R2 S3 API 500 errors when using ipv6 ranges in Client IP Address Filtering

Developers Storage
1

I am using an R2 API token with Object Read&Write permissions for my bucket.
In the Client IP Address Filtering, if I include a /8, /16, /32 or /128 IP range in the Include list, then it works as expected. If I use a /48 or /64 IP range then any request that does not match one of the ranges to the left of it will get a 500 response.

E.g. with a list like “123.123.123.123/32 1234:1234::/32 4321:4321:4321::43/128”, I can successfully make requests from 123.123.123.123 or 4321:4321:4321::43. If a make a request from a non-matching IP, I get a 401 response as expected.

With a list like “123.123.123.123/32 1234:1234:1234::/48 4321:4321:4321::43/128”, I can successfully make requests from 123.123.123.123. But from any other IP, I get a 500 error. If I reorder the ipv4 address to be after the /48 range, then requests from that IP will also fail with a 500 error.

These IP addresses are just examples, the issue seems to happen with any /48 or /64 IP range that I try.

image
image1215×247 6.54 KB

Note I’m testing using Postman anrclone clients with a request to list objects in d a bucket.

Something doesn’t seem right here. Is there some reason I can’t use a /48 or /64 IPv6 IP range in the include list?

3

Here’s an example failing request and response

GET /backup?delimiter=%2F&encoding-type=url&list-type=2&max-keys=1000&prefix= HTTP/1.1
Host: myaccountid.r2.cloudflarestorage.com
User-Agent: rclone/v1.64.2
Authorization: XXXX
X-Amz-Content-Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
X-Amz-Date: 20231118T013144Z
Accept-Encoding: gzip

HTTP/1.1 500 Internal Server Error
Content-Length: 149
Cf-Ray: 827c74a62939aad2-SYD
Connection: keep-alive
Content-Type: application/xml
Date: Sat, 18 Nov 2023 01:31:45 GMT
Server: cloudflare
Vary: Accept-Encoding

<?xml version="1.0" encoding="UTF-8"?><Error><Code>InternalError</Code><Message>We encountered an internal error. Please try again.</Message></Error>