Chris LuandGitHub 00c5572e8c volume: decode IPv6 transition addresses in the remote-endpoint guard (#10683) ...

* volume: decode IPv6 transition addresses in the remote-endpoint guard

checkBlockedIP normalized only ::ffff: mapped IPv4, so NAT64 (64:ff9b::/96),
6to4 (2002::/16), Teredo (2001:0000::/32), and IPv4-compatible (::/96) addresses
that embed an internal IPv4 (loopback, 169.254.169.254, RFC 1918) passed the
endpoint guard even though the plain IPv4 forms are refused. Extract the
embedded IPv4 from those forms and re-check it against the deny list, which
covers both the up-front validation and the dial-time guard. Mirrored in the
Rust volume server.

* volume: require the full NAT64 well-known prefix before decoding

Only 64:ff9b::/96 carries the embedded IPv4 in the low 32 bits, so also require
bytes 4-11 to be zero before treating an address as NAT64; other 64:ff9b:
prefixes place the IPv4 elsewhere and are left untouched. Add public-target
coverage for 6to4, Teredo, and IPv4-compatible so every decoder is exercised on
both a blocked and an allowed destination. Mirrored in the Rust volume server.

2026-08-09 23:22:13 -07:00

..

endpoint_guard.rs

volume: decode IPv6 transition addresses in the remote-endpoint guard (#10683)

2026-08-09 23:22:13 -07:00

mod.rs

volume: validate remote S3 endpoints in FetchAndWriteNeedle (Rust) (#10001)

2026-06-17 00:56:13 -07:00

s3_tier.rs

fix(volume): make tier-down crash-safe and serve from local (Rust) (#10113)

2026-06-25 12:29:21 -07:00

s3.rs

Rust volume server implementation with CI (#8539)

2026-03-26 17:24:35 -07:00