hacker07/NeoTachyon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Fix country lookup behind FakeIP DNS

Browse Source
This commit is contained in:
ushan0v
2026-07-11 00:10:56 +03:00
parent 6774d48356
commit 6577b341e1
3 changed files with 138 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/backend/country_detection_regression.sh
+31 -8
View File
@@ -19,9 +19,10 @@ mkdir -p "$WORK_DIR/bin"
cat >"$WORK_DIR/bin/dig" <<'SH'
#!/usr/bin/env sh
case "$2" in
alpha.example) printf '203.0.113.1\n' ;;
beta.example) printf '203.0.113.2\n' ;;
case " $* " in
*' alpha.example A '*) printf '8.8.8.8\n' ;;
*' beta.example A '*) printf '1.1.1.1\n' ;;
*' @9.9.9.9 country.invalid A '*) printf '8.6.112.0\n' ;;
esac
SH
chmod +x "$WORK_DIR/bin/dig"
@@ -30,6 +31,7 @@ cat >"$WORK_DIR/bin/curl" <<'SH'
#!/usr/bin/env sh
output=""
payload=""
resolve=""
while [ "$#" -gt 0 ]; do
case "$1" in
-o)
@@ -40,13 +42,18 @@ while [ "$#" -gt 0 ]; do
payload="$2"
shift 2
;;
--resolve)
resolve="$2"
shift 2
;;
*)
shift
;;
esac
done
printf '%s\n' "$payload" >"$FAKE_COUNTRY_PAYLOAD"
printf '[{"ip":"203.0.113.1","country":"DE"},{"ip":"203.0.113.2","country":"NL"}]\n' >"$output"
printf '%s\n' "$resolve" >"$FAKE_COUNTRY_RESOLVE"
printf '[{"ip":"8.8.8.8","country":"DE"},{"ip":"1.1.1.1","country":"NL"}]\n' >"$output"
printf '200'
SH
chmod +x "$WORK_DIR/bin/curl"
@@ -60,10 +67,21 @@ function fail(message) {
let detected = country.detect({
alpha: "alpha.example",
beta: "beta.example"
}, {});
beta: "beta.example",
zero: "0.0.0.0",
private: "192.168.1.1",
fakeip: "198.18.6.9",
documentation: "203.0.113.10"
}, {}, "9.9.9.9");
if (detected.alpha != "DE" || detected.beta != "NL")
fail("country.is response was not mapped to outbound tags");
if (detected.zero != null || detected.private != null || detected.fakeip != null || detected.documentation != null)
fail("non-public server addresses must not receive country metadata");
if (!country.public_ip("8.8.8.8") || !country.public_ip("2606:4700:4700::1111"))
fail("public address classification changed");
if (country.public_ip("0.0.0.0") || country.public_ip("192.168.1.1") || country.public_ip("198.18.6.9") || country.public_ip("fc00::1"))
fail("non-public address classification changed");
let cached = country.detect({
renamed: "alpha.example"
@@ -76,13 +94,18 @@ if (cached.renamed != "DE")
UCODE
FAKE_COUNTRY_PAYLOAD="$WORK_DIR/payload.json" \
FAKE_COUNTRY_RESOLVE="$WORK_DIR/resolve.txt" \
PODKOP_COUNTRY_IS_URL="https://country.invalid/" \
PATH="$WORK_DIR/bin:$PATH" \
ucode -L "$PODKOP_LIB" "$WORK_DIR/runner.uc"
grep -Fq '203.0.113.1' "$WORK_DIR/payload.json" ||
grep -Fq '8.8.8.8' "$WORK_DIR/payload.json" ||
fail "country.is request did not contain the first resolved IP"
grep -Fq '203.0.113.2' "$WORK_DIR/payload.json" ||
grep -Fq '1.1.1.1' "$WORK_DIR/payload.json" ||
fail "country.is request did not contain the second resolved IP"
grep -Fq 'country.invalid:443:8.6.112.0' "$WORK_DIR/resolve.txt" ||
fail "country.is request did not bypass the router FakeIP resolver"
grep -Eq '0\.0\.0\.0|192\.168\.1\.1|198\.18\.6\.9|203\.0\.113\.10' "$WORK_DIR/payload.json" &&
fail "country.is request contained a non-public address"
printf 'country detection regression checks passed\n'