From 0598c8985be7eafbdcd019e91e363dcb65f47777 Mon Sep 17 00:00:00 2001 From: Kyle Isom Date: Tue, 22 Sep 2026 23:01:19 -0700 Subject: [PATCH] p1.1: note IPv4-only self-IP assumption Trace via 1.1.1.1 never learns a delegated v6 prefix. --- internal/selfip/selfip.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/internal/selfip/selfip.go b/internal/selfip/selfip.go index f89932c..539846c 100644 --- a/internal/selfip/selfip.go +++ b/internal/selfip/selfip.go @@ -1,5 +1,10 @@ // Package selfip discovers the host's current WAN address so the SSRF // guard can deny hairpin-NAT fetches of the residential IP. +// +// Assumption: the LAN is IPv4-only. A 1.1.1.1 trace only learns v4. If the +// ISP ever delegates global v6, add interface-derived self prefixes +// (net.InterfaceAddrs, deny the delegated prefix, default /56) — v6 LAN +// hosts are then directly reachable with no hairpin NAT. package selfip import (