golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(06-13): complete fetchguard SSRF gap-closure plan

Browse Source
This commit is contained in:
Jakub Zych
2026-09-21 19:45:03 +02:00
parent b1079ab8a4
commit 54dd60953a
3 changed files with 39 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.planning/ROADMAP.md
View File

@@ -425,7 +425,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 →
| 3. First vertical slice — genres end to end | 4/4 | Complete | 2026-09-17 | | 3. First vertical slice — genres end to end | 4/4 | Complete | 2026-09-17 |
| 4. CLI scaffolding, i18n and mail | 4/4 | Complete | 2026-09-18 | | 4. CLI scaffolding, i18n and mail | 4/4 | Complete | 2026-09-18 |
| 5. Data layer full fidelity | 6/6 | Complete | 2026-09-18 | | 5. Data layer full fidelity | 6/6 | Complete | 2026-09-18 |
| 6. HTTP routing, auth groups and rate limiting | 12/14 | In Progress| | | 6. HTTP routing, auth groups and rate limiting | 13/14 | In Progress| |
| 7. User plugin and authentication | 0/TBD | Not started | - | | 7. User plugin and authentication | 0/TBD | Not started | - |
| 8. OAuth2.1 authorization server | 0/TBD | Not started | - | | 8. OAuth2.1 authorization server | 0/TBD | Not started | - |
| 9. Backend admin authentication and schema pipeline | 0/TBD | Not started | - | | 9. Backend admin authentication and schema pipeline | 0/TBD | Not started | - |

4
.planning/STATE.md
View File

@@ -4,13 +4,13 @@ milestone: v1.0
milestone_name: milestone milestone_name: milestone
status: verifying status: verifying
stopped_at: Completed 06-11-PLAN.md stopped_at: Completed 06-11-PLAN.md
last_updated: "2026-09-21T17:43:47.082Z" last_updated: "2026-09-21T17:45:02.572Z"
last_activity: 2026-09-21 last_activity: 2026-09-21
progress: progress:
total_phases: 15 total_phases: 15
completed_phases: 5 completed_phases: 5
total_plans: 37 total_plans: 37
completed_plans: 35 completed_plans: 36
percent: 33 percent: 33
--- ---

36
.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-13-SUMMARY.md Normal file
View File

@@ -0,0 +1,36 @@
---
phase: 06-http-routing-auth-groups-and-rate-limiting
plan: 13
subsystem: fetchguard
tags: [ssrf, security, http-07]
requires: []
provides: [full IANA special-use non-public IP classification, zoned IPv6 rejection at dial time]
affects: [fetchguard]
key-files:
modified: [fetchguard/ip.go, fetchguard/fetch.go, fetchguard/ip_test.go, fetchguard/fetch_test.go]
decisions:
- "Zoned IPv6 dial targets are rejected outright with private_ip; classifier also strips zones so results match the unzoned form"
metrics:
tasks: 2
completed: 2026-09-21
requirements: [HTTP-07]
---
# Phase 6 Plan 13: fetchguard SSRF gap closure Summary
Full IANA special-use IPv4/IPv6 prefix tables (incl. 198.18.0.0/15, 192.0.0.0/24, 240.0.0.0/4, ::/96, 2001::/23, 2001:db8::/32, 3fff::/20, fec0::/10, ff00::/8) plus zone-stripping in the classifier and outright rejection of zoned dial targets.
## Tasks
1. Extended privateV4/privateV6 and zone-stripping in `isReservedOrPrivate`; NAT64/6to4 recursion untouched. Commit b1079ab.
2. `dialControl` returns errPrivateIP for zoned addresses before classification; smoke tests added. Commit b1079ab (single code commit, both tasks touch one fix).
## Deviations from Plan
None. Both tasks were committed together in one code commit.
## Verification
`go vet ./...` and `go test ./... -short` green; fetchguard also green under `-race`.
## Self-Check: PASSED