Files
hermes-agent/tools
xielevi 2163a426c8 fix(url_safety): classify the IPv4-translated wrapper by its embedded IPv4
On the reporting macOS host with fake-IP TUN DNS, the resolver answers an IPv4
name with the plain address and its IPv4-translated form ::ffff:0:a.b.c.d
(RFC 2765). ipaddress reads it as unrelated IPv6 space (ipv4_mapped is None),
so a declared security.fake_ip_ranges block could not excuse it — every fetch
on such a host stayed blocked (pre-flight and connect-time) — and the
cloud-metadata floor missed its translated form, leaving it dialable when
allow_private_urls is on.

_embedded_ipv4() extracts the wrapped IPv4 for both wrapper forms; the three
classification sites classify by it.

Fixes #117100.
2026-09-20 15:28:59 -07:00
..