From 5a9d3abc10a497a1b7580d47cacb7b389183adcc Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 13 Mar 2026 21:27:08 +0000
Subject: [PATCH] test: tighten shared ip helper coverage

---
 src/shared/net/ip.test.ts | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/src/shared/net/ip.test.ts b/src/shared/net/ip.test.ts
index f89fb03f7ef..2ed2558214a 100644
--- a/src/shared/net/ip.test.ts
+++ b/src/shared/net/ip.test.ts
@@ -2,11 +2,16 @@ import { describe, expect, it } from "vitest";
 import { blockedIpv6MulticastLiterals } from "./ip-test-fixtures.js";
 import {
   extractEmbeddedIpv4FromIpv6,
+  isBlockedSpecialUseIpv4Address,
   isCanonicalDottedDecimalIPv4,
+  isCarrierGradeNatIpv4Address,
   isIpInCidr,
   isIpv6Address,
   isLegacyIpv4Literal,
+  isLoopbackIpAddress,
   isPrivateOrLoopbackIpAddress,
+  isRfc1918Ipv4Address,
+  normalizeIpAddress,
   parseCanonicalIpAddress,
 } from "./ip.js";
 
@@ -53,4 +58,35 @@ describe("shared ip helpers", () => {
     }
     expect(isPrivateOrLoopbackIpAddress("2001:4860:4860::8888")).toBe(false);
   });
+
+  it("normalizes canonical IP strings and loopback detection", () => {
+    expect(normalizeIpAddress("[::FFFF:127.0.0.1]")).toBe("127.0.0.1");
+    expect(normalizeIpAddress("  [2001:DB8::1]  ")).toBe("2001:db8::1");
+    expect(isLoopbackIpAddress("::ffff:127.0.0.1")).toBe(true);
+    expect(isLoopbackIpAddress("198.18.0.1")).toBe(false);
+  });
+
+  it("classifies RFC1918 and carrier-grade-nat IPv4 ranges", () => {
+    expect(isRfc1918Ipv4Address("10.42.0.59")).toBe(true);
+    expect(isRfc1918Ipv4Address("100.64.0.1")).toBe(false);
+    expect(isCarrierGradeNatIpv4Address("100.64.0.1")).toBe(true);
+    expect(isCarrierGradeNatIpv4Address("10.42.0.59")).toBe(false);
+  });
+
+  it("blocks special-use IPv4 ranges while allowing optional RFC2544 benchmark addresses", () => {
+    const loopback = parseCanonicalIpAddress("127.0.0.1");
+    const benchmark = parseCanonicalIpAddress("198.18.0.1");
+
+    expect(loopback?.kind()).toBe("ipv4");
+    expect(benchmark?.kind()).toBe("ipv4");
+    if (!loopback || loopback.kind() !== "ipv4" || !benchmark || benchmark.kind() !== "ipv4") {
+      throw new Error("expected ipv4 fixtures");
+    }
+
+    expect(isBlockedSpecialUseIpv4Address(loopback)).toBe(true);
+    expect(isBlockedSpecialUseIpv4Address(benchmark)).toBe(true);
+    expect(isBlockedSpecialUseIpv4Address(benchmark, { allowRfc2544BenchmarkRange: true })).toBe(
+      false,
+    );
+  });
 });