first commit

tests/dns-alias.test.mjs

@@ -0,0 +1,10 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {defaultPolicy} from '../packages/core/policy.mjs';
+import {dnsAddressBlocked} from '../packages/core/security.mjs';
+test('IPv4-mapped IPv6 cannot bypass blocked destination IPs',()=>{
+  const p=defaultPolicy();p.security.dns.blockedIPs=['127.0.0.2'];
+  for(const ip of ['127.0.0.2','::ffff:127.0.0.2','0:0:0:0:0:ffff:7f00:2'])assert.equal(dnsAddressBlocked(ip,p),true);
+  assert.equal(dnsAddressBlocked('::ffff:127.0.0.3',p),false);
+  p.security.dns.blockedIPs=['::ffff:7f00:2'];assert.equal(dnsAddressBlocked('127.0.0.2',p),true);
+});