net: fix BlockList.fromJSON for IPv4-mapped IPv6 rules

BlockList.toJSON() serializes IPv4-mapped IPv6 addresses in mixed
dotted-quad form (e.g. "::ffff:192.0.2.128"), but the fromJSON() rule
parser's IPv6 regexes excluded "." and capped the length at 39, so such
rules were silently corrupted or dropped on a toJSON()/fromJSON()
round-trip. Allow "." and raise the cap to 45 (the longest mixed form).

Signed-off-by: Daijiro Wachi <daijiro.wachi@gmail.com>
PR-URL: #64125
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>

Author: watilde

lib/internal/blocklist.js

@@ -383,7 +383,7 @@ class BlockList {
         // - 2001:db8:85a3::8a2e:370:7334/64 (compressed)
         // - 2001:db8:85a3::192.0.2.128/64 (mixed)
         const ipv6SubnetMatch = item.match(
-          /Subnet: IPv6 ([0-9a-fA-F:]{1,39})\/([0-9]{1,3})/i,
+          /Subnet: IPv6 ([0-9a-fA-F:.]{1,45})\/([0-9]{1,3})/i,
         );
         if (ipv6SubnetMatch) {
           const { 1: network, 2: prefix } = ipv6SubnetMatch;
@@ -396,7 +396,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full)
         // - 2001:db8:85a3::8a2e:370:7334 (compressed)
         // - 2001:db8:85a3::192.0.2.128 (mixed)
-        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:]{1,39})/i);
+        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:.]{1,45})/i);
         if (ipv6AddressMatch) {
           const { 1: address } = ipv6AddressMatch;
           this.addAddress(address, 'ipv6');
@@ -408,7 +408,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334-2001:0db8:85a3:0000:0000:8a2e:0370:7335 (full)
         // - 2001:db8:85a3::8a2e:370:7334-2001:db8:85a3::8a2e:370:7335 (compressed)
         // - 2001:db8:85a3::192.0.2.128-2001:db8:85a3::192.0.2.129 (mixed)
-        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:]{1,39})-([0-9a-fA-F:]{1,39})/i);
+        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:.]{1,45})-([0-9a-fA-F:.]{1,45})/i);
         if (ipv6RangeMatch) {
           const { 1: start, 2: end } = ipv6RangeMatch;
           this.addRange(start, end, 'ipv6');

test/parallel/test-blocklist.js

@@ -955,3 +955,40 @@ const util = require('util');
   assert(!blockList.check('10.2.0.1'));
   assert.strictEqual(blockList.rules.length, 1);
 }
+
+{
+  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
+  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
+  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
+  // in that notation.
+  const bl = new BlockList();
+  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
+  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');
+
+  const expected = [
+    'Address: IPv6 ::ffff:192.0.2.128',
+    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
+    'Subnet: IPv6 ::ffff:10.0.0.0/120',
+  ];
+  assert.deepStrictEqual(bl.toJSON().sort(), expected);
+
+  const restored = new BlockList();
+  restored.fromJSON(bl.toJSON());
+
+  // The restored rules must be identical (lossless round-trip).
+  assert.deepStrictEqual(restored.toJSON().sort(), expected);
+
+  // And it must still match the same addresses as the original.
+  [
+    ['::ffff:192.0.2.128', true],  // the single address
+    ['::ffff:192.0.2.129', false],
+    ['::ffff:10.0.0.50', true],    // inside the subnet
+    ['::ffff:10.0.1.0', false],
+    ['::ffff:172.16.0.5', true],   // inside the range
+    ['::ffff:172.16.0.20', false],
+  ].forEach(([address, result]) => {
+    assert.strictEqual(bl.check(address, 'ipv6'), result);
+    assert.strictEqual(restored.check(address, 'ipv6'), result);
+  });
+}