securenow 8.25.0 → 8.25.2

package/NPM_README.md

@@ -1472,7 +1472,7 @@ The firewall supports four layers -- Layer 1 is always on, the rest are opt-in:
 | **Layer 1: HTTP** | *(always on)* | Returns 403 (`config.firewall.statusCode`): JSON `{"error":"Forbidden","ip":"..."}` for API clients, a security alert page for browsers. Works with proxy headers. |
 | **Layer 2: TCP** | `config.firewall.tcp=true` | `socket.destroy()` before HTTP parsing -- zero bytes sent back. Sees only the connection's source IP; connections from trusted proxies are left to Layer 1. Checked on each server `connection` **(8.25.0+)**; before, it hooked `listen()` and missed the servers most apps start before the SDK has finished starting |
 | **Layer 3: iptables** | `config.firewall.iptables=true` | Kernel-level DROP in a dedicated `SECURENOW_BLOCK` chain (ip6tables for IPv6), or a `securenow` nft table where iptables is missing **(8.25.0+)**. Linux, root or `CAP_NET_ADMIN`; direct client connections only. 8.25.0 validates every entry, runs without a shell and applies each sync as one batch |
-| **Layer 4: Cloud WAF** | `config.firewall.cloud="cloudflare"` / `"aws"` / `"gcp"` | Pushes the global blocklist to Cloudflare (an account IP list named `securenow-blocklist` that your own WAF rule must reference), AWS WAFv2 (IP set; `npm i @aws-sdk/client-wafv2`) or GCP Cloud Armor (`deny(403)` rules at priority 2000; `npm i @google-cloud/compute`), at most every 30 seconds. `config.firewall.cloudDryRun=true` only logs. 8.25.0 fixes IPv6 ranges, Cloud Armor's 10-range limit and stale rules. Request format tested, not run against real accounts |
+| **Layer 4: Cloud WAF** | `config.firewall.cloud="cloudflare"` / `"aws"` / `"gcp"` | Pushes the global blocklist to Cloudflare (an account IP list named `securenow-blocklist` that your own WAF rule must reference), AWS WAFv2 (IP set; `npm i @aws-sdk/client-wafv2`) or GCP Cloud Armor (`deny(403)` rules at priority 2000; `npm i @google-cloud/compute`), at most every 30 seconds. `config.firewall.cloudDryRun=true` only logs. 8.25.0 fixes IPv6 ranges, Cloud Armor's 10-range limit and stale rules. AWS tested against real IP sets (8.25.2+); Cloudflare and GCP request format tested only |
 
 Layers 2 to 4 carry the global blocklist; scoped blocks, rate limits and challenges are Layer 1 only. Turn Layers 2 to 4 on with 8.25.0+. In a container, Layer 3 needs `--cap-add NET_ADMIN` and the `iptables` package.
 

package/SKILL-API.md

@@ -2,7 +2,7 @@
 
 > **Node.js security:** Use a supported, patched runtime: Node.js 22.23.4+, 24.22.1+, or 26.12.1+ on its respective release line. Earlier patches are affected by [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). Upgrading the SecureNow package does not patch Node.js; upgrade the runtime and restart every application process.
 
-The integration playbook for the `securenow` npm package. A coding agent that reads only this file can plug SecureNow into a Node.js app, turn on every feature, deploy it and prove it works. It describes 8.25.0; items marked **(8.25.0+)** are new in 8.25.0, so an older install needs `npm install securenow@latest` for them (check with `npx securenow version`). The terminal reference is [SKILL-CLI.md](./SKILL-CLI.md). Both files ship in `node_modules/securenow/`.
+The integration playbook for the `securenow` npm package. A coding agent that reads only this file can plug SecureNow into a Node.js app, turn on every feature, deploy it and prove it works. It describes 8.25.2; items marked **(8.25.0+)** are new in 8.25.0, so an older install needs `npm install securenow@latest` for them (check with `npx securenow version`). The terminal reference is [SKILL-CLI.md](./SKILL-CLI.md). Both files ship in `node_modules/securenow/`.
 
