fix(egress): judge IP literals synchronously and match every IPv4 spelling

Two more from review, both verified with probes first.

The deferral added last round applied to every liftable refusal whenever an IP
range was configured — literals included. A literal has already been judged
against its own address, so a lookup can add nothing, and deferring accepted
literals outside every configured range: with only `10.0.0.0/8` allowlisted,
`https://192.168.1.1` came back valid. It now defers hostnames only.

`matchesRangeAllowlist` compared the raw parsed address, so a resolver answering
with `::a00:1` — which is 10.0.0.1 — was refused by a `10.0.0.0/8` entry. It
over-blocks rather than under-blocks, but an allowlisted destination became
unreachable depending on what DNS returned. `canonicalAddress` already existed
for the metadata comparison and simply was not used here.

Folding needed a carve-out the metadata path did not: `::` and `::1` are the
unspecified and loopback addresses, not an IPv4 carried inside IPv6. Folding
`::1` to `0.0.0.1` would have let a `0.0.0.0/8` entry match loopback and stopped
`::1/128` matching it. Both directions are pinned by tests, alongside the four
spellings an IPv4 range must accept.

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.test.ts

@@ -473,6 +473,22 @@ describe('validateUrlWithDNS', () => {
       expect(result.error).toContain('private or reserved address')
     })
 
+    it('refuses an IP literal outside the configured range without deferring', () => {
+      // A literal was judged against its own address, so a lookup could add
+      // nothing — deferring it would accept literals outside every range.
+      envFlagsMock.egressAllowedIpRanges = '10.0.0.0/8'
+      try {
+        expect(
+          validateExternalUrl('https://192.168.1.1/x', 'url', 'configuredEndpoint').isValid
+        ).toBe(false)
+        expect(validateExternalUrl('https://10.0.0.5/x', 'url', 'configuredEndpoint').isValid).toBe(
+          true
+        )
+      } finally {
+        envFlagsMock.egressAllowedIpRanges = undefined
+      }
+    })
+
     it('permits a private IP once the operator allowlists its range', async () => {
       envFlagsMock.egressAllowedIpRanges = '192.168.0.0/16'
       try {

apps/sim/lib/core/security/input-validation.ts

@@ -1,5 +1,6 @@
 import { createLogger } from '@sim/logger'
 import { evaluateUrl, isLiftableByVouching, policyDefersToAddress } from '@sim/security/egress'
+import { isIpLiteral, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import {
   describeEgressDenial,
   type EgressProfile,
@@ -521,7 +522,15 @@ export function validateExternalUrl(
   // host permitted only by EGRESS_ALLOWED_IP_RANGES cannot be recognised until
   // DNS runs, and refusing here would stop it being configured at all.
   // validateUrlWithDNS makes the authoritative call before anything is dialled.
-  if (policyDefersToAddress(policy) && isLiftableByVouching(decision.reason)) {
+  //
+  // Only for a hostname. A literal was judged against its own address, so there
+  // is nothing a lookup could add and deferring would accept a literal outside
+  // every configured range.
+  if (
+    !isIpLiteral(unwrapIpv6Brackets(parsed.hostname)) &&
+    policyDefersToAddress(policy) &&
+    isLiftableByVouching(decision.reason)
+  ) {
     return { isValid: true }
   }
 

packages/security/src/egress.test.ts

@@ -155,6 +155,33 @@ describe('operator allowlist — the self-hosted posture', () => {
   })
 })
 
+describe('an IPv4 range matches every spelling of the same address', () => {
+  const ranged = createEgressPolicy({ allowedRanges: '10.0.0.0/8' })
+
+  it.each([
+    ['10.0.0.1', 'plain IPv4'],
+    ['::a00:1', 'the IPv4-compatible form a resolver can return'],
+    ['::ffff:10.0.0.1', 'the IPv4-mapped form'],
+    ['::10.0.0.1', 'IPv4-compatible written long-hand'],
+  ])('permits %s — %s', (address) => {
+    expect(decide(ranged, 'https://svc.internal/', address).allowed).toBe(true)
+  })
+
+  it('does not fold the addresses that are IPv6 in their own right', () => {
+    // `::1` is loopback, not 0.0.0.1 carried inside IPv6 — folding it would let
+    // a 0.0.0.0/8 entry match it, and stop `::1/128` matching it.
+    const loopback = createEgressPolicy({ allowedRanges: '::1/128' })
+    expect(decide(loopback, 'https://svc.internal/', '::1').allowed).toBe(true)
+
+    const zeroPage = createEgressPolicy({ allowedRanges: '0.0.0.0/8' })
+    expect(decide(zeroPage, 'https://svc.internal/', '::1').allowed).toBe(false)
+  })
+
+  it('still refuses an address outside the range in any spelling', () => {
+    expect(reason(ranged, 'https://svc.internal/', '::c0a8:101')).toBe('address-blocked')
+  })
+})
+
 describe('the same operator config is inert on the hosted posture', () => {
   it.each([
     ['http://host.docker.internal/', '192.168.65.254'],

packages/security/src/egress.ts

@@ -245,8 +245,10 @@ function matchesHostAllowlist(host: string, policy: EgressPolicy): boolean {
 
 function matchesRangeAllowlist(address: string, policy: EgressPolicy): boolean {
   if (policy.allowedRanges.length === 0) return false
-  const clean = unwrapIpv6Brackets(address)
-  if (!ipaddr.isValid(clean)) return false
+  // Canonical form, so an operator's IPv4 CIDR still matches a resolver that
+  // answered with the IPv4-compatible IPv6 spelling of the same address.
+  const clean = canonicalAddress(address)
+  if (clean === null) return false
   const parsed = ipaddr.process(clean)
   return policy.allowedRanges.some(
     (range) =>
@@ -268,7 +270,11 @@ function canonicalAddress(address: string): string | null {
   const parsed = ipaddr.process(clean)
   if (parsed.kind() === 'ipv6') {
     const parts = (parsed as ipaddr.IPv6).parts
-    if (parts.slice(0, 6).every((part) => part === 0)) {
+    const embedded = ((parts[6] << 16) >>> 0) + parts[7]
+    // `::` and `::1` are the unspecified and loopback addresses, not an IPv4
+    // carried inside IPv6 — folding them would turn `::1` into `0.0.0.1` and
+    // stop an operator's `::1/128` entry matching it.
+    if (parts.slice(0, 6).every((part) => part === 0) && embedded > 1) {
       return ipaddr
         .fromByteArray([
           (parts[6] >> 8) & 0xff,