37 lines
1.4 KiB
Markdown
37 lines
1.4 KiB
Markdown
---
|
|
phase: 06-http-routing-auth-groups-and-rate-limiting
|
|
plan: 13
|
|
subsystem: fetchguard
|
|
tags: [ssrf, security, http-07]
|
|
requires: []
|
|
provides: [full IANA special-use non-public IP classification, zoned IPv6 rejection at dial time]
|
|
affects: [fetchguard]
|
|
key-files:
|
|
modified: [fetchguard/ip.go, fetchguard/fetch.go, fetchguard/ip_test.go, fetchguard/fetch_test.go]
|
|
decisions:
|
|
- "Zoned IPv6 dial targets are rejected outright with private_ip; classifier also strips zones so results match the unzoned form"
|
|
metrics:
|
|
tasks: 2
|
|
completed: 2026-09-21
|
|
requirements: [HTTP-07]
|
|
---
|
|
|
|
# Phase 6 Plan 13: fetchguard SSRF gap closure Summary
|
|
|
|
Full IANA special-use IPv4/IPv6 prefix tables (incl. 198.18.0.0/15, 192.0.0.0/24, 240.0.0.0/4, ::/96, 2001::/23, 2001:db8::/32, 3fff::/20, fec0::/10, ff00::/8) plus zone-stripping in the classifier and outright rejection of zoned dial targets.
|
|
|
|
## Tasks
|
|
|
|
1. Extended privateV4/privateV6 and zone-stripping in `isReservedOrPrivate`; NAT64/6to4 recursion untouched. Commit b1079ab.
|
|
2. `dialControl` returns errPrivateIP for zoned addresses before classification; smoke tests added. Commit b1079ab (single code commit, both tasks touch one fix).
|
|
|
|
## Deviations from Plan
|
|
|
|
None. Both tasks were committed together in one code commit.
|
|
|
|
## Verification
|
|
|
|
`go vet ./...` and `go test ./... -short` green; fetchguard also green under `-race`.
|
|
|
|
## Self-Check: PASSED
|