GPA to support IPv6 dual-stack address

[Zhidong Peng (ZhidongPeng)]

Context: Some of the modern http client library implicitly use IPv6 dual-stack mode for IPv4 host ipaddress, while our current GPA/eBPF program only hook up cgroup/connect4 event. So, in enforce mode, such modern http requests will goto host endpoint directly without captured/proxied by GPA/eBPF, then these requests rejected by host with 401.

Fix:

• GPA to hook up /attaches connect6 event
• The connect6 programs recognize the ::ffff:0:0/96 prefix, extract the low-order IPv4 address, and look it up in the existing IPv4 policy map. A matched connection is redirected to IPv4-mapped loopback while remaining usable by the originating dual-stack socket.
• Add addressFamily to the ProxySummary telemetry event

Native IPv6 still in unsupported until we published the well-known host IPv6 address:

• Native IPv6 addresses do not match the IPv4 policy map and pass through unchanged
• No new native IPv6 endpoint configuration is introduced in this stage

[Copilot]

Pull request overview

This PR adds dual-stack protection for IPv4-mapped IPv6 destinations (::ffff:a.b.c.d) by attaching IPv6 connect hooks in the eBPF layer (Linux + Windows) and carrying the observed connect address family through the shared audit ABI into request + aggregate telemetry.

Changes:

• Add/attach connect6 (Linux) and authorize_connect6 (Windows) programs to intercept IPv4-mapped IPv6 connects and redirect using the existing IPv4 policy map.
• Extend the shared audit/local structs and Rust decoders to carry address_family, and propagate it into AuditEntry → TcpConnectionContext → ProxySummary / ProxyConnectionSummary.
• Update tests and the design doc to reflect mapped-IPv6 behavior and ABI compatibility.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
shared-ebpf/include/gpa_audit_event.h	Extends shared audit/local ABI to include address_family (+ reserved word).
proxy_agent/src/shared_state/connection_summary_wrapper.rs	Updates connection-summary tests for the new addressFamily keying/serialization behavior.
proxy_agent/src/redirector/windows/bpf_prog.rs	Attaches both IPv4 and IPv6 Windows eBPF connect programs; stores multiple links for lifetime management.
proxy_agent/src/redirector/windows.rs	Updates BpfObject to retain multiple eBPF links.
proxy_agent/src/redirector/shared_ebpf.rs	Updates canonical audit entry encode/decode to [u32; 7] and maps address_family into AuditEntry.
proxy_agent/src/redirector/linux.rs	Attaches both connect4 and connect6; updates kprobe naming/attachment and audit decode path.
proxy_agent/src/redirector.rs	Introduces AddressFamily and adds it to AuditEntry for downstream propagation.
proxy_agent/src/proxy/proxy_summary.rs	Adds addressFamily into per-request summary and aggregation key.
proxy_agent/src/proxy/proxy_server.rs	Emits addressFamily in ProxySummary creation.
proxy_agent/src/proxy/proxy_connection.rs	Carries audit-derived address_family through TcpConnectionContext.
proxy_agent_shared/src/proxy_agent_aggregate_status.rs	Adds addressFamily to aggregate status model with a backward-compatible default.
proxy_agent_extension/src/service_main.rs	Updates tests for the new aggregate summary field.
linux-ebpf/ebpf_cgroup.c	Implements cgroup/connect6 for IPv4-mapped IPv6 detection + redirect; records family in local/audit maps.
ebpf/socket.h	Minor typedef formatting consistency.
ebpf/redirect.bpf.c	Implements Windows cgroup/connect6 program for IPv4-mapped IPv6 handling and family recording.
doc/plans/Innovation-4.3-ipv6-dual-stack.md	Updates design to “mapped-IPv6 first” scope, semantics, risks, and milestones.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Srikrishna Veturi (srikrishnaveturi)]

Is this parameter being added for both windows and linux? Did we make changes to the windows script to accept this param?