Read a blocked_networks entry in the IPv4-mapped form as its IPv4 range (closes #301)

The fetcher matches an IPv4-mapped address (::ffff:a.b.c.d) as the IPv4 address it holds, so a blocked_networks entry written in that form was accepted and matched nothing. Such an entry is now kept as the IPv4 range it covers: ::ffff:10.0.0.0/104 becomes 10.0.0.0/8, and ::ffff:0:0/96 becomes 0.0.0.0/0. One shorter than /96 covers more than IPv4 addresses and aborts startup naming the setting. README.md says both. trusted_proxies shares the list parser, has the same fault and is unchanged here (issue 303). Model: opus-5-5
2026-10-19 03:00:43 +02:00
parent faad959bea
commit 0ab15324f7
4 changed files with 94 additions and 2 deletions
@@ -30,6 +30,9 @@ P2: security: per-origin rate limiting

 # Completed Steps

+- 2026-10-18 a `blocked_networks` entry in the IPv4-mapped form refused nothing;
+  `::ffff:10.0.0.0/104` is now read as `10.0.0.0/8`, and such an entry shorter
+  than `/96` aborts startup (closes #301).
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
  addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
  refuses `64:ff9b::/96`, and refuses an IPv6 address in the IPv4-compatible