test(supervisor): IPv6 fail-closed cases and allowed_ips for NAT64 answers

allowed_ips entries now match a NAT64 address through the IPv4 address
it embeds, so 10.0.0.0/8 covers 64:ff9b::a00:5 the same way it covers
10.0.0.5. Loopback, link-local and metadata stay blocked first.

The mediated IPv6 test now also checks that these are denied: the real
upstream IPv6, an unallocated synthetic address, the right address on
the wrong port, an open without a binary identity, and the old mapping
after a policy reload. A second test covers an unreachable trusted
resolver. The store gets the IPv6 version of the wrong port / stale
generation / expiry test.

Signed-off-by: Joffref <mjoffre@blaxel.ai>

Author: Joffref

crates/openshell-core/src/net.rs

@@ -269,6 +269,21 @@ pub fn is_internal_ip(ip: IpAddr) -> bool {
     }
 }
 
+/// Check whether an `allowed_ips` entry covers `ip`.
+///
+/// A NAT64 address also matches through the IPv4 address it embeds, so
+/// `10.0.0.0/8` covers the DNS64 answer `64:ff9b::a00:5` exactly as it covers
+/// `10.0.0.5`. Callers apply the always-blocked check first.
+pub fn allowed_net_contains(net: &IpNet, ip: IpAddr) -> bool {
+    if net.contains(&ip) {
+        return true;
+    }
+    match ip {
+        IpAddr::V6(v6) => nat64::embedded_ipv4(v6).is_some_and(|v4| net.contains(&IpAddr::V4(v4))),
+        IpAddr::V4(_) => false,
+    }
+}
+
 /// Check if a CIDR network intersects any address range classified by
 /// [`is_internal_ip`].
 pub fn is_internal_net(net: IpNet) -> bool {
@@ -863,4 +878,24 @@ mod tests {
         assert!(is_internal_net(net("64:ff9b:1::/64")));
         assert!(!is_internal_net(net("64:ff9b::8c52:7000/120")));
     }
+
+    #[test]
+    fn nat64_answers_match_allowed_ipv4_networks() {
+        let net: IpNet = "10.0.0.0/8".parse().unwrap();
+        assert!(allowed_net_contains(&net, "10.0.0.5".parse().unwrap()));
+        assert!(allowed_net_contains(
+            &net,
+            "64:ff9b::a00:5".parse().unwrap()
+        ));
+        assert!(!allowed_net_contains(
+            &net,
+            "64:ff9b::b00:5".parse().unwrap()
+        ));
+        assert!(!allowed_net_contains(
+            &net,
+            "2001:db8::a00:5".parse().unwrap()
+        ));
+        let v6: IpNet = "2001:db8::/32".parse().unwrap();
+        assert!(allowed_net_contains(&v6, "2001:db8::1".parse().unwrap()));
+    }
 }

crates/openshell-supervisor-network/src/policy_dns/store.rs

@@ -816,6 +816,57 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn ipv6_wrong_port_stale_generation_and_expiry_fail_closed() {
+        let store = store(2);
+        let now = Instant::now();
+        let mut ipv6 = request("db.example", 4, Duration::from_secs(2));
+        ipv6.family = AddressFamily::Ipv6;
+        ipv6.contracts[0].pinned_addresses = vec!["2001:db8::8".parse().unwrap()];
+        let record = store.publish(ipv6, 4, now).unwrap();
+        assert!(record.synthetic_address.is_ipv6());
+        assert_eq!(
+            store
+                .lookup(record.synthetic_address, 5432, 4, now)
+                .unwrap()
+                .pinned_addresses(),
+            ["2001:db8::8".parse::<IpAddr>().unwrap()]
+        );
+        assert!(matches!(
+            store.lookup(record.synthetic_address, 3306, 4, now),
+            Err(MappingLookupError::PortMismatch)
+        ));
+        assert!(matches!(
+            store.lookup(record.synthetic_address, 5432, 5, now),
+            Err(MappingLookupError::StalePolicy)
+        ));
+        assert!(matches!(
+            store.lookup(
+                record.synthetic_address,
+                5432,
+                4,
+                now + Duration::from_secs(2)
+            ),
+            Err(MappingLookupError::Expired)
+        ));
+        // An unallocated address in the IPv6 pool, and the real upstream
+        // address, have no mapping.
+        for unmapped in ["fd00:1::2", "2001:db8::8"] {
+            assert!(matches!(
+                store.lookup(unmapped.parse().unwrap(), 5432, 4, now),
+                Err(MappingLookupError::Missing)
+            ));
+        }
+    }
+
+    #[test]
+    fn ipv6_answers_cannot_publish_ipv4_pins() {
+        let store = store(2);
+        let mut mixed = request("db.example", 1, Duration::from_secs(2));
+        mixed.family = AddressFamily::Ipv6;
+        assert!(store.publish(mixed, 1, Instant::now()).is_err());
+    }
+
     #[test]
     fn expiry_never_reassigns_synthetic_address_to_another_name() {
         let store = store(2);