net: fail closed when BlockList peer address is unavailable - #66640

# 06c4567ffde9bdbc12e2b1a676900dba69867e24 ok 1 assisted-by-is-trailer: Assisted-by is a trailer ok 2 co-authored-by-is-trailer: no Co-authored-by metadata ok 3 fixes-url: skipping fixes-url # SKIP ok 4 line-after-title: blank line after title not ok 5 line-length: Line should be <= 72 columns. --- { found: 73, compare: '<=', wanted: 72, at: { line: 9, column: 72, body: [ '', 'When a net.Server is configured with a `blockList`, the peer address is', 'looked up with getpeername() and checked before the connection is', 'accepted. If the peer address cannot be obtained (for example, the', 'connection was reset before getpeername(), causing', 'uv_tcp_getpeername() to return ENOTCONN), the access-control check was', 'silently skipped and the connection proceeded, allowing a blocked peer to', "reach the application's 'connection' handler (fail open).", '', 'Fail closed: when a BlockList is configured but the peer address cannot be', 'determined, close the connection instead of bypassing the check. A', 'connection whose peer address cannot be obtained cannot be proven to be', 'allowed, so it must be refused.', '', 'Ref: https://github.com/nodejs/node/issues/66422', 'Ref: https://github.com/libuv/libuv/pull/5337', '', 'Signed-off-by: Matteo Collina <hello@matteocollina.com>', 'Assisted-by: pi' ] } } ... not ok 6 line-length: Line should be <= 72 columns. --- { found: 74, compare: '<=', wanted: 72, at: { line: 12, column: 72, body: [ '', 'When a net.Server is configured with a `blockList`, the peer address is', 'looked up with getpeername() and checked before the connection is', 'accepted. If the peer address cannot be obtained (for example, the', 'connection was reset before getpeername(), causing', 'uv_tcp_getpeername() to return ENOTCONN), the access-control check was', 'silently skipped and the connection proceeded, allowing a blocked peer to', "reach the application's 'connection' handler (fail open).", '', 'Fail closed: when a BlockList is configured but the peer address cannot be', 'determined, close the connection instead of bypassing the check. A', 'connection whose peer address cannot be obtained cannot be proven to be', 'allowed, so it must be refused.', '', 'Ref: https://github.com/nodejs/node/issues/66422', 'Ref: https://github.com/libuv/libuv/pull/5337', '', 'Signed-off-by: Matteo Collina <hello@matteocollina.com>', 'Assisted-by: pi' ] } } ... ok 7 signed-off-by: has valid Signed-off-by ok 8 subsystem: valid subsystems [net] ok 9 title-format: Title is formatted correctly. 0..9 # tests 9 # pass 6 # fail 2 # Please review the commit message guidelines: # https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#commit-message-guidelines npm warn deprecated tap@16.3.10: Versions of tap before v18 are no longer maintained. Please upgrade. npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported npm warn deprecated @humanwhocodes/config-array@0.13.0: Use @eslint/config-array instead npm warn deprecated @humanwhocodes/object-schema@2.0.3: Use @eslint/object-schema instead npm warn deprecated libtap@1.4.1: This library is no longer used by node-tap, and is unmaintained. npm warn deprecated eslint@8.57.1: This version is no longer support