fix: bucket IPv6 enroll rate-limit clients by /64 #29

New issue

Closed

opened 2026-07-04 15:32:03 +00:00 by a73x · 1 comment

a73x commented

2026-07-04 15:32:03 +00:00

(Migrated from git.a73x.sh)

[claude 2026-07-04] Fixes 9e4d88ae (DEF-3). bucketKey(): v6 -> masked /64 prefix; v4 + v4-mapped -> unmapped address; garbage -> raw key. TDD: normalization table + end-behavior test (burst from ::1 exhausts ::2 in the same /64; different /64 fresh). E2E to follow in the consolidated sandbox pass (multiple fd00 source addrs in-VM against the real binary). make ci green.

Migrated from git-collab patche 1af09c708985c64389f5e15ee0daaa0d9d6488ff.

Original author: a73x dev@a73x.sh.

Fixes git-collab issue 9e4d88ae

Historical merged patch. The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed.

Original branches: fix/def3-ipv6-bucket → main.

[claude 2026-07-04] Fixes 9e4d88ae (DEF-3). bucketKey(): v6 -> masked /64 prefix; v4 + v4-mapped -> unmapped address; garbage -> raw key. TDD: normalization table + end-behavior test (burst from ::1 exhausts ::2 in the same /64; different /64 fresh). E2E to follow in the consolidated sandbox pass (multiple fd00 source addrs in-VM against the real binary). make ci green. --- Migrated from git-collab patche `1af09c708985c64389f5e15ee0daaa0d9d6488ff`. Original author: a73x <dev@a73x.sh>. Fixes git-collab issue `9e4d88ae` **Historical merged patch.** The original head and merge commits were not recorded. Forgejo cannot display a pull request without a head commit, so this record is preserved as a closed issue. The original diff is unavailable; no commit was guessed. Original branches: `fix/def3-ipv6-bucket` → `main`.

a73x commented

2026-07-04 17:55:16 +00:00

(Migrated from git.a73x.sh)

Original review: comment (revision not recorded)

[claude 2026-07-04] Reviewer verdict: ready (verified Is4In6 ordering, zone handling, exact /64 boundary tests, single allow() call site). Minors applied: unreachable-branch + granularity comments. E2E: real HTTP v4 burst 5x403->429; in-VM real v6 sources — same /64 shares the bucket (429), different /64 fresh (403). Merging per session goal.

**Original review: comment** (revision not recorded) [claude 2026-07-04] Reviewer verdict: ready (verified Is4In6 ordering, zone handling, exact /64 boundary tests, single allow() call site). Minors applied: unreachable-branch + granularity comments. E2E: real HTTP v4 burst 5x403->429; in-VM real v6 sources — same /64 shares the bucket (429), different /64 fresh (403). Merging per session goal.