summercms/.planning/phases/06-http-routing-auth-groups-and-rate-limiting/06-13-SUMMARY.md

phase, plan, subsystem, tags, requires, provides, affects, key-files, decisions, metrics, requirements

phase	plan	subsystem	tags	requires	provides	affects	key-files	decisions	metrics	requirements
06-http-routing-auth-groups-and-rate-limiting	13	fetchguard	ssrf security http-07		full IANA special-use non-public IP classification zoned IPv6 rejection at dial time	fetchguard	modified fetchguard/ip.go fetchguard/fetch.go fetchguard/ip_test.go fetchguard/fetch_test.go	Zoned IPv6 dial targets are rejected outright with private_ip; classifier also strips zones so results match the unzoned form	tasks completed 2 2026-09-21	HTTP-07

Phase 6 Plan 13: fetchguard SSRF gap closure Summary

Full IANA special-use IPv4/IPv6 prefix tables (incl. 198.18.0.0/15, 192.0.0.0/24, 240.0.0.0/4, ::/96, 2001::/23, 2001:db8::/32, 3fff::/20, fec0::/10, ff00::/8) plus zone-stripping in the classifier and outright rejection of zoned dial targets.

Tasks

1. Extended privateV4/privateV6 and zone-stripping in isReservedOrPrivate; NAT64/6to4 recursion untouched. Commit b1079ab.
2. dialControl returns errPrivateIP for zoned addresses before classification; smoke tests added. Commit b1079ab (single code commit, both tasks touch one fix).

Deviations from Plan

None. Both tasks were committed together in one code commit.

Verification

go vet ./... and go test ./... -short green; fetchguard also green under -race.

Self-Check: PASSED