FA-7061 / Proxy forwarding / Open access

Proxy bypass cidr matches address network membership · case 01

Proxy bypass cidr matches address network membership.

Verified by executionVariant 1 · 4 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

The faulty implementation uses `address == network.split("/")[0]` for the proxy-bypass-cidr-matches-address-network-membership decision.

VERIFIED REPAIR

Apply the explicit proxy-bypass-cidr-matches-address-network-membership contract, including the tested boundary and negative cases.

Unsuccessful approach: The attempted repair uses `address.startswith(network.split("/")[0].rsplit(".",1)[0])` and still violates a separate fixture.

Case contract

Bounded offline decision model: proxy bypass cidr matches address network membership. Inputs are already validated protocol fields; the explicit fixtures define the supported policy, not a complete protocol implementation.

Why this case matters

This deterministic proxy forwarding model isolates the proxy-bypass-cidr-matches-address-network-membership policy at a network component boundary.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(address, network):
    return address == network.split("/")[0]
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('10.1.2.3', '10.0.0.0/8'), True)", "check('fixture 2', solve('10.0.0.200', '10.0.0.0/25'), False)", "check('fixture 3', solve('192.0.2.1', '10.0.0.0/8'), False)", "check('fixture 4', solve('10.0.0.0', '10.0.0.0/8'), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`False`	`False`	Passed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`False`	`True`	Failed

SHA-256 / c70815eb520e98596c912f4e42601c9c9291f7b497a645e76478c070ac2e7aa2

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(address, network):
    return address.startswith(network.split("/")[0].rsplit(".",1)[0])
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('10.1.2.3', '10.0.0.0/8'), True)", "check('fixture 2', solve('10.0.0.200', '10.0.0.0/25'), False)", "check('fixture 3', solve('192.0.2.1', '10.0.0.0/8'), False)", "check('fixture 4', solve('10.0.0.0', '10.0.0.0/8'), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`True`	`False`	Failed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`False`	`True`	Failed

SHA-256 / 5d8835562d52b7a3873716974d1b672f55599d9c20717dcb9288d2e1b509fe79

3 / The verified repair

Exit 0

"""Failure Map reference implementation. Python standard library only."""
import json
import ipaddress
import re
from urllib.parse import urlsplit, urljoin
N = 1
observations = []
def solve(address, network):
    return ipaddress.ip_address(address) in ipaddress.ip_network(network)
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
_fixtures = ["check('fixture 1', solve('10.1.2.3', '10.0.0.0/8'), True)", "check('fixture 2', solve('10.0.0.200', '10.0.0.0/25'), False)", "check('fixture 3', solve('192.0.2.1', '10.0.0.0/8'), False)", "check('fixture 4', solve('10.0.0.0', '10.0.0.0/8'), True)"]
for _line in _fixtures[N % len(_fixtures):] + _fixtures[:N % len(_fixtures)]:
    exec(_line)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
fixture 2	`False`	`False`	Passed
fixture 3	`False`	`False`	Passed
fixture 4	`True`	`True`	Passed
fixture 1	`True`	`True`	Passed

SHA-256 / 34ba0753541b8761625907c9b7feffd8e79c54085c0ebfa9e9db46a38be94e3b

Verification & scope

Bounded deterministic policy model over validated inputs; not a complete protocol stack or an interoperability claim. The five variants rotate the same explicit fixture set. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-29T14:38:07.911403+00:00.

Case digest / 89dfa9beaad6da2164a37503c4b4e9c27ccfe3f899582def82e9ef0b3f787112