[FrostGod]

Summary

A transparent TCP connection allowed for an IPv4 destination was denied when a dual-stack client used its ::ffff: form. Canonicalize the destination before routing, policy DNS lookup, policy evaluation, and denial reporting, while preserving native IPv6 scope and flow information.

Related Issue

Closes #5093

Changes

• Normalize the staged destination IP with to_canonical().
• Add five regression tests covering allowed endpoints, DNS hostname recovery and pinned addresses, denial hosts, metadata blocking, and native IPv6 preservation.
• Extend the existing Docker/Podman TCP E2E probe with an actual IPv4-mapped AF_INET6 connection, and document equivalent IPv4 policy matching.

Release Notes

Testing

• Scoped formatting, Clippy, and documentation navigation checks pass.
• Unit tests added: 5 new regressions and 23 existing staged-open/reserved-routing checks pass.
• Existing E2E test extended; local execution did not reach the tests.

Commands passed:

• cargo test --offline -p openshell-supervisor-network --lib proxy::tests::ipv4_mapped
• cargo test --offline -p openshell-supervisor-network --lib -- staged_ reserved_ metadata_staging --test-threads=1
• cargo clippy --offline -p openshell-supervisor-network --lib --tests -- -D warnings
• cargo fmt --check -p openshell-supervisor-network
• rustfmt --check --edition 2024 e2e/rust/tests/transparent_tcp.rs
• mise run --skip-tools docs:nav

The focused Docker E2E run was canceled after stalling on base-image metadata from ghcr.io/astral-sh/uv and nvcr.io/nvidia/base/ubuntu, before sandbox tests started. The repository-wide commit hook also failed in unrelated local Python tooling; the commit uses the completed scoped checks above.

Checklist

• Follows Conventional Commits.
• Commit signed off (DCO).
• Relevant network-policy documentation updated.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5097.docs.buildwithfern.com/openshell