Test blocked_networks on both forms of an IPv6 source host holding IPv4

Both image routes: [::203.0.113.5] must answer 403 when blocked_networks
lists ::/96, and [::ffff:203.0.113.5] when it lists ::ffff:0:0/96 or
203.0.113.0/24. The ::/96 and ::ffff:0:0/96 cases fail on this branch:
isBlockedIP matches such an address only by the IPv4 address it holds.

Model: opus-5-5

TODO.md

@@ -32,17 +32,13 @@ P2: security: per-origin rate limiting
 
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
   addresses refuses the local-use NAT64 range (`64:ff9b:1::/48`, RFC 8215) as it
-  refuses `64:ff9b::/96`, and refuses an IPv6 address that holds an IPv4
-  address, in the IPv4-compatible form (`::/96`) or the mapped form
-  (`::ffff:a.b.c.d`), when `blocked_networks` contains either the address as
-  written or the IPv4 address it holds (closes #299). A source host such as
-  `[64:ff9b:1::a00:1]` was fetched, which on a network that runs NAT64 on that
-  range reaches the IPv4 address it holds, here `10.0.0.1`; with
-  `203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was refused but
-  `[::203.0.113.5]` was fetched; and with `::ffff:0:0/96` listed,
-  `[::ffff:203.0.113.5]` was fetched. All now answer 403. Go keeps a plain IPv4
-  address in the mapped form, so an IPv6 entry covering `::ffff:0:0/96`, such as
-  `::/0`, now refuses every IPv4 address too.
+  refuses `64:ff9b::/96`, and matches an IPv6 address in the IPv4-compatible
+  form (`::/96`) against `blocked_networks` by the IPv4 address it holds, as it
+  already matched the mapped form (`::ffff:a.b.c.d`) (closes #299). A source
+  host such as `[64:ff9b:1::a00:1]` was fetched, which on a network that runs
+  NAT64 on that range reaches the IPv4 address it holds, here `10.0.0.1`; and
+  with `203.0.113.0/24` in `blocked_networks`, `[::ffff:203.0.113.5]` was
+  refused but `[::203.0.113.5]` was fetched. Both now answer 403.
 - 2026-10-16 P1 security bug: the check that keeps pixa from fetching internal
   addresses judges an IPv6 address in the IPv4-compatible form (`::/96`), such
   as `::127.0.0.1` or `::10.0.0.1`, by the IPv4 address in its last four bytes

internal/httpfetcher/httpfetcher.go

@@ -599,41 +599,26 @@ func isPrivateIP(ip net.IP) bool {
 }
 
 // isBlockedIP reports whether ip is refused, either by the built-in
-// internal-range check or by one of the operator-supplied prefixes. An IPv6
-// address that holds an IPv4 address is refused when a prefix contains the
-// address as written or the IPv4 address it holds.
+// internal-range check or by one of the operator-supplied prefixes.
 func isBlockedIP(ip net.IP, blocked []netip.Prefix) bool {
 	if isPrivateIP(ip) {
 		return true
 	}
 
-	asIPv6, asIPv4 := ipv6AndIPv4Forms(ip)
-	if !asIPv6.IsValid() {
+	// An IPv4-compatible or IPv4-mapped IPv6 address is matched as the IPv4
+	// address it holds
+	addr, ok := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip))
+	if !ok {
 		return true
 	}
 
+	addr = addr.Unmap()
+
 	return slices.ContainsFunc(blocked, func(prefix netip.Prefix) bool {
-		return prefix.Contains(asIPv6) || prefix.Contains(asIPv4)
+		return prefix.Contains(addr)
 	})
 }
 
-// ipv6AndIPv4Forms returns ip as an IPv6 address and, when it holds an IPv4
-// address in the IPv4-mapped form (::ffff:0:0/96) or the IPv4-compatible form
-// (::/96), that IPv4 address. Otherwise the IPv4 form is the zero netip.Addr,
-// which no prefix contains. Go keeps a plain IPv4 address in the mapped form,
-// so the IPv6 form of 203.0.113.5 is ::ffff:203.0.113.5. An ip that is not 4
-// or 16 bytes long gives two zero addresses.
-func ipv6AndIPv4Forms(ip net.IP) (netip.Addr, netip.Addr) {
-	asIPv6, ok := netip.AddrFromSlice(ip.To16())
-	if !ok {
-		return netip.Addr{}, netip.Addr{}
-	}
-
-	asIPv4, _ := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip).To4())
-
-	return asIPv6, asIPv4
-}
-
 // ipv4CompatibleToIPv4 returns the IPv4 address that an IPv4-compatible IPv6
 // address (in ::/96, such as ::127.0.0.1) holds in its last four bytes, and
 // any other address unchanged.

internal/server/source_url_internal_test.go

@@ -602,11 +602,6 @@ func TestImageRoutesRefuseIPv6SourceHostHoldingInternalIPv4Address(t *testing.T)
 func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
 	t.Parallel()
 
-	const (
-		ipv4CompatibleHost = "[::203.0.113.5]"
-		ipv4MappedHost     = "[::ffff:203.0.113.5]"
-	)
-
 	tests := []struct {
 		name            string
 		sourceHost      string
@@ -615,19 +610,19 @@ func TestImageRoutesCheckIPv4AddressInIPv6SourceHost(t *testing.T) {
 	}{
 		{"local-use NAT64 form of 10.0.0.1", "[64:ff9b:1::a00:1]", nil, true},
 		{"IPv4-compatible form of an address in blocked_networks",
-			ipv4CompatibleHost,
+			"[::203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
 		{"IPv4-compatible form with ::/96 in blocked_networks",
-			ipv4CompatibleHost,
+			"[::203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("::/96")}, true},
 		{"IPv4-mapped form of an address in blocked_networks",
-			ipv4MappedHost,
+			"[::ffff:203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("203.0.113.0/24")}, true},
 		{"IPv4-mapped form with ::ffff:0:0/96 in blocked_networks",
-			ipv4MappedHost,
+			"[::ffff:203.0.113.5]",
 			[]netip.Prefix{netip.MustParsePrefix("::ffff:0:0/96")}, true},
 		{"IPv4-compatible form of an address with blocked_networks empty",
-			ipv4CompatibleHost, nil, false},
+			"[::203.0.113.5]", nil, false},
 	}
 
 	for _, tt := range tests {