Skip to content

fix(workloadapi): accept IPv6 literals in tcp Workload API addresses #481

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maxlambrecht merged 2 commits into from
Oct 29, 2026
+12 −3
Merged

fix(workloadapi): accept IPv6 literals in tcp Workload API addresses #481

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aa0f434
fix(workloadapi): accept IPv6 literals in tcp Workload API addresses
NopeCharon Oct 27, 2026
b34da7d
fix(workloadapi): reject IPv6 zone IDs in tcp Workload API addresses
NopeCharon Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions java-spiffe-core/src/main/java/io/spiffe/workloadapi/Address.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,8 +157,10 @@ private static void validateTcpAddress(final URI parsedAddress) throws SocketEnd
throw new SocketEndpointAddressException(String.format(error, parsedAddress));
}

boolean ipValid;
ipValid = InetAddresses.isInetAddress(parsedAddress.getHost());
// URI.getHost() returns IPv6 literals enclosed in square brackets (e.g. '[::1]').
// Zone IDs (e.g. '[fe80::1%eth0]') are not allowed by RFC 3986, so hosts containing '%' are rejected.
String host = parsedAddress.getHost();
boolean ipValid = host.indexOf('%') < 0 && InetAddresses.isUriInetAddress(host);
if (!ipValid) {
String error = "Workload endpoint tcp socket URI host component must be an IP:port: %s";
throw new SocketEndpointAddressException(String.format(error, parsedAddress));
Expand Down
9 changes: 8 additions & 1 deletion java-spiffe-core/src/test/java/io/spiffe/workloadapi/AddressTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,9 @@ static Stream<Arguments> provideTestAddress() {
Arguments.of("unix:/path/to/endpoint.sock", URI.create("unix:/path/to/endpoint.sock")),
Arguments.of("unix:///path/to/endpoint.sock", URI.create("unix:///path/to/endpoint.sock")),
Arguments.of("tcp://127.0.0.1:8000", URI.create("tcp://127.0.0.1:8000")),
Arguments.of("tcp://[::1]:8000", URI.create("tcp://[::1]:8000")),
Arguments.of("tcp://[2001:db8::1]:8000", URI.create("tcp://[2001:db8::1]:8000")),
Arguments.of("tcp://[::ffff:127.0.0.1]:8000", URI.create("tcp://[::ffff:127.0.0.1]:8000")),

Arguments.of("", "Workload endpoint socket URI must have a tcp:// or unix:// scheme: "),
Arguments.of("\\t", "Workload endpoint socket is not a valid URI: \\t"),
Expand All @@ -69,7 +72,11 @@ static Stream<Arguments> provideTestAddress() {
Arguments.of("tcp://1.2.3.4:5#whatever", "Workload endpoint tcp socket URI must not include a fragment: tcp://1.2.3.4:5#whatever"),
Arguments.of("tcp://john:doe@1.2.3.4:5/path", "Workload endpoint tcp socket URI must not include user info: tcp://john:doe@1.2.3.4:5/path"),
Arguments.of("tcp://foo:9000", "Workload endpoint tcp socket URI host component must be an IP:port: tcp://foo:9000"),
Arguments.of("tcp://1.2.3.4", "Workload endpoint tcp socket URI host component must include a port: tcp://1.2.3.4")
Arguments.of("tcp://[foo]:9000", "Workload endpoint socket is not a valid URI: tcp://[foo]:9000"),

@maxlambrecht maxlambrecht Oct 29, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you also add rejected cases for tcp://[fe80::1%eth0]:8000 and tcp://[fe80::1%25eth0]:8000 to cover the scope restriction?

The [foo] case is useful malformed-input coverage, but java.net.URI rejects it before it reaches the changed check. An accepted tcp://[::ffff:127.0.0.1]:8000 case would also be useful coverage for IPv4-mapped IPv6.

@NopeCharon NopeCharon Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added both zone ID cases as rejected and tcp://[::ffff:127.0.0.1]:8000 as accepted. I kept the [foo] case as malformed input coverage.

Arguments.of("tcp://[fe80::1%eth0]:8000", "Workload endpoint tcp socket URI host component must be an IP:port: tcp://[fe80::1%eth0]:8000"),
Arguments.of("tcp://[fe80::1%25eth0]:8000", "Workload endpoint tcp socket URI host component must be an IP:port: tcp://[fe80::1%25eth0]:8000"),
Arguments.of("tcp://1.2.3.4", "Workload endpoint tcp socket URI host component must include a port: tcp://1.2.3.4"),
Arguments.of("tcp://[::1]", "Workload endpoint tcp socket URI host component must include a port: tcp://[::1]")
);
}

Expand Down
Loading