Mask host part of IPv6 addresses before pseudonymising

pkg/dnstap/message.go

@@ -173,6 +173,13 @@ func (m *Message) unpackDNSTap(data []byte, meta *meta) {
 		if !(m.HasFlags(ValidResponseAddr) && m.ResponseAddr.Is6()) { //nolint:staticcheck
 			m.flags &= ^ValidResponseAddr
 		}
+		// unmap IPv4-mapped IPv6 address for valid addresses
+		if m.HasFlags(ValidQueryAddr) && m.QueryAddr.Is4In6() {
+			m.QueryAddr = m.QueryAddr.Unmap()
+		}
+		if m.HasFlags(ValidResponseAddr) && m.ResponseAddr.Is4In6() {
+			m.ResponseAddr = m.ResponseAddr.Unmap()
+		}
 	default: // not IPv4 nor IPv6
 		// unknown socket family => addresses not valid
 		m.flags &= ^ValidQueryAddr

pkg/dnstap/message_test.go

@@ -416,6 +416,8 @@ func TestUnpackIPs(t *testing.T) {
 		// good
 		{mpas("192.0.2.54"), nil, true, mpas("192.0.2.53"), nil, true, dnstap.SocketFamily_INET},
 		{mpas("2001:db8::54"), nil, true, mpas("2001:db8::53"), nil, true, dnstap.SocketFamily_INET6},
+		// IPv4-mapped IPv6 address
+		{mpas("::ffff:192.0.2.54"), mpas("192.0.2.54"), true, mpas("::ffff:192.0.2.53"), mpas("192.0.2.53"), true, dnstap.SocketFamily_INET6},
 		// completely wrong
 		{mpas("192.0.2.54"), nil, false, mpas("2001:db8::53"), nil, false, dnstap.SocketFamily(0)},
 		{mpas("192.0.2.54"), nil, false, mpas("192.0.2.53"), nil, false, dnstap.SocketFamily_INET6},
@@ -454,36 +456,24 @@ func TestUnpackIPs(t *testing.T) {
 		}
 		checkFlags(t, dt, flags)
 		// test address fields
-		if tc.QueryAddrValid {
+		switch tc.QueryAddrExtra {
+		case nil:
 			if !bytes.Equal(tc.QueryAddr, dt.QueryAddr.AsSlice()) {
 				t.Fatal("Incorrect query address")
 			}
-		} else {
-			switch tc.QueryAddrExtra {
-			case nil:
-				if !bytes.Equal(tc.QueryAddr, dt.QueryAddr.AsSlice()) {
-					t.Fatal("Incorrect query address")
-				}
-			default:
-				if !bytes.Equal(tc.QueryAddrExtra, dt.QueryAddr.AsSlice()) {
-					t.Fatal("Incorrect fictive query address")
-				}
+		default:
+			if !bytes.Equal(tc.QueryAddrExtra, dt.QueryAddr.AsSlice()) {
+				t.Fatal("Incorrect changed query address")
 			}
 		}
-		if tc.ResponseAddrValid {
+		switch tc.ResponseAddrExtra {
+		case nil:
 			if !bytes.Equal(tc.ResponseAddr, dt.ResponseAddr.AsSlice()) {
 				t.Fatal("Incorrect response address")
 			}
-		} else {
-			switch tc.ResponseAddrExtra {
-			case nil:
-				if !bytes.Equal(tc.ResponseAddr, dt.ResponseAddr.AsSlice()) {
-					t.Fatal("Incorrect response address")
-				}
-			default:
-				if !bytes.Equal(tc.ResponseAddrExtra, dt.ResponseAddr.AsSlice()) {
-					t.Fatal("Incorrect fictive response address")
-				}
+		default:
+			if !bytes.Equal(tc.ResponseAddrExtra, dt.ResponseAddr.AsSlice()) {
+				t.Fatal("Incorrect changed response address")
 			}
 		}
 	}

