PR #74391: fix(ssrf): extend allowRfc2544BenchmarkRange to cover IPv6 uniqueLocal (fc00::/7) (#74351)

• Repository: openclaw/openclaw
• Author: hclsys
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/74391

Description (problem / solution / changelog)

Summary

Fixes #74351.

Fake-ip proxy tools (sing-box, Clash, Surge) resolve foreign domains to both IPv4 198.18.0.0/15 (RFC 2544 range) and IPv6 fc00::/7 (uniqueLocal). Setting tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange: true correctly exempted the IPv4 side but isBlockedSpecialUseIpv6Address had no options parameter, so the IPv6 ULA range remained unconditionally blocked — causing web_fetch to fail for all foreign domains through fake-ip proxies.

Root cause: isPrivateIpAddress in src/infra/net/ssrf.ts called isBlockedSpecialUseIpv6Address(strictIp) without forwarding the policy options that were already threaded for IPv4.

Fix (2 files, backward-compatible):

• src/shared/net/ip.ts: add Ipv6SpecialUseBlockOptions type (mirrors Ipv4SpecialUseBlockOptions); extend isBlockedSpecialUseIpv6Address with an optional options param (default {}); exempt uniqueLocal range when allowRfc2544BenchmarkRange === true
• src/infra/net/ssrf.ts: add resolveIpv6SpecialUseBlockOptions helper (mirrors resolveIpv4SpecialUseBlockOptions); pass it to the IPv6 check

Pre-implement audit:

1. Existing helper: reusing isBlockedSpecialUseIpv6Address — extended in-place, not duplicated ✓
2. Shared helper callers: called in 2 places (ip.ts:237, ssrf.ts:186) — default {} preserves backward compatibility for both ✓
3. Rival scan: no competing PR found for #74351 ✓

Test plan

• isBlockedSpecialUseIpv6Address(fc00::1) → true (default, no exemption)
• isBlockedSpecialUseIpv6Address(fc00::1, { allowRfc2544BenchmarkRange: true }) → false (exempted)
• isBlockedSpecialUseIpv6Address(::1, { allowRfc2544BenchmarkRange: true }) → true (loopback not exempted)
• isPrivateIpAddress("fc00::1", { allowRfc2544BenchmarkRange: true }) → false (end-to-end via ssrf.ts)
• isPrivateIpAddress("fc00::1") → true (default still blocks)

🤖 Generated with Claude Code

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/infra/net/ssrf.ts (modified, +9/-1)
• src/shared/net/ip.test.ts (modified, +21/-0)
• src/shared/net/ip.ts (modified, +14/-1)

PR #74571: fix(ssrf): allow opt-in IPv6 unique-local exemption for fake-ip proxies

• Repository: openclaw/openclaw
• Author: jeffrey701
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/74571

Description (problem / solution / changelog)

Closes #74351. AI-assisted, fully tested.

Sing-box / Clash / Surge fake-ip proxy stacks resolve foreign domains
to BOTH IPv4 198.18.0.0/15 AND IPv6 fc00::/7 simultaneously. Setting
`tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange: true` already
exempted the IPv4 leg, but the IPv6 ULA range stayed unconditionally
blocked, so every web_fetch through a fake-ip proxy still failed with
"Blocked: resolves to private/internal/special-use IP address".

## Approach

Adds a separate, opt-in `allowIpv6UniqueLocalRange` flag rather than
extending `allowRfc2544BenchmarkRange`'s semantics. Reasons:

- No silent behavior change for existing `allowRfc2544BenchmarkRange:
  true` users — their IPv6 surface stays exactly as restrictive as it
  was.
- Operators can mix and match: only IPv4 fake-ip ranges, only IPv6
  ULA, or both, depending on which proxy they actually run.
- Matches the issue's "Alternatively, provide a separate configuration
  option for exempting the IPv6 ULA range" suggestion, which is the
  conservative of the two presented options.

## Implementation

- `src/shared/net/ip.ts`: new `Ipv6SpecialUseBlockOptions` type;
  `isBlockedSpecialUseIpv6Address` now takes optional opts and returns
  false for `range() === "uniqueLocal"` only when
  `allowUniqueLocalRange === true`. Loopback (`::1`), unspecified
  (`::`), multicast (`ff00::/8`), discard, reserved, and the
  deprecated site-local `fec0::/10` keep their unconditional block —
  the exemption is scoped to ULA, not "any reserved IPv6 range".
- `src/infra/net/ssrf.ts`: new `allowIpv6UniqueLocalRange` field on
  `SsrFPolicy`, mirrored into `normalizeSsrFPolicyForComparison` so
  `isSameSsrFPolicy` participates in policy-cache invalidation. New
  `resolveIpv6SpecialUseBlockOptions` helper threaded through the
  `isPrivateIpAddress` path. The `media/parse.ts` call site keeps the
  default options (no opt-in), so media URL safety stays unchanged.

## Tests

- `src/shared/net/ip.test.ts` — 2 new unit tests covering the wrapper
  contract and the explicit "exemption is scoped to ULA only" invariant.
- `src/infra/net/ssrf.test.ts` — 7 new `it.each` rows covering the
  policy-threading: ULA blocked by default; exempt with the new flag;
  other reserved ranges still blocked; the new flag is independent of
  `allowRfc2544BenchmarkRange`. Plus a new `isSameSsrFPolicy` case
  asserting the new field participates in semantic equality.

`pnpm test src/shared/net/ip.test.ts src/infra/net/ssrf.test.ts
src/infra/net/ssrf.pinning.test.ts src/infra/net/fetch-guard.ssrf.test.ts`
— 108 passed across 4 files.

`pnpm exec oxfmt --check` — clean. `pnpm exec oxlint` — 0 warnings,
0 errors.

## AI-assisted PR

- [x] Mark as AI-assisted (Claude). Lightly tested via targeted Vitest
  shards on the four ssrf/ip-policy files; not exercised end-to-end
  against a live fake-ip proxy stack — operator confirmation welcome.
- [x] Confirm I understand what the code does: yes — the SSRF gate
  is delegating to `isBlockedSpecialUseIpv6Address`, and the new flag
  is a per-call, per-policy opt-out for one specific IPv6 range.

Closes #74351

Changed files

• CHANGELOG.md (modified, +1/-0)
• docs/.generated/config-baseline.sha256 (modified, +3/-3)
• docs/tools/web-fetch.md (modified, +8/-0)
• packages/memory-host-sdk/src/host/ssrf-policy.ts (modified, +1/-0)
• src/agents/tools/web-fetch.ssrf.test.ts (modified, +25/-1)
• src/agents/tools/web-fetch.ts (modified, +12/-3)
• src/config/schema.base.generated.ts (modified, +11/-0)
• src/config/schema.help.ts (modified, +2/-0)
• src/config/schema.labels.ts (modified, +1/-0)
• src/config/schema.test.ts (modified, +2/-0)
• src/config/types.tools.ts (modified, +2/-0)
• src/config/zod-schema.agent-runtime.ts (modified, +1/-0)
• src/infra/net/ssrf.test.ts (modified, +34/-0)
• src/infra/net/ssrf.ts (modified, +18/-1)
• src/plugin-sdk/ssrf-policy.test.ts (modified, +2/-0)
• src/plugin-sdk/ssrf-policy.ts (modified, +3/-0)
• src/shared/net/ip.test.ts (modified, +49/-0)
• src/shared/net/ip.ts (modified, +28/-1)