3 Commits

Include renames

Author	SHA1	Message	Date
mrambossekandClaude Fable 5	ac6c653115	privacy: pseudonymize the whole ULA prefix, not just its tail ... Found in a real uploaded run from the phone: the server held fda1:3fb1:ff92:6696::2662 for a DNS server. The general IPv6 path keeps the leading two groups on purpose - for a global address that preserves the ISP allocation, which is the useful part - but for a ULA that passes through 32 of the 40 random bits of the global ID. A ULA looks like the v6 RFC1918 and the instinct is to treat it the same. It is not analogous, and the difference is the point: an RFC1918 prefix is shared by millions of networks and identifies none of them, while a ULA global ID is random and unique to one network by construction (RFC 4193). The prefix IS the identifier, so it was a network fingerprint surviving redaction. Pseudonymized as a unit now, so two addresses on one ULA subnet still share a pseudonymous prefix - "these hosts are on one network" survives, "this is that network" does not. RFC1918 stays readable, and the contrast is what justifies it; a test pins both halves. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 15:26:09 +02:00
mrambossekandClaude Fable 5	172afb421d	privacy: fix a real leak - global IPv6 addresses were uploaded verbatim ... Setting out to build the machine-readable schema, the first step was checking whether the anonymizer covers the fields the schema declares sensitive. It did not, and five identifying values were going out at the `balanced` level: networks[].link.addresses[].addr the device's own global IPv6 address networks[].link.routes[].gateway the ISP allocation networks[].link.dns.servers[] the configured resolver private_dns_hostname an internal hostname search_domains[] the internal domain The settings screen describes that level as pseudonymizing addresses. Root cause: classification keyed on field names, and the schema's actual names were never added to the table. Every existing test passed, because each checked a field somebody had remembered to write a case for - an unfalsifiable design for a privacy control. So beyond adding the names, classification now falls back to the *value* when the name is unknown: anything shaped like an IPv4/IPv6 address or a MAC is treated as one. Hostnames deliberately are not inferred by shape, since train.udp_updown is indistinguishable from a domain and mangling a test type would corrupt the document to protect nothing. LeakTest is the guard, and is written to fail for fields nobody thought of: it plants identifying values wherever one can occur and asserts none survive. It also pins that RFC1918 addresses stay readable, so it cannot pass by over-redacting. Route prefixes and :: needed care - 0.0.0.0/0 must stay itself or a routing table becomes unreadable for no privacy gain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 14:45:52 +02:00
mrambossekandClaude Fable 5	ce1aaa332a	server: send granted traffic from the address the session actually used ... fmr binds two IPv4 addresses. connFor picked whichever socket of the right family came first in the bind list, so a downtrain for a session established on .150 went out from .151 — and every packet was dropped by the client's NAT, which has no mapping for that pair. tcpdump on the server showed all 50 leaving; the client saw none. Read as "100% downstream loss", which is the worst kind of wrong: a confident measurement of something that never happened. Sessions now record which of our own bound addresses received their traffic, and granted sends (and delayed echo) go back out through that socket. The fallback to a family match is kept for the case where nothing has been received yet, and the test pins both paths — a single-homed lab can never reproduce this. Also: the client-side halves of the same work — anonymizer (core-privacy), local run archive with retention (core-archive), upload client, and the app's settings and history screens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-08-01 10:45:43 +02:00