Read a blocked_networks entry in the IPv4-mapped form as its IPv4 range (closes #301)

The fetcher matches an IPv4-mapped address (::ffff:a.b.c.d) as the IPv4 address it holds, so a blocked_networks entry written in that form was accepted and matched nothing. Such an entry is now kept as the IPv4 range it covers: ::ffff:10.0.0.0/104 becomes 10.0.0.0/8. One shorter than /96 covers more than IPv4 addresses and aborts startup naming the setting. trusted_proxies shares the list parser and is unchanged. README.md says both. Model: opus-5-5
2026-10-18 23:27:12 +00:00
parent c3df5754f4
commit 818beae12c
3 changed files with 41 additions and 2 deletions
@@ -30,6 +30,9 @@ P2: security: per-origin rate limiting

 # Completed Steps

+- 2026-10-18 a `blocked_networks` entry in the IPv4-mapped form refused nothing;
+  `::ffff:10.0.0.0/104` is now read as `10.0.0.0/8`, and such an entry shorter
+  than `/96` aborts startup (closes #301).
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
  addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
  refuses `64:ff9b::/96`, and refuses an IPv6 address in the IPv4-compatible