Matthew Jackson 4a241e04bc block 6to4/Teredo tunnels in the SSRF guard ...

The IPv6 SSRF guard already re-checked IPv4-mapped/-compatible addresses, but 6to4 (2002::/16) and Teredo (2001:0000::/32) also tunnel an embedded IPv4 and were passed through untouched, letting an attacker wrap 127.0.0.1 or a cloud metadata address in either encapsulation to bypass the block list. Decode both forms and re-check the embedded IPv4 through is_blocked_ip. Add a test covering 6to4/Teredo-wrapped loopback and metadata addresses, plus a 6to4-wrapped public IP that must still be allowed.

2026-09-05 12:37:48 -07:00

..

keydb_format.rs

release: 1.7.0

2026-09-02 12:27:48 -07:00

keydb.rs

persist keydb.cfg at mode 0600 (it holds key material)

2026-09-05 12:37:43 -07:00

lib.rs

release: 1.7.0

2026-09-02 12:27:48 -07:00

online.rs

block 6to4/Teredo tunnels in the SSRF guard

2026-09-05 12:37:48 -07:00

paths.rs

release: 1.7.0

2026-09-02 12:27:48 -07:00