From fd3a832f7be6c1085e51792d6631424b7911a63a Mon Sep 17 00:00:00 2001
From: NotAShelf <raf@notashelf.dev>
Date: Tue, 10 Mar 2026 09:39:15 +0300
Subject: [PATCH] internal/normalize: simplify IP parser; cleanup

Signed-off-by: NotAShelf <raf@notashelf.dev>
Change-Id: I7a860779a4fe49b8034d66f2abd910fc6a6a6964
---
 internal/normalize/referrer.go      | 43 ++++++++++-------------------
 internal/normalize/referrer_test.go | 30 ++++++++++++++++++++
 2 files changed, 45 insertions(+), 28 deletions(-)

diff --git a/internal/normalize/referrer.go b/internal/normalize/referrer.go
index df0189d..1b43423 100644
--- a/internal/normalize/referrer.go
+++ b/internal/normalize/referrer.go
@@ -1,6 +1,7 @@
 package normalize
 
 import (
+	"net"
 	"net/url"
 	"strings"
 
@@ -21,34 +22,20 @@ func isInternalHost(hostname string) bool {
 		return true
 	}
 
-	// Private IPv4 ranges (RFC1918)
-	if strings.HasPrefix(hostname, "10.") ||
-		strings.HasPrefix(hostname, "192.168.") ||
-		strings.HasPrefix(hostname, "172.16.") ||
-		strings.HasPrefix(hostname, "172.17.") ||
-		strings.HasPrefix(hostname, "172.18.") ||
-		strings.HasPrefix(hostname, "172.19.") ||
-		strings.HasPrefix(hostname, "172.20.") ||
-		strings.HasPrefix(hostname, "172.21.") ||
-		strings.HasPrefix(hostname, "172.22.") ||
-		strings.HasPrefix(hostname, "172.23.") ||
-		strings.HasPrefix(hostname, "172.24.") ||
-		strings.HasPrefix(hostname, "172.25.") ||
-		strings.HasPrefix(hostname, "172.26.") ||
-		strings.HasPrefix(hostname, "172.27.") ||
-		strings.HasPrefix(hostname, "172.28.") ||
-		strings.HasPrefix(hostname, "172.29.") ||
-		strings.HasPrefix(hostname, "172.30.") ||
-		strings.HasPrefix(hostname, "172.31.") {
-		return true
-	}
-
-	// IPv6 loopback and local
-	if strings.HasPrefix(hostname, "::1") ||
-		strings.HasPrefix(hostname, "fe80::") ||
-		strings.HasPrefix(hostname, "fc00::") ||
-		strings.HasPrefix(hostname, "fd00::") {
-		return true
+	// Check if hostname is an IP address
+	if ip := net.ParseIP(hostname); ip != nil {
+		// Private IPv4 ranges (RFC1918)
+		if ip.IsPrivate() {
+			return true
+		}
+		// Additional localhost checks for IP formats
+		if ip.IsLoopback() {
+			return true
+		}
+		// Link-local addresses
+		if ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
+			return true
+		}
 	}
 
 	return false
diff --git a/internal/normalize/referrer_test.go b/internal/normalize/referrer_test.go
index 04a8d0a..0fa2e21 100644
--- a/internal/normalize/referrer_test.go
+++ b/internal/normalize/referrer_test.go
@@ -108,6 +108,36 @@ func TestExtractReferrerDomain(t *testing.T) {
 			siteDomain: "example.com",
 			want:       "internal",
 		},
+		{
+			name:       "private IP 172.16.x (RFC1918)",
+			referrer:   "http://172.16.0.1/page",
+			siteDomain: "example.com",
+			want:       "internal",
+		},
+		{
+			name:       "private IP 172.31.x (RFC1918 upper bound)",
+			referrer:   "http://172.31.255.1/page",
+			siteDomain: "example.com",
+			want:       "internal",
+		},
+		{
+			name:       "private IP 172.20.x (middle of range)",
+			referrer:   "http://172.20.50.100/page",
+			siteDomain: "example.com",
+			want:       "internal",
+		},
+		{
+			name:       "public IP 172.15.x (just outside private range)",
+			referrer:   "http://172.15.0.1/page",
+			siteDomain: "example.com",
+			want:       "other", // not internal, but invalid TLD
+		},
+		{
+			name:       "public IP 172.32.x (just outside private range)",
+			referrer:   "http://172.32.0.1/page",
+			siteDomain: "example.com",
+			want:       "other", // not internal, but invalid TLD
+		},
 	}
 
 	for _, tt := range tests {