Module ip_allowlist 

The address allowlist behind masterKeyIps and maintenanceKeyIps.

Upstream builds a net.BlockList from the configured entries and asks it about the request’s peer address (middlewares.js:50-64). The default for both options is the two literal addresses 127.0.0.1 and ::1 (Options/Definitions.js:385-388, :396-399), which is why an unimplemented option is an open control rather than a missing feature: a stock parse-server honours the master key only from the machine it runs on.

Two mechanisms, and measuring only one of them gets both wrong

Upstream’s check is checkIp, not BlockList.check, and the wrapper is not a thin one. It implements five allow-all literals that never reach the block list at all: getBlockList compares each configured entry against '::/0', '::', '::0', '0.0.0.0/0' and '0.0.0.0' by string, sets allowAllIpv6 or allowAllIpv4, and returns without adding anything (middlewares.js:27-48). checkIp then consults those flags against the peer’s own address family, where isIPv4 is false for an IPv4-mapped IPv6 address (middlewares.js:50-64).

Everything else does go to the block list, which works in one 128-bit space where an IPv4 address is its IPv4-mapped form. So there are two rules, not one:

• The five literals are family-scoped. ::/0 admits every IPv6 peer, mapped ones included, and no IPv4 peer. 0.0.0.0/0 admits every IPv4 peer and no IPv6 peer, mapped ones included. Bare ::, ::0 and 0.0.0.0 mean the same as their /0 spellings rather than naming one address.
• Every other entry is matched in IPv6 space, so an IPv4 rule a.b.c.d/n becomes ::ffff:a.b.c.d/(96+n), 127.0.0.1 matches a peer of ::ffff:127.0.0.1, and ::/64 matches an IPv4 peer because the mapped form’s top 64 bits are zero.

Measured through checkIp on the Node that builds the pinned parse-server, and the table is asserted below rather than described:

rule	127.0.0.1	::1	::ffff:127.0.0.1
::/0, ::, ::0	no	yes	yes
0.0.0.0/0, 0.0.0.0	yes	no	no
127.0.0.1	yes	no	yes
::1	no	yes	no
::/64	yes	yes	yes

An earlier version of this module drove BlockList directly and produced the wrong answer in both directions, admitting an IPv4 peer under ::/0 and a mapped peer under 0.0.0.0/0, because neither special case exists at that layer. The test below therefore measures the same layer the server uses. Nothing here is derived from the option’s help text, which says the two families “are not compared against each other” and is true only of the block-list half.

Structs

InvalidIpEntry

Why an entry could not be read.

IpAllowlist

The addresses a privileged key may be presented from.