sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 7 Packages Projects Releases Wiki Activity

Match the mapped form against blocked_networks only as IPv4
check / check (push) Canceled after 0s
Details

Browse Source 
isBlockedIP again matches an IPv4-mapped address (::ffff:0:0/96) only
as the IPv4 address it holds, as on next: Go keeps a plain IPv4 address
in that form, so matching it as written let an IPv6 entry such as ::/0
refuse every IPv4 address. An IPv4-compatible address (::/96) is still
matched both as written and as the IPv4 address it holds.
ipv6AndIPv4Forms is gone. README.md says the mapped form is matched as
IPv4 only.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-16 04:25:45 +00:00
parent a5088a69a1
commit 19113ffa2f
3 changed files with 27 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+8 -9
View File
@@ -32,17 +32,16 @@ P2: security: per-origin rate limiting
- 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
refuses `64:ff9b::/96`, and refuses an IPv6 address that holds an IPv4
address, in the IPv4-compatible form (`::/96`) or the mapped form
(`::ffff:a.b.c.d`), when `blocked_networks` contains either the address as
written or the IPv4 address it holds (closes #299). A source host such as
refuses `64:ff9b::/96`, and refuses an IPv6 address in the IPv4-compatible
form (`::/96`) when `blocked_networks` contains either the address as written
or the IPv4 address it holds (closes #299). A source host such as
`[64:ff9b:1::a00:1]` was fetched, which on a network that runs NAT64 on that
range reaches the IPv4 address it holds, here `10.0.0.1`; with
range reaches the IPv4 address it holds, here `10.0.0.1`; and with
`203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was refused but
`[::203.0.113.5]` was fetched; and with `::ffff:0:0/96` listed,
`[::ffff:203.0.113.5]` was fetched. All now answer 403. Go keeps a plain IPv4
address in the mapped form, so an IPv6 entry covering `::ffff:0:0/96`, such as
`::/0`, now refuses every IPv4 address too.
`[::203.0.113.5]` was fetched. Both now answer 403. The mapped form
(`::ffff:a.b.c.d`) is still matched only as the IPv4 address it holds: Go
keeps a plain IPv4 address in that form, and an IPv6 entry such as `::/0` must
not refuse every IPv4 address.
- 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
addresses judges an IPv6 address in the IPv4-compatible form (`::/96`), such
as `::127.0.0.1` or `::10.0.0.1`, by the IPv4 address in its last four bytes