 ## Rules for the agent
 
@@ -384,7 +384,7 @@ So a `runtime.json` left on a server beats the `credentials.production.json` nex
   | 1 HTTP | always, once the runtime API key is present | 403 JSON `{"error":"Forbidden","ip":"..."}`, or an HTML page with the masked IP for browsers; status from `firewall.statusCode` | Works behind proxies (forwarding headers) |
   | 2 TCP | `"tcp": true` | Destroys the socket before HTTP parsing, zero bytes sent | Sees only the connection's source IP; connections from trusted proxies are left to layer 1. Use 8.25.0+: before, it hooked `listen()` and missed the servers most apps start before the SDK has finished starting |
   | 3 OS | `"iptables": true` | Kernel DROP: a `SECURENOW_BLOCK` chain in iptables (ip6tables for IPv6), or a `securenow` nft table where iptables is missing **(8.25.0+)** | Linux, root or `CAP_NET_ADMIN`, `iptables`/`nft` installed; direct client connections only. Use 8.25.0+: it validates every entry, runs without a shell and applies each sync as one batch, and an IPv6 entry no longer stops the sync |
-  | 4 Cloud WAF | `"cloud": "cloudflare"`, `"aws"` or `"gcp"` | Pushes the global blocklist to the edge, at most every 30 s | Cloudflare: fills an account IP list `securenow-blocklist` that your own WAF rule must reference. AWS: WAFv2 IP set. GCP: Cloud Armor rules at priority 2000, `deny(403)`. Use 8.25.0+ (IPv6 ranges, Cloud Armor's 10-range limit, stale rules fixed). Request format tested, not run against real accounts |
+  | 4 Cloud WAF | `"cloud": "cloudflare"`, `"aws"` or `"gcp"` | Pushes the global blocklist to the edge, at most every 30 s | Cloudflare: fills an account IP list `securenow-blocklist` that your own WAF rule must reference. AWS: WAFv2 IP set. GCP: Cloud Armor rules at priority 2000, `deny(403)`. Use 8.25.2+ (IPv6 ranges, Cloud Armor's 10-range limit, stale rules, IPv4-mapped entries fixed). AWS tested against real IP sets; Cloudflare and GCP request format tested only |
 
   Layers 2 to 4 carry the global blocklist. Scoped blocks, rate limits and challenges are layer 1 only.
 - **On:** automatic with the runtime API key. Each app and environment also has a remote switch, `npx securenow firewall enable|disable --app <key> --env production`, applied without a deploy. `config.firewall.enabled` is ignored.
@@ -419,7 +419,7 @@ So a `runtime.json` left on a server beats the `credentials.production.json` nex
 
 ### 5.8 Blocklist, allowlist, trusted IPs
 
-- **Blocklist:** block an IPv4 address or CIDR everywhere or on a route, optionally with an expiry (the dashboard, CLI and API don't accept IPv6 entries yet). An unblock stops enforcement and keeps the history.
+- **Blocklist:** block an IP address or CIDR range, IPv4 or IPv6, everywhere or on a route, optionally with an expiry (IPv6 ranges are enforced by securenow 8.25.0+). An unblock stops enforcement and keeps the history.
 
