Jakub Zych
e50e2dd632
test(06-14): fetchguard IANA boundary and zoned dial tests, surf edge coverage
2026-09-21 19:48:06 +02:00
Jakub Zych
b1079ab8a4
fix(06-13): full IANA special-use SSRF tables and reject zoned dial targets
2026-09-21 19:44:51 +02:00
Jakub Zych
99fa932d43
fix(06-08): classify IPv6 transition addresses
...
- Decode embedded IPv4 from NAT64 well-known and local-use prefixes
- Reapply private and reserved IPv4 policy to 6to4 destinations
- Fail closed on malformed RFC 6052 local-use encodings
2026-09-20 18:14:12 +02:00
Jakub Zych
1cd76fcd95
test(06-08): add failing transition address regressions
...
- Cover private and public IPv4 embeddings across NAT64 and 6to4
- Exercise unsafe transition literals through the production dial control
- Require classifier-owned IPv4-mapped normalization
2026-09-20 17:15:57 +02:00
Jakub Zych
98dd09847a
test(06-05): close framework coverage gaps in bouncer, surf, wire, fetchguard
...
- Registry neither-interface, nil-registry, and authenticate default
- MemoryStore sweep actually drops expired entries
- RegisterHouseMiddlewareFactory duplicate-name failure
- pathScopedCORS unmatched path plus empty-raw-group introspection
- Time UnmarshalJSON +00:00/Z and PublicOnlyMode host/IP cases
2026-09-19 21:08:04 +02:00
Jakub Zych
7923fe86c7
feat(06-04): implement dial-time SSRF-guarded Fetch
...
- AllowHosts exact/dotted-suffix and PublicOnly modes, https-only
- Private/reserved IP check at net.Dialer.Control, no redirects
- Streaming io.LimitReader byte cap and typed failure reasons
2026-09-19 19:02:12 +02:00
Jakub Zych
bae9de8788
test(06-04): add failing tests for SSRF-guarded Fetch
...
- Cover host allow-list, dotted-suffix bypass, dial-time private IP
- Cover no-follow redirects, streaming byte cap, and D-14 config defaults
2026-09-19 19:00:01 +02:00
Jakub Zych
d3630e7de0
feat(06-04): implement private/reserved IP classification table
...
- Port PHP PRIVATE_V4_CIDRS and PRIVATE_V6_PREFIXES onto netip.Prefix
- Fail closed on invalid addresses; Unmap remains the caller's job
2026-09-19 18:57:44 +02:00
Jakub Zych
f7e7ca7fa3
test(06-04): add failing test for private/reserved IP table
...
- Table-driven cases port PHP PRIVATE_V4_CIDRS/PRIVATE_V6_PREFIXES
- Document Unmap() as the caller responsibility for v4-mapped literals
2026-09-19 18:57:18 +02:00
