Merge branch 'fix-ipv4-mapped-ipv6-for-bypassed-ips' into update-qa-tests

Author: bitterpanda63

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/IPList.java

@@ -18,13 +18,20 @@ public void add(String ipOrCIDR) {
             return; // Don't add if IP is null
         }
         IPAddress ip = new IPAddressString(ipOrCIDR).getAddress();
+        if (ip == null) {
+            return;
+        }
+        // Normalize IPv4-mapped IPv6 addresses to their IPv4 form so matching is symmetric.
+        if (ip.isIPv6() && ip.toIPv6().isIPv4Convertible()) {
+            IPAddress ipv4 = ip.toIPv6().toIPv4();
+            if (ipv4 != null) {
+                ip = ipv4;
+            }
+        }
         if (ipOrCIDR.contains("/")) {
-            // CIDR :
             ip = ip.toPrefixBlock();
         }
-        if (ip != null) {
-            ipAddresses.add(ip);
-        }
+        ipAddresses.add(ip);
     }
 
     public boolean matches(String ip) {

agent_api/src/test/java/collectors/WebRequestCollectorTest.java

@@ -262,33 +262,6 @@ void testReport_ipBlockedUsingLists_IPv4MappedBypass() {
         assertNull(Context.get());
     }
 
-    @Test
-    void testReport_bypassedIp_setsBypassedStore() {
-        List<String> bypassedIps = List.of("192.168.1.1");
-        ServiceConfigStore.updateFromAPIResponse(new APIResponse(
-                true, "", getUnixTimeMS(), List.of(), List.of(), bypassedIps, false, null, true, false, List.of()
-        ));
-
-        assertFalse(BypassedContextStore.isBypassed());
-
-        WebRequestCollector.Res response = WebRequestCollector.report(contextObject);
-
-        assertNull(response);
-        assertNull(Context.get());
-        assertTrue(BypassedContextStore.isBypassed());
-    }
-
-    @Test
-    void testReport_nonBypassedIp_clearsBypassedStore() {
-        BypassedContextStore.setBypassed(true);
-        assertTrue(BypassedContextStore.isBypassed());
-
-        WebRequestCollector.Res response = WebRequestCollector.report(contextObject);
-
-        assertNull(response);
-        assertFalse(BypassedContextStore.isBypassed());
-    }
-
     @Test
     void testReport_ipNotAllowedUsingLists_Ip_Bypassed() {
         ReportingApi.APIListsResponse blockedListsRes = new ReportingApi.APIListsResponse(

agent_api/src/test/java/helpers/IPListTest.java

@@ -140,4 +140,32 @@ public void testBlocklistStoredIPv4MappedMatchesIPv4Input() {
         blocklist.add("::ffff:23.45.67.89");
         assertTrue(blocklist.matches("::ffff:23.45.67.89"));
     }
+
+    @Test
+    public void testBlocklistAddInvalidIpIgnored() {
+        blocklist.add("notanip");
+        assertEquals(0, blocklist.length());
+        assertFalse(blocklist.matches("192.168.1.1"));
+    }
+
+    @Test
+    public void testBlocklistLengthEmpty() {
+        assertEquals(0, blocklist.length());
+    }
+
+    @Test
+    public void testBlocklistStoredIPv4MappedMatchesPlainIPv4() {
+        blocklist.add("::ffff:23.45.67.89");
+        assertTrue(blocklist.matches("23.45.67.89"));
+        assertTrue(blocklist.matches("::ffff:23.45.67.89"));
+        assertFalse(blocklist.matches("23.45.67.90"));
+    }
+
+    @Test
+    public void testBlocklistStoredIPv4MappedCidrMatchesPlainIPv4() {
+        blocklist.add("::ffff:10.0.0.0/104");
+        assertTrue(blocklist.matches("10.1.2.3"));
+        assertTrue(blocklist.matches("::ffff:10.1.2.3"));
+        assertFalse(blocklist.matches("11.1.2.3"));
+    }
 }