test(06-14): fetchguard IANA boundary and zoned dial tests, surf edge coverage

fetchguard/ip_test.go

@@ -90,3 +90,89 @@ func TestIsReservedOrPrivateSpecialUseSmoke(t *testing.T) {
 		}
 	}
 }
+
+func prefixBounds(p netip.Prefix) (first, last netip.Addr) {
+	first = p.Masked().Addr()
+	b := first.AsSlice()
+	for bit := p.Bits(); bit < len(b)*8; bit++ {
+		b[bit/8] |= 1 << (7 - bit%8)
+	}
+	last, _ = netip.AddrFromSlice(b)
+	return first, last
+}
+
+func TestIsReservedOrPrivateIANABoundaries(t *testing.T) {
+	var all []netip.Prefix
+	all = append(all, privateV4...)
+	all = append(all, privateV6...)
+	inAny := func(a netip.Addr) bool {
+		for _, p := range all {
+			if p.Contains(a) {
+				return true
+			}
+		}
+		return false
+	}
+	for _, p := range all {
+		t.Run(p.String(), func(t *testing.T) {
+			first, last := prefixBounds(p)
+			interior := first.Next()
+			for _, a := range []netip.Addr{first, last, interior} {
+				if !p.Contains(a) {
+					t.Fatalf("test bug: %s not in %s", a, p)
+				}
+				if !isReservedOrPrivate(a) {
+					t.Errorf("%s (in %s) classified public", a, p)
+				}
+			}
+			for _, a := range []netip.Addr{first.Prev(), last.Next()} {
+				if !a.IsValid() || inAny(a) || a.IsMulticast() || a.IsUnspecified() {
+					continue
+				}
+				if _, ok := embeddedTransitionIPv4(a); ok {
+					continue
+				}
+				if isReservedOrPrivate(a) {
+					t.Errorf("neighbour %s of %s classified non-public", a, p)
+				}
+			}
+		})
+	}
+
+	explicit := []struct {
+		ip   string
+		want bool
+	}{
+		{"198.17.255.255", false}, {"198.18.0.0", true}, {"198.19.255.255", true}, {"198.20.0.0", false},
+		{"191.255.255.255", false}, {"192.0.0.0", true}, {"192.0.1.0", false},
+		{"239.255.255.255", true}, {"240.0.0.0", true}, {"255.255.255.255", true},
+		{"100.63.255.255", false}, {"100.64.0.0", true}, {"100.127.255.255", true}, {"100.128.0.0", false},
+		{"172.15.255.255", false}, {"172.32.0.0", false},
+		{"2001:200::1", false}, {"2001:db8::", true}, {"2001:db9::", false},
+		{"3fff:fff:ffff:ffff:ffff:ffff:ffff:ffff", true}, {"3fff:1000::", false},
+		{"8.8.8.8", false}, {"1.1.1.1", false}, {"2606:4700:4700::1111", false},
+		{"::ffff:127.0.0.1", true}, {"::ffff:10.0.0.1", true}, {"::ffff:198.18.0.1", true}, {"::ffff:8.8.8.8", false},
+	}
+	for _, tc := range explicit {
+		if got := isReservedOrPrivate(netip.MustParseAddr(tc.ip)); got != tc.want {
+			t.Errorf("isReservedOrPrivate(%s) = %v, want %v", tc.ip, got, tc.want)
+		}
+	}
+	if !isReservedOrPrivate(netip.Addr{}) {
+		t.Error("invalid addr must fail closed")
+	}
+}
+
+func TestIsReservedOrPrivateIgnoresZone(t *testing.T) {
+	for _, s := range []string{"fe80::1%eth0", "fe80::1%1", "fe80::1", "fc00::1%eth0"} {
+		if !isReservedOrPrivate(netip.MustParseAddr(s)) {
+			t.Errorf("%s should be non-public", s)
+		}
+	}
+	for _, s := range []string{"2606:4700:4700::1111%eth0", "2606:4700:4700::1111%2"} {
+		a := netip.MustParseAddr(s)
+		if isReservedOrPrivate(a) != isReservedOrPrivate(a.WithZone("")) || isReservedOrPrivate(a) {
+			t.Errorf("%s should classify as its unzoned public form", s)
+		}
+	}
+}