Apply /48 mask for ipv6 netblock anonymization (#154)

m-lab · Jan 17, 2023 · 479b589 · 479b589
1 parent fd83308
commit 479b589
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/anonymize/ip.go b/anonymize/ip.go
@@ -166,8 +166,8 @@ func (netblockAnonymizer) IP(ip net.IP) {
 		return
 	}
 	if ip.To16() != nil {
-		// Anonymize IPv6 addresses to the containing /64
-		for i := 8; i < 16; i++ {
+		// Truncate IPv6 addresses to the containing /48
+		for i := 6; i < 16; i++ {
 			ip[i] = 0
 		}
 		return
@@ -196,7 +196,7 @@ func (n netblockAnonymizer) Contains(dst, ip net.IP) bool {
 	if dst.To16() != nil {
 		nn := &net.IPNet{
 			IP:   dst,
-			Mask: net.CIDRMask(64, 128),
+			Mask: net.CIDRMask(48, 128),
 		}
 		return nn.Contains(ip)
 	}

diff --git a/anonymize/ip_test.go b/anonymize/ip_test.go
@@ -58,8 +58,8 @@ func TestNetblockAnon(t *testing.T) {
 		{"1:0::2", "1::2"},         // IgnoredIPs should be ignored.
 		{"10.1.2.3", "10.1.2.0"},
 		{"255.255.255.255", "255.255.255.0"},
-		{"0:1:2:3:4:5:6:7", "0:1:2:3::"},
-		{"aaaa:aaab:aaac:aaad:aaae:aaaf:aaa1:aaa1", "aaaa:aaab:aaac:aaad::"},
+		{"0:1:2:3:4:5:6:7", "0:1:2::"},
+		{"aaaa:aaab:aaac:aaad:aaae:aaaf:aaa1:aaa1", "aaaa:aaab:aaac::"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.ip, func(t *testing.T) {