Re: [whatwg/fetch] Block access to ::, ::ffff:0:0, and 0.0.0.0 (PR #1763) from Richard Gibson on 2024-09-25 (public-webapps-github@w3.org from September 2024)

From: Richard Gibson <notifications@github.com>
Date: Wed, 25 Sep 2024 07:49:30 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/pull/1763/c2374317029@github.com>

> are we sure 6to4 and `::ffff:...` are the sole mechanisms or are there other ways to end up with IPv4 through IPv6?

Definitively not; the [Internet Protocol Version 6 Address Space registry](https://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xhtml) includes the deprecated **::/96** "IPv4-compatible IPv6 address" and the [IPv6 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml#iana-ipv6-special-registry-1) includes **64:ff9b::/96** as the well-known prefix for algorithmic translations and **64:ff9b:1::/48** as the prefix for local network domain translation. And [RFC 6052](https://www.rfc-editor.org/rfc/rfc6052.html) also allows networks to use their own self-chosen prefixes.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/1763#issuecomment-2374317029
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/1763/c2374317029@github.com>

Received on Wednesday, 25 September 2024 14:49:34 UTC