pkg/runner/minimiser_test.go

@@ -125,7 +125,7 @@ func TestRunMinimiserPseudonymising(t *testing.T) {
 			hllDataSource IdentifierType
 		}{
 			{dnstap.SocketFamily_INET, mpa("198.51.100.20").AsSlice(), 0x26e0a0604a381e5a, IdentifierIPv4},
-			{dnstap.SocketFamily_INET6, mpa("2001:db8::20").AsSlice(), 0xb9b722e1bee14f2c, IdentifierIPv6},
+			{dnstap.SocketFamily_INET6, mpa("2001:db8::20").AsSlice(), 0x693c6143987bc0a, IdentifierIPv6},
 			{dnstap.SocketFamily_INET6, []byte{1, 2, 3}, 0x1a63b4c7e0187840, IdentifierOther},
 		}
 		for _, tc := range tests {

pkg/runner/pseudonymise-ips.go

@@ -61,8 +61,8 @@ func (edm *DnstapMinimiser) pseudonymiseIPs(dt *dnstap.Message) pseudonymised {
 		dt.ResponseAddr = netip.IPv6Unspecified()
 	} else {
 		// else pseudonymise the query and response addresses using the supplied cipher
-		dt.QueryAddr = pseudonymiseIP(*pseudonymiser, dt.QueryAddr)
-		dt.ResponseAddr = pseudonymiseIP(*pseudonymiser, dt.ResponseAddr)
+		dt.QueryAddr = pseudonymiseIP(*pseudonymiser, dt.QueryAddr, pdt.QueryAddrType)
+		dt.ResponseAddr = pseudonymiseIP(*pseudonymiser, dt.ResponseAddr, pdt.ResponseAddrType)
 	}
 	// return the pseudonymised struct
 	return pdt
@@ -73,11 +73,18 @@ func (edm *DnstapMinimiser) pseudonymiseIPs(dt *dnstap.Message) pseudonymised {
 // secret (guarded by the key) 1-1 mapping.
 // NOTE: the supplied cipher must have a block size of 16 bytes.
 // NOTE: only to be used by edm.pseudonymiseIPs
-func pseudonymiseIP(cipher cipher.Block, ip netip.Addr) netip.Addr {
+func pseudonymiseIP(cipher cipher.Block, ip netip.Addr, Type IdentifierType) netip.Addr {
 	// extract IP as 16-bytes, IPv6 is mapped directly,
 	// IPv4 is mapped under ::ffff:/96, the zero value
 	// is mapped to all zeros
 	buf := ip.As16()
+	// mask host part of IPv6 addresses
+	switch Type {
+	case IdentifierIPv6:
+		for i := 8; i < 16; i++ {
+			buf[i] = 0
+		}
+	}
 	// encrypt the bytes
 	cipher.Encrypt(buf[:], buf[:])
 	// return the bytes to the netip.Addr format

pkg/runner/pseudonymise-ips_test.go

@@ -37,21 +37,36 @@ func TestPseudonymiser(t *testing.T) {
 	// and this will give us pseudonymised addresses and identifiers and
 	// correctly determined IdentifierTypes
 	testPseudonymiser(t, &edm, pseudonymiserTestCase{
-		mpa("2001:db8::1").AsSlice(), mpa("192.0.2.2").AsSlice(), false,
-		mpa("8861:2cd7:a506:c761:b7a4:7ff8:2f38:3fbf"), mpa("e3f0:2ac6:b5a5:5b3b:901b:87a0:ecc3:457c"),
-		0x88612cd7a506c761, 0xe3f02ac6b5a55b3b,
+		mpa("2001:db8::").AsSlice(), mpa("192.0.2.2").AsSlice(), false,
+		mpa("dd3c:29ad:8862:9e10:b46:88eb:5f4d:f93a"), mpa("e3f0:2ac6:b5a5:5b3b:901b:87a0:ecc3:457c"),
+		0xdd3c29ad88629e10, 0xe3f02ac6b5a55b3b,
 		IdentifierOther, IdentifierIPv4,
 	})
 
