Skip to content

fix(apple): don't send connlib DNS server IPs that aren't IPs - #9242

Merged
jamilbk merged 2 commits into
mainfrom
fix/dns-server-parsing
May 27, 2025
Merged

fix(apple): don't send connlib DNS server IPs that aren't IPs#9242
jamilbk merged 2 commits into
mainfrom
fix/dns-server-parsing

Conversation

@jamilbk

@jamilbk jamilbk commented May 27, 2025

Copy link
Copy Markdown
Member

When pulling IPs from system resolvers, it's possible the IPv6 addresses may contain scopes which will cause connlib to barf when parsing.

To fix these, we first convert to the Swift-native type IPv4Address or IPv6Address and then use the string representation of those types, which normalizes them to plain addresses.

Fixes #9055

@jamilbk
jamilbk requested review from Copilot and thomaseizinger and removed request for Copilot May 27, 2025 00:12
@vercel

vercel Bot commented May 27, 2025

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
firezone ✅ Ready (Inspect) Visit Preview 💬 Add feedback May 27, 2025 0:15am

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes an issue where connlib fails when given IPv6 addresses containing scopes by normalizing the resolver IP addresses using Swift-native types.

  • Normalize IP addresses by converting them to IPv4Address or IPv6Address and using their string representations
  • Log a warning if an address fails to parse as either IPv4 or IPv6

Comment on lines +456 to +463
return parsedResolvers.append("\(ipv4Address)")
}

if let ipv6Address = IPv6Address(stringAddress) {
return parsedResolvers.append("\(ipv6Address)")
}

Log.warning("IP address \(stringAddress) did not parse as either IPv4 or IPv6")

Copilot AI May 27, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider using an if/else-if chain instead of separate if statements to clarify that only one address type should be added and to avoid needless condition checks.

Suggested change
return parsedResolvers.append("\(ipv4Address)")
}
if let ipv6Address = IPv6Address(stringAddress) {
return parsedResolvers.append("\(ipv6Address)")
}
Log.warning("IP address \(stringAddress) did not parse as either IPv4 or IPv6")
parsedResolvers.append("\(ipv4Address)")
} else if let ipv6Address = IPv6Address(stringAddress) {
parsedResolvers.append("\(ipv6Address)")
} else {
Log.warning("IP address \(stringAddress) did not parse as either IPv4 or IPv6")
}

Copilot uses AI. Check for mistakes.
@jamilbk

jamilbk commented May 27, 2025

Copy link
Copy Markdown
Member Author

Tested on iOS and macOS with IPv4 and IPv6 resolvers with manual scopes applied.

var parsedResolvers: [String] = []

// Normalize addresses to remove any possible scope suffixes
resolvers.forEach { stringAddress in

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there no iterator-like way of doing this? Like filter_map and then collect? Would avoid the mutability.

@thomaseizinger thomaseizinger changed the title fix(apple): Don't send connlib DNS server IPs that aren't IPs fix(apple): don't send connlib DNS server IPs that aren't IPs May 27, 2025
@jamilbk
jamilbk added this pull request to the merge queue May 27, 2025
Merged via the queue into main with commit 94b05a1 May 27, 2025
@jamilbk
jamilbk deleted the fix/dns-server-parsing branch May 27, 2025 00:54
jamilbk added a commit that referenced this pull request Jun 1, 2025
A regression was introduced in #9242 where it appears that some Sentry
events don't contain messages, so the filtering module is updated only
to act on events with messages.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

3 participants