mosaicstack/stack
25
0 Fork 1
Code Issues 389 Pull Requests 13 Packages Projects Releases 15 Wiki Activity

Refuse mapped IPv6 private addresses before web.fetch dispatch #1834

Closed
mos wants to merge 0 commits from work/q284-web-fetch-ipv6-ssrf into refactor
pull from: work/q284-web-fetch-ipv6-ssrf
merge into: mosaicstack:refactor
Conversation 2 Commits - Files Changed -
mos commented 2026-10-29 05:22:37 +00:00
First-time contributor
Copy link
Copy source

The address gate accepted hexadecimal IPv4-mapped IPv6 loopback/private values and pinned them into the outbound connection. Parse IPv6 into canonical words and apply the unchanged IPv4 refusal policy to every mapped spelling. Literal, DNS-answer and redirect paths use the same gate. Fixes the source bypass recorded in #710.

Author focused baseline7/7, RED6pass/4fail, final10/10. Parent reviewed the source/test diff and matched exact pins. Full package/script CI and independent cross-family merge review remain required. No live/internal endpoint or runtime security proof is claimed.

Fresh parent focused check: 10/10, zero failures or skips. Local commit: 4cf888c04c on work/q284-web-fetch-ipv6-ssrf, base 09a847edaa25b609bac7728ff83f224708a29399. Fresh Claude Opus 5.5 effort high review running; no verdict yet. Mos publishes; #660 admitted CI remains required before merge.

Review disclosure: the canonical classifier refuses the well-known NAT64 prefix exactly at 64:ff9b::/96. The former textual 64:ff9b:: prefix also refused a subset of addresses outside /96 (for example 64:ff9b:0:0:1:0:a00:1); those now classify as public. This boundary change is explicit and unit-tested. Zone-suffixed address inputs now fail closed. Other translator/tunnel or special-use IPv6 policy remains a separate LOW follow-up; no deployment translator configuration was inspected.

Vikunja #710. Author: Sage seat (Codex, Q284). Pushed and opened by Mos (mos-2248) because seats hold no Gitea account before #436b (Q190). Base refactor 09a847ed. Independent Claude Opus 5.5 high review r1 approved 4cf888c0 (source), report SHA256 82d08094...cfd. Head a19b936a adds boundary tests and log lines only, web.mjs unchanged. Merge waits for the #660 gate runner (Q264).

The address gate accepted hexadecimal IPv4-mapped IPv6 loopback/private values and pinned them into the outbound connection. Parse IPv6 into canonical words and apply the unchanged IPv4 refusal policy to every mapped spelling. Literal, DNS-answer and redirect paths use the same gate. Fixes the source bypass recorded in #710. Author focused baseline7/7, RED6pass/4fail, final10/10. Parent reviewed the source/test diff and matched exact pins. Full package/script CI and independent cross-family merge review remain required. No live/internal endpoint or runtime security proof is claimed. Fresh parent focused check: 10/10, zero failures or skips. Local commit: 4cf888c04cda8354b894f277d76f65017dc870b6 on `work/q284-web-fetch-ipv6-ssrf`, base `09a847edaa25b609bac7728ff83f224708a29399`. Fresh Claude Opus 5.5 effort high review running; no verdict yet. Mos publishes; #660 admitted CI remains required before merge. Review disclosure: the canonical classifier refuses the well-known NAT64 prefix exactly at 64:ff9b::/96. The former textual `64:ff9b::` prefix also refused a subset of addresses outside /96 (for example 64:ff9b:0:0:1:0:a00:1); those now classify as public. This boundary change is explicit and unit-tested. Zone-suffixed address inputs now fail closed. Other translator/tunnel or special-use IPv6 policy remains a separate LOW follow-up; no deployment translator configuration was inspected. Vikunja #710. Author: Sage seat (Codex, Q284). Pushed and opened by Mos (mos-2248) because seats hold no Gitea account before #436b (Q190). Base refactor 09a847ed. Independent Claude Opus 5.5 high review r1 approved 4cf888c0 (source), report SHA256 82d08094...cfd. Head a19b936a adds boundary tests and log lines only, web.mjs unchanged. Merge waits for the #660 gate runner (Q264).
mos added 1 commit 2026-10-29 05:22:37 +00:00
fix(web): refuse hexadecimal mapped IPv6 private targets (#710) 4cf888c04c
mos added 1 commit 2026-10-29 05:25:22 +00:00
test(web): document canonical NAT64 policy boundary (#710) a19b936a8c
mos commented 2026-10-29 05:25:29 +00:00
Author
First-time contributor
Copy link
Copy source

Delta review (Mos, Claude Opus 5.5) of 4cf888c0..a19b936a: 3 files, +15/-0. packages/discord/src/web.mjs is unchanged. The new test pins the 64:ff9b::/96 boundary. 64:ff9b:0:0:1:0:a00:1 treated as public is correct because it is outside both 64:ff9b::/96 and the RFC 8215 local-use prefix 64:ff9b:1::/48. The local-use /48 and other transition ranges are tracked as #717 (LOW). No blocking findings. Source review r1 (Claude) approved 4cf888c0. Merge still waits for the #660 gate.

Delta review (Mos, Claude Opus 5.5) of 4cf888c0..a19b936a: 3 files, +15/-0. packages/discord/src/web.mjs is unchanged. The new test pins the 64:ff9b::/96 boundary. 64:ff9b:0:0:1:0:a00:1 treated as public is correct because it is outside both 64:ff9b::/96 and the RFC 8215 local-use prefix 64:ff9b:1::/48. The local-use /48 and other transition ranges are tracked as #717 (LOW). No blocking findings. Source review r1 (Claude) approved 4cf888c0. Merge still waits for the #660 gate.
jason.woltje commented 2026-11-02 19:57:07 +00:00
Owner
Copy link
Copy source

Landed on refactor by the Mosaic Stack lead: merge f7d16e9a8 (this PR's head a19b936a8). refactor fast-forwarded 09a847eda..c1e9841d3. Gate: all package suites plus every scripts/test-*.sh green on c1e9841d3, GATE_PASSED 2026-11-02T19:55:06Z. This repo has manual-merge marking and autodetect turned off, so Gitea cannot show the PR as merged; closing it with this record. Vikunja #710 closed. Live state: dragon-lin still runs its pinned copy until a re-pin.

Landed on refactor by the Mosaic Stack lead: merge f7d16e9a8 (this PR's head a19b936a8). refactor fast-forwarded 09a847eda..c1e9841d3. Gate: all package suites plus every scripts/test-*.sh green on c1e9841d3, GATE_PASSED 2026-11-02T19:55:06Z. This repo has manual-merge marking and autodetect turned off, so Gitea cannot show the PR as merged; closing it with this record. Vikunja #710 closed. Live state: dragon-lin still runs its pinned copy until a re-pin.
jason.woltje closed this pull request 2026-11-02 19:57:08 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-dogfood-01 (Mosaic fleet seat code-dogfood-01) code-infra-01 (Mosaic fleet seat code-infra-01) darkwing (Mosaic fleet seat darkwing) dewey (Mosaic fleet seat dewey) fargo filbert (Mosaic fleet seat filbert) fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) marcie merge-gate mosaic-stack-coder-bot (mosaic-stack coder bot) mosaic-stack-cto-bot (mosaic-stack cto bot) mosaic-stack-pm-bot (mosaic-stack pm bot) ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) orch-01 (Mosaic fleet seat orch-01) pepper resume rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) rocko (Mosaic fleet seat rocko) sanity scooby (Scooby) scrappy shaggy tiny topher (Mosaic fleet seat topher) velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1834