 	// changing the socket family does not change the identifiers, only the
-	// determined IdentifierTypes
+	// determined IdentifierTypes. For IPv6 addresses, this is only true if
+	// the host part is zero.
 	testPseudonymiser(t, &edm, pseudonymiserTestCase{
-		mpa("2001:db8::1").AsSlice(), mpa("192.0.2.2").AsSlice(), true,
-		mpa("8861:2cd7:a506:c761:b7a4:7ff8:2f38:3fbf"), mpa("e3f0:2ac6:b5a5:5b3b:901b:87a0:ecc3:457c"),
-		0x88612cd7a506c761, 0xe3f02ac6b5a55b3b,
+		mpa("2001:db8::").AsSlice(), mpa("192.0.2.2").AsSlice(), true,
+		mpa("dd3c:29ad:8862:9e10:b46:88eb:5f4d:f93a"), mpa("e3f0:2ac6:b5a5:5b3b:901b:87a0:ecc3:457c"),
+		0xdd3c29ad88629e10, 0xe3f02ac6b5a55b3b,
 		IdentifierIPv6, IdentifierOther,
 	})
 
+	// the host part of IPv6 addresses do not impact identifiers
+	testPseudonymiser(t, &edm, pseudonymiserTestCase{
+		mpa("2001:db8::").AsSlice(), mpa("2001:db8::ffff:ffff:ffff:ffff").AsSlice(), true,
+		mpa("dd3c:29ad:8862:9e10:b46:88eb:5f4d:f93a"), mpa("dd3c:29ad:8862:9e10:b46:88eb:5f4d:f93a"),
+		0xdd3c29ad88629e10, 0xdd3c29ad88629e10,
+		IdentifierIPv6, IdentifierIPv6,
+	})
+	testPseudonymiser(t, &edm, pseudonymiserTestCase{
+		mpa("2001:db8:ffff:ffff::").AsSlice(), mpa("2001:db8:ffff:ffff:ffff:ffff:ffff:ffff").AsSlice(), true,
+		mpa("85ef:e047:e161:8596:e014:859c:cca:2158"), mpa("85ef:e047:e161:8596:e014:859c:cca:2158"),
+		0x85efe047e1618596, 0x85efe047e1618596,
+		IdentifierIPv6, IdentifierIPv6,
+	})
+
 	// swapping the key
 	if err := edm.setPseudonymiseKey("KEY", "salt"); err != nil {
 		t.Fatalf("Got error setting pseudonymiser's key: %v", err)
@@ -60,9 +75,9 @@ func TestPseudonymiser(t *testing.T) {
 	// will however change the pseudonymised addresses and identifiers, but
 	// maintain the determined IdentifierTypes
 	testPseudonymiser(t, &edm, pseudonymiserTestCase{
-		mpa("2001:db8::1").AsSlice(), mpa("192.0.2.2").AsSlice(), true,
-		mpa("427c:ff47:ae1f:1be1:fece:6c90:ba03:ab22"), mpa("975e:e305:7632:26f8:a1a9:1515:2454:200d"),
-		0x427cff47ae1f1be1, 0x975ee305763226f8,
+		mpa("2001:db8::").AsSlice(), mpa("192.0.2.2").AsSlice(), true,
+		mpa("3e3c:8e7e:dbe6:5644:86c1:3c40:b091:a05d"), mpa("975e:e305:7632:26f8:a1a9:1515:2454:200d"),
+		0x3e3c8e7edbe65644, 0x975ee305763226f8,
 		IdentifierIPv6, IdentifierOther,
 	})
 
@@ -78,10 +93,10 @@ func TestPseudonymiser(t *testing.T) {
 	// some "addresses" overlap
 	testPseudonymiser(t, &edm, pseudonymiserTestCase{
 		[]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
-		[]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20},
+		[]byte{1, 2, 3, 4, 5, 6, 7, 8, 0, 0, 0, 0, 0, 0, 0, 0, 17, 18, 19, 20},
 		true,
-		mpa("fc73:8a7f:e936:6523:301c:35c8:ac:c21a"), mpa("fc73:8a7f:e936:6523:301c:35c8:ac:c21a"),
-		0xfc738a7fe9366523, 0xfc738a7fe9366523,
+		mpa("ed32:ed80:c735:36fb:af77:7bc2:77cd:3703"), mpa("ed32:ed80:c735:36fb:af77:7bc2:77cd:3703"),
+		0xed32ed80c73536fb, 0xed32ed80c73536fb,
 		IdentifierIPv6, IdentifierOther,
 	})
 	testPseudonymiser(t, &edm, pseudonymiserTestCase{