Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c7a6160aac237c2d5392fe0fcc5ba8920d002e4a
https://github.com/WebKit/WebKit/commit/c7a6160aac237c2d5392fe0fcc5ba8920d002e4a
Author: Ian Gower <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
M Source/WebCore/Modules/fetch/IPAddressSpace.cpp
M Source/WebKit/UIProcess/BrowsingContextGroup.cpp
M Tools/TestWebKitAPI/CMakeLists.txt
M Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp
Log Message:
-----------
Classify address spaces beyond the ranges in the Local Network Access spec
https://bugs.webkit.org/show_bug.cgi?id=321725
rdar://184859143
Reviewed by Pascoe.
Widens IP address space classification beyond the ranges the Local Network
Access spec
enumerates, and replaces string comparison on the host with a prefix-table
match over raw
address bytes. See
https://wicg.github.io/local-network-access/#ip-address-space-section and
https://github.com/WICG/local-network-access/issues/6, /issues/13 and
/issues/15.
The previous implementation compared host strings (`host == "::1"`,
`host.contains(':')`),
which missed equivalent spellings of the same address -- `::1` and
`0:0:0:0:0:0:0:1` are the
same host. Parsing to bytes and matching a prefix table classifies all
spellings of an
address identically.
Classifying a range as public is the permissive answer here: the check fires
only when the
target is less public than the client, so a range left public is reachable from
a public page
with no permission at all. None of the ranges below can host a publicly-served
site.
Ranges added beyond the spec, each covered by a test:
- as loopback: 0.0.0.0/32 (this host, RFC 1122), 198.18.0.0/15 (benchmarking,
RFC 2544),
::/128 (IPv6 unspecified, RFC 4291)
- as local: 0.0.0.0/8 (this network, RFC 791), 100.64.0.0/10 (carrier-grade
NAT, RFC 6598),
192.0.0.0/24 (IETF protocol assignments, RFC 6890), 192.0.2.0/24,
198.51.100.0/24,
203.0.113.0/24 (documentation, RFC 5737), 192.88.99.0/24 (deprecated 6to4
relay anycast,
RFC 7526), 224.0.0.0/4 (multicast), 240.0.0.0/4 (reserved, RFC 1112)
- as local, IPv6: fec0::/10 (deprecated site-local, RFC 3879), 2001:db8::/32
and 3fff::/20
(documentation, RFC 3849 and RFC 9637), ff00::/8 (multicast, RFC 4291),
0100::/64
(discard-only, RFC 6666)
- IPv4-mapped IPv6 forms, which now classify as their embedded IPv4 address
does
- NAT64 (RFC 6052), which likewise classifies as the IPv4 address it carries:
the Well-Known
Prefix 64:ff9b::/96, and 64:ff9b:1::/48 reserved for local use (RFC 8215).
Without this a
public page could reach a private host through a NAT64 prefix with no
permission. At /48 the
embedded address straddles the octet at bits 64-71 that the addressing
architecture reserves,
so 64:ff9b:1:c0a8:1:100:: carries 192.168.1.1. An operator's
network-specific prefix cannot be
recognised here, so only these two fixed prefixes are handled.
Also recognises localhost and .local by name, which the previous host-string
path did not.
Non-dotted IPv4 hosts are canonicalised by the URL parser before classification
sees them, so
http://2130706433/ and http://0x7f000001/ arrive as 127.0.0.1. Asserted rather
than assumed, since
classifyHost() only parses dotted quads and would return Public for any form
the parser stopped
normalising.
Adds Tests/WebCore/IPAddressSpaceTests.cpp to
Tools/TestWebKitAPI/CMakeLists.txt. It was never
listed, so every CMake port has been skipping these tests entirely.
Also gates BrowsingContextGroup's shared-process exclusion on the
LocalNetworkAccessEnabled
preference. Widening the classifier changes what isLoopbackOrLocalNetworkSite()
returns, and
without the gate that would alter site-isolation process placement for
embedders with the
feature off. Ordinary hostnames are unaffected either way: classifyHost()
returns Public for
anything that is not an address literal, so only literals, localhost and .local
names are
excluded from the shared process.
Two entry points share the tables: determineIPAddressSpace(URL/Site), used
before any
connection exists by fetch()'s targetAddressSpace derivation and site-isolation
process
placement; and classifyIPAddressSpace(IPAddress), used for a resolved peer
address.
No behaviour change with LocalNetworkAccessEnabled off.
* Source/WebCore/Modules/fetch/IPAddressSpace.cpp:
(WebCore::matchesPrefix):
(WebCore::classifyAddress):
(WebCore::classifyIPv4Address):
(WebCore::nat64EmbeddedIPv4Address):
(WebCore::classifyIPv6Address):
(WebCore::determineIPAddressSpaceFromHost):
* Source/WebKit/UIProcess/BrowsingContextGroup.cpp:
(WebKit::isLoopbackOrLocalNetworkSite):
(WebKit::BrowsingContextGroup::sharedProcessForSite):
* Tools/TestWebKitAPI/CMakeLists.txt:
* Tools/TestWebKitAPI/Tests/WebCore/IPAddressSpaceTests.cpp:
Canonical link: https://commits.webkit.org/319918@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
