Count a bare IPv6 endpoint as a full host

[gab-arrobo]

No description provided.

[Copilot]

Copilot review overview

🟡 Changes recommended

IPv4-mapped IPv6 hosts remain undercounted, allowing configurations beyond the UPF shape limit.

Review effort: Balanced
Findings: 1

Open (1)

• Mapped IPv4 host prefixes are undercounted during CIDR validation · New

What changed in this PR

Corrects UPF rule-shape accounting so bare IPv6 endpoints count as full hosts rather than match-any addresses.

Changes:

• Selects host prefixes based on address family.
• Adds a shape-limit regression test and updates explanatory comments.

File	Description
configapi/​slice_operations_test.go	Tests bare IPv6 host accounting at the shape limit.
configapi/​slice_helpers.go	Adds /128 handling for bare IPv6 endpoints.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused fix preserves existing prefix behavior and includes regression coverage for both IPv6 host forms.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Mapped IPv4 host prefixes are undercounted during CIDR validation

[midwell]

A note on how the UPF itself reads a bare IPv6 address, in case it matters for this change. Its parseNet (pfcpiface/parse_sdf.go) appends /32 to every address written without a prefix, IPv4 or IPv6:

case 1:
	ipnet = ipNetFields[0] + "/32"

ParseCIDR then gives 2001:db8::1/32 a 128-bit mask with only the leading 32 bits set, and ipMask2int keeps the low 32 bits, which are all zero. I measured this on upf main (b86c29e) by running each filter through parsePDR and building the masks as addPDR does:

Filter endpoint	dstIP mask installed
any	00000000
10.0.0.1	ffffffff
2001:db8::1	00000000
::ffff:192.0.2.1	00000000
2001:db8::1/128	ffffffff

So the UPF installs a bare IPv6 address, including an IPv4-mapped one, as a match on any address, not a single host. Counting it as a host can merge it with an existing IPv4 /32 host shape where the UPF adds the any-address shape, which lets one more shape through than the table holds.

The underlying oddity is arguably on the UPF side: a bare IPv6 endpoint silently matching every address is not what anyone writing it would expect. I'm happy to open a PR there so parseNet appends /128 to an IPv6 address, which would make this change's count exact, or one here to follow the UPF as it is today. Whichever you prefer.

🤖 Generated with Claude Code