From 54dd60953aff850cad4c10b83f3a4cb01139d35a Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 21 Sep 2026 19:45:03 +0200 Subject: [PATCH] docs(06-13): complete fetchguard SSRF gap-closure plan --- .planning/ROADMAP.md | 2 +- .planning/STATE.md | 4 +-- .../06-13-SUMMARY.md | 36 +++++++++++++++++++ 3 files changed, 39 insertions(+), 3 deletions(-) create mode 100644 .planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-13-SUMMARY.md diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 1c92602..f497941 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -425,7 +425,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 3. First vertical slice — genres end to end | 4/4 | Complete | 2026-09-17 | | 4. CLI scaffolding, i18n and mail | 4/4 | Complete | 2026-09-18 | | 5. Data layer full fidelity | 6/6 | Complete | 2026-09-18 | -| 6. HTTP routing, auth groups and rate limiting | 12/14 | In Progress| | +| 6. HTTP routing, auth groups and rate limiting | 13/14 | In Progress| | | 7. User plugin and authentication | 0/TBD | Not started | - | | 8. OAuth2.1 authorization server | 0/TBD | Not started | - | | 9. Backend admin authentication and schema pipeline | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 2d939f6..8c016b3 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,13 +4,13 @@ milestone: v1.0 milestone_name: milestone status: verifying stopped_at: Completed 06-11-PLAN.md -last_updated: "2026-09-21T17:43:47.082Z" +last_updated: "2026-09-21T17:45:02.572Z" last_activity: 2026-09-21 progress: total_phases: 15 completed_phases: 5 total_plans: 37 - completed_plans: 35 + completed_plans: 36 percent: 33 --- diff --git a/.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-13-SUMMARY.md b/.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-13-SUMMARY.md new file mode 100644 index 0000000..b2958c9 --- /dev/null +++ b/.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-13-SUMMARY.md @@ -0,0 +1,36 @@ +--- +phase: 06-http-routing-auth-groups-and-rate-limiting +plan: 13 +subsystem: fetchguard +tags: [ssrf, security, http-07] +requires: [] +provides: [full IANA special-use non-public IP classification, zoned IPv6 rejection at dial time] +affects: [fetchguard] +key-files: + modified: [fetchguard/ip.go, fetchguard/fetch.go, fetchguard/ip_test.go, fetchguard/fetch_test.go] +decisions: + - "Zoned IPv6 dial targets are rejected outright with private_ip; classifier also strips zones so results match the unzoned form" +metrics: + tasks: 2 + completed: 2026-09-21 +requirements: [HTTP-07] +--- + +# Phase 6 Plan 13: fetchguard SSRF gap closure Summary + +Full IANA special-use IPv4/IPv6 prefix tables (incl. 198.18.0.0/15, 192.0.0.0/24, 240.0.0.0/4, ::/96, 2001::/23, 2001:db8::/32, 3fff::/20, fec0::/10, ff00::/8) plus zone-stripping in the classifier and outright rejection of zoned dial targets. + +## Tasks + +1. Extended privateV4/privateV6 and zone-stripping in `isReservedOrPrivate`; NAT64/6to4 recursion untouched. Commit b1079ab. +2. `dialControl` returns errPrivateIP for zoned addresses before classification; smoke tests added. Commit b1079ab (single code commit, both tasks touch one fix). + +## Deviations from Plan + +None. Both tasks were committed together in one code commit. + +## Verification + +`go vet ./...` and `go test ./... -short` green; fetchguard also green under `-race`. + +## Self-Check: PASSED