# HG changeset patch
# User Mads Kiilerich <mads@kiilerich.com>
# Date 1535757133 -7200
# Node ID c57d926edd39aa6a36b83cfc26c488e786031e31
# Parent  a79c137b1ddcb56bf0253ba46613017762f85946
auth: strip RFC4007 zone identifiers from IPv6 addresses before doing access control

If using IPv6, the request IP address might contain a '%' that the ipaddr
module that is used for IP filtering can't handle.

https://tools.ietf.org/html/rfc4007#section-11 specifies how IPv6 addresses can
have zone identifiers like trailing '%13' or '%eth0'. The zone identifier is
used to help distinguish *if* the same address should be available on multiple
interfaces. It *could* potentially have security implications in the odd case
where the same address is different on different interfaces. The IP whitelist
functionality does however not support zone filters, so there is no way users
can expect the zone to be relevant for IP filtering. We can thus safely strip
the zone index and only check for match on the other parts of the address.

diff -r a79c137b1ddc -r c57d926edd39 kallithea/lib/auth.py
--- a/kallithea/lib/auth.py	Thu Aug 30 20:58:25 2018 +0200
+++ b/kallithea/lib/auth.py	Sat Sep 01 01:12:13 2018 +0200
@@ -1008,6 +1008,7 @@
     :param allowed_ips: list of allowed ips together with mask
     """
     from kallithea.lib import ipaddr
+    source_ip = source_ip.split('%', 1)[0]
     log.debug('checking if ip:%s is subnet of %s', source_ip, allowed_ips)
     if isinstance(allowed_ips, (tuple, list, set)):
         for ip in allowed_ips: