Adding Allowed IPs to API token generating Source IP Error

[Th3Bard]

I am trying to restrict an API toke to a single /32, and when I enter the IP, I get this error when sending any API calls:

"detail":"Source IP ::ffff:10.x.x.x is not permitted to authenticate using this token."

It appeasts the IPv4 IP address is being appended to an IPv6 address? This happens on any type of call. See a basic example below.

api_test.py:

`import requests

url = "https://url/api/dcim/manufacturers/"

payload = {}
headers = {
'Authorization': 'Token {{my_token}}',
'Cookie': 'csrftoken={{cookie_info}}'
}

response = requests.request("GET", url, headers=headers, data=payload)

print(response.text)`

I saw someone else had a similar issue here: #10601

Anyone else have this problem? I am just running the python script above from VS Code.

[candlerb]

It appeasts the IPv4 IP address is being appended to an IPv6 address?

Not exactly. What you see is an "IPv4-mapped IPv6" address, where a 128-bit IPv6 address field can hold a real IPv4 address. It's commonly seen on dual-protocol sockets.

As a workaround, try adding this form of address into the list of allowed IPs for the token. It may allow you to enter e.g. ::ffff:10.1.2.3/128 directly. If it doesn't, then you may need to translate the 32 bits into hex, in two groups of 16 bits: e.g. ::ffff:a01:203/128

It would certainly be more friendly if such an IPv4-mapped address would match 10.1.2.3/32 directly though.

[Th3Bard]

Dope, thank you @candlerb . I added the mapped IPv6 address to the "allowed IPs" field and it worked. Really appreciate the clarification!

Would be very useful to have that added/clarified on the API Token page :)