Refuse local-use NAT64 addresses, and IPv4-compatible ones in blocked_networks (closes #299)

64:ff9b:1::/48 joins the built-in blocked ranges next to 64:ff9b::/96. isBlockedIP now reads an address in ::/96 as the IPv4 address in its last four bytes before matching blocked_networks, as it already unmapped the ::ffff: form. The reading isPrivateIP gained for ::/96 moved into ipv4CompatibleToIPv4, which both call. Model: opus-5-5
2026-10-16 03:43:55 +00:00
parent 04d9a6bf37
commit 294474a2cd
2 changed files with 34 additions and 13 deletions
@@ -30,6 +30,15 @@ P2: security: per-origin rate limiting

 # Completed Steps

+- 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
+  addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
+  refuses `64:ff9b::/96`, and matches an IPv6 address in the IPv4-compatible
+  form (`::/96`) against `blocked_networks` by the IPv4 address it holds, as it
+  already matched the mapped form (`::ffff:a.b.c.d`) (closes #299). A source
+  host such as `[64:ff9b:1::a00:1]` was fetched, which on a network that runs
+  NAT64 on that range reaches the IPv4 address it holds, here `10.0.0.1`; and
+  with `203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was
+  refused but `[::203.0.113.5]` was fetched. Both now answer 403.
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
  addresses judges an IPv6 address in the IPv4-compatible form (`::/96`), such
  as `::127.0.0.1` or `::10.0.0.1`, by the IPv4 address in its last four bytes