   ```bash
   npx securenow blocklist add 203.0.113.42 --env production --duration 24h --reason "credential stuffing"
@@ -806,8 +806,8 @@ Bad signs: no `[securenow]` line at all (the preload is not on the command that
 
 **Not supported:** Edge runtimes (Cloudflare Workers, Vercel Edge, Next.js Edge middleware and routes), Deno, `Bun.serve`, browser telemetry.
 **Not tested:** Vercel (firewall unverified on its serverless functions), AWS Lambda and other serverless platforms.
-**Layers 2 to 4:** turn them on with 8.25.0+ only (in 8.24.0 layer 2 dropped nothing for most apps and layers 3 and 4 mishandled IPv6). **Cloud WAF (layer 4):** request format tested, not run against real Cloudflare, AWS or GCP accounts; on Cloudflare your own WAF rule must reference the `securenow-blocklist` list.
-**IPv6:** layer 1 and trusted proxies match IPv6 addresses and IPv6 CIDR ranges **(8.25.0+; before, IPv6 ranges never matched)**. The dashboard, CLI and API accept only IPv4 addresses and CIDRs in the blocklist, allowlist, trusted IPs, rate limits and challenges.
+**Layers 2 to 4:** turn them on with 8.25.0+ only (in 8.24.0 layer 2 dropped nothing for most apps and layers 3 and 4 mishandled IPv6). **Cloud WAF (layer 4):** AWS WAF is tested against real IP sets (IPv4 and IPv6, emptied list) from 8.25.2; Cloudflare and GCP are tested on the request format only, not against real accounts. On Cloudflare your own WAF rule must reference the `securenow-blocklist` list.
+**IPv6:** the blocklist, allowlist, trusted IPs, rate limits, challenges and API-key IP limits take IPv6 addresses and CIDR ranges, stored in canonical form (`2001:DB8::1` = `2001:db8::1`); layer 1 and trusted proxies match them **(8.25.0+; older SDKs match exact IPv6 addresses but ignore IPv6 ranges)**. A trusted-IP range can be no wider than /8 (IPv4) or /32 (IPv6).
 **`nuxt dev`:** before 8.25.0 the client IP was unknown, so IP blocking only applied to the built server.
 **Log redaction (8.25.0+)** goes by field names and value shapes: a secret in free text with no recognizable shape is exported as written.
 

package/firewall-cloud.js

@@ -11,7 +11,7 @@
  */
 
 const https = require('https');
-const net = require('net');
+const { parseIp, parseCidr, parseCidr6, intToIp, bigIntToIpv6 } = require('./cidr');
 
 let _options = null;
 let _active = false;
@@ -24,21 +24,38 @@ const GCP_MAX_RULES = 100;
 
 const MIN_PUSH_INTERVAL_MS = 30000;
 
-// Blocklist entries as CIDRs, per address family: an exact address becomes /32 (IPv4) or /128 (IPv6).
-// (Appending "/32" to everything turned one IPv6 address into a /32 covering billions of addresses.)
+// Blocklist entries as canonical CIDRs, per address family: an exact address becomes /32 (IPv4) or /128
+// (IPv6), an IPv4-mapped address (::ffff:1.2.3.4) is IPv4, a range is written from its network address,
+// and anything a provider would refuse (not an IP, a /0) is left out. One bad entry used to make the
+// provider refuse the whole push; the app still blocks what is left out here.
 function toCidrs(ips) {
-  const v4 = [];
-  const v6 = [];
+  const v4 = new Set();
+  const v6 = new Set();
   for (const raw of ips || []) {
     const entry = String(raw || '').trim();
     if (!entry) continue;
-    const slash = entry.indexOf('/');
-    const addr = slash === -1 ? entry : entry.slice(0, slash);
-    const family = net.isIP(addr);
-    if (family === 4) v4.push(slash === -1 ? `${addr}/32` : entry);
-    else if (family === 6) v6.push(slash === -1 ? `${addr}/128` : entry);
+    if (!entry.includes('/')) {
+      const ip = parseIp(entry);
+      if (ip) (ip.family === 4 ? v4 : v6).add(`${ip.key}/${ip.family === 4 ? 32 : 128}`);
+      continue;
+    }
+    const bits = Number(entry.slice(entry.indexOf('/') + 1));
+    const c4 = parseCidr(entry);
+    if (c4) {
+      if (bits > 0) v4.add(`${intToIp(c4.network)}/${bits}`);
+      continue;
+    }
+    const c6 = parseCidr6(entry);
+    if (!c6 || c6.bits === 0) continue;
+    if (c6.bits >= 96 && (c6.network >> 32n) === 0xffffn) {
+      // ::ffff:0:0/96 and narrower are IPv4 ranges written in IPv6 form.
+      const b4 = c6.bits - 96;
+      if (b4 > 0) v4.add(`${intToIp(Number(c6.network & 0xffffffffn) >>> 0)}/${b4}`);
+    } else {
+      v6.add(`${bigIntToIpv6(c6.network)}/${c6.bits}`);
+    }
   }
-  return { v4, v6 };
+  return { v4: [...v4], v6: [...v6] };
 }
 
 function prefixLength(cidr) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securenow",
-  "version": "8.25.0",
+  "version": "8.25.2",
   "mcpName": "ai.securenow/securenow",
   "description": "OpenTelemetry instrumentation for Node.js, Next.js, and Nuxt - Send traces and logs to any OTLP-compatible backend",
   "type": "commonjs",