:0:ffff:127.0.0.1",
		"::ffff:169.254.169.254",
		"::ffff:10.0.0.1",
		"::",
		"[::]",
		"[::ffff:127.0.0.1]",
		"::127.0.0.1",
		"fe80::1%lo0",
		"::1%1",
	} {
		require.False(t, np.Validate(ip), "Validate should deny %s", ip)
		require.False(t, np.ValidateAddress(ip), "ValidateAddress should deny %s", ip)
		_, ok := np.ValidateHost(ip)
		require.False(t, ok, "ValidateHost should deny %s", ip)
		require.False(t, np.ValidateURLWithIP("example.com", ip), "ValidateURLWithIP should deny %s", ip)
	}

	// names, URLs and host:port values that dial a denied range
	for _, host := range []string{
		"127.1",
		"2130706433",
		"0x7f.0.0.1",
		"0177.0.0.1",
		"0x7f000001",
		"0xa9.0xfe.0xa9.0xfe",
		"localhost",
		"LOCALHOST.",
		"foo.localhost",
		"http://127.0.0.1/",
		"http://[::ffff:127.0.0.1]:18081/x",
		"http://[::]:18082/",
		"http://2130706433/",
		"http://localhost:8080/",
		"127.0.0.1:80",
		"[::1]:80",
		"[::ffff:169.254.169.254]:80",
	} {
		require.False(t, np.Validate(host), "Validate should deny %s", host)
	}

	// public destinations stay allowed
	for _, host := range []string{
		"8.8.8.8",
		"::ffff:8.8.8.8",
		"2404:6800:4002:81c::200e",
		"http://8.8.8.8/",
		"http://[::ffff:8.8.8.8]:80/",
		"8.8.8.8:53",
		"134744072",
		"example.com",
		"http://example.com:8080/",
		"1.2.3.4.example.com",
		"localhost.example.com",
	} {
		require.True(t, np.Validate(host), "Validate should allow %s", host)
	}
	require.True(t, np.ValidateAddress("::ffff:8.8.8.8"))
}

func TestValidateExcludedIPv4Forms(t *testing.T) {
	// same as an exclude list with one IPv4 address
	np, err := New(Options{DenyList: []string{"127.0.0.1"}})
	require.NoError(t, err)

	for _, host := range []string{"::ffff:127.0.0.1", "[::ffff:7f00:1]", "0.0.0.0", "::", "http://[::ffff:127.0.0.1]:18081/via-redirect", "127.1"} {
		require.False(t, np.Validate(host), "Validate should deny %s", host)
	}
	require.False(t, np.ValidateAddress("::ffff:127.0.0.1"))
	require.False(t, np.ValidateAddress("::"))
	require.True(t, np.Validate("::ffff:127.0.0.2"))
	require.True(t, np.Validate("8.8.8.8"))
}

func TestValidateAllowListMappedForms(t *testing.T) {
	np, err := New(Options{AllowList: []string{"10.0.0.0/8"}})
	require.NoError(t, err)

	require.True(t, np.Validate("::ffff:10.0.0.1"))
	require.True(t, np.ValidateAddress("[::ffff:10.0.0.1]"))
	require.False(t, np.Validate("::ffff:8.8.8.8"))
	require.False(t, np.ValidateAddress("8.8.8.8"))
}

func TestValidateHostnameDenyRule(t *testing.T) {
	np, err := New(Options{DenyList: DefaultHostDenylist})
	require.NoError(t, err)

	require.False(t, np.Validate("localhost"))
	require.True(t, np.Validate("example.com"))
}

func TestValidateHostBracketedIP(t *testing.T) {
	np, err := New(Options{DenyList: []string{"10.0.0.0/8"}})
	require.NoError(t, err)

	ip, ok := np.ValidateHost("[::1]")
	require.True(t, ok)
	require.Equal(t, "::1", ip)
}