fix(runner): reject mismatched IPv4 session addresses

pkg/runner/partial_dnstap_test.go

@@ -0,0 +1,34 @@
+package runner
+
+import (
+	"io"
+	"log/slog"
+	"net/netip"
+	"testing"
+	"time"
+
+	dnstap "github.com/dnstap/golang-dnstap"
+	"github.com/miekg/dns"
+)
+
+func TestNewSessionIgnoresMismatchedIPv4FamilyAddress(t *testing.T) {
+	edm := &dnstapMinimiser{
+		log: slog.New(slog.NewTextHandler(io.Discard, nil)),
+	}
+	msg := new(dns.Msg)
+	msg.SetQuestion("example.com.", dns.TypeA)
+
+	socketFamily := dnstap.SocketFamily_INET
+	socketProtocol := dnstap.SocketProtocol_UDP
+	sd := edm.newSession(&dnstap.Dnstap{
+		Message: &dnstap.Message{
+			SocketFamily:   &socketFamily,
+			SocketProtocol: &socketProtocol,
+			QueryAddress:   netip.MustParseAddr("2001:db8::1").AsSlice(),
+		},
+	}, msg, false, defaultLabelLimit, time.Unix(0, 0).UTC())
+
+	if sd.SourceIPv4 != nil {
+		t.Fatalf("SourceIPv4 should stay nil for IPv6 bytes with INET socket family, have: %d", *sd.SourceIPv4)
+	}
+}

pkg/runner/runner.go

@@ -2566,6 +2566,10 @@ func ipBytesToInt(ip4Bytes []byte) (uint32, error) {
 	if !ok {
 		return 0, fmt.Errorf("ipBytesToInt: unable to parse bytes")
 	}
+	ip = ip.Unmap()
+	if !ip.Is4() {
+		return 0, fmt.Errorf("ipBytesToInt: address is not IPv4: %s", ip)
+	}
 
 	// Make sure we are dealing with 4 byte IPv4 address data (and deal with IPv4-in-IPv6 addresses)
 	ip4 := ip.As4()