sneak/pixa
1
0
Fork 0
Code Issues 13 Pull Requests 5 Actions 43 Packages Projects Releases Wiki Activity

Refuse an IPv6 address that holds an internal IPv4 address (closes #297) #298

Merged
clawbot merged 2 commits from issue-297-embedded-ipv4-private-check into next 2026-10-16 05:31:56 +02:00
Conversation 1 Commits 2 Files Changed 4
+96
2 Commits
Author SHA1 Message Date
sneak 1631f92e2f Refuse an IPv6 address that holds an internal IPv4 address (closes #297)
check / check (push) Waiting to run
Details 
isPrivateIP read an IPv6 address as IPv4 only in the mapped form
(::ffff:a.b.c.d), so an IPv4-compatible address such as ::127.0.0.1 or
::10.0.0.1 was judged as a public IPv6 address and fetched. An address
in ::/96 is now judged by the IPv4 address in its last four bytes. The
NAT64 range 64:ff9b::/96 is already one of the built-in blocked ranges
and is left as it is.

Model: opus-5-5
 2026-10-16 03:11:40 +00:00
sneak e8ffd4e47f Test that an IPv6 address holding an internal IPv4 address is refused
check / check (push) Canceled after 0s
Details 
The check that keeps pixa from fetching internal addresses reads an
IPv6 address as IPv4 only in the mapped form (::ffff:a.b.c.d). These
tests fail until it also judges the IPv4-compatible form (::/96), such
as ::127.0.0.1 or ::10.0.0.1, by the IPv4 address it holds. The NAT64
form, 64:ff9b::7f00:1, is already refused and is tested alongside.

Model: opus-5-5
 2026-10-16 03:10:51 +00:00