sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 20 Packages Projects Releases Wiki Activity

Match blocked_networks against both forms of an address holding IPv4
check / check (push) Canceled after 0s
Details

Browse Source 
isBlockedIP refuses an address when a blocked_networks entry contains
it as an IPv6 address or contains the IPv4 address it holds, for the
mapped (::ffff:0:0/96) and the IPv4-compatible (::/96) form alike, so
an IPv6 entry refuses everything it refused on next. ipv6AndIPv4Forms
gives the two forms. Go keeps a plain IPv4 address in the mapped form,
so an entry covering ::ffff:0:0/96, such as ::/0, now refuses every
IPv4 address too.

Model: opus-5-5
This commit is contained in:
sneak
2026-10-16 04:14:20 +00:00
parent 4900837068
commit 8fceeca202
2 changed files with 34 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+11 -7
View File
@@ -32,13 +32,17 @@ P2: security: per-origin rate limiting
- 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
refuses `64:ff9b::/96`, and matches an IPv6 address in the IPv4-compatible
form (`::/96`) against `blocked_networks` by the IPv4 address it holds, as it
already matched the mapped form (`::ffff:a.b.c.d`) (closes #299). A source
host such as `[64:ff9b:1::a00:1]` was fetched, which on a network that runs
NAT64 on that range reaches the IPv4 address it holds, here `10.0.0.1`; and
with `203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was
refused but `[::203.0.113.5]` was fetched. Both now answer 403.
refuses `64:ff9b::/96`, and refuses an IPv6 address that holds an IPv4
address, in the IPv4-compatible form (`::/96`) or the mapped form
(`::ffff:a.b.c.d`), when `blocked_networks` contains either the address as
written or the IPv4 address it holds (closes #299). A source host such as
`[64:ff9b:1::a00:1]` was fetched, which on a network that runs NAT64 on that
range reaches the IPv4 address it holds, here `10.0.0.1`; with
`203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was refused but
`[::203.0.113.5]` was fetched; and with `::ffff:0:0/96` listed,
`[::ffff:203.0.113.5]` was fetched. All now answer 403. Go keeps a plain IPv4
address in the mapped form, so an IPv6 entry covering `::ffff:0:0/96`, such as
`::/0`, now refuses every IPv4 address too.
- 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
addresses judges an IPv6 address in the IPv4-compatible form (`::/96`), such
as `::127.0.0.1` or `::10.0.0.1`, by the IPv4 address in its last four bytes