test: failing tests for blocked_networks config and extended SSRF ranges

Table-driven coverage for the CGNAT, IETF-protocol, benchmark, and NAT64 ranges (IPv4, IPv6, and IPv4-mapped forms), an operator-supplied blocked_networks entry enforced by the dialer, and strict parsing that aborts startup naming the key and the offending value. Model: opus-4-8
2026-09-21 19:10:17 +00:00
parent 37d49ade11
commit a7dfbf4414
2 changed files with 201 additions and 0 deletions
@@ -0,0 +1,90 @@
+package config
+
+import (
+	"testing"
+)
+
+// TestBlockedNetworksParsed loads a valid blocked_networks list and checks
+// each CIDR is parsed into the resolved prefixes in order.
+func TestBlockedNetworksParsed(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := signingKeyLine + `blocked_networks:
+  - 203.0.113.0/24
+  - 2001:db8::/32
+`
+
+	c, err := configFromYAML(t, yamlContent)
+	if err != nil {
+		t.Fatalf("valid blocked_networks should load, got error: %v", err)
+	}
+
+	want := []string{"203.0.113.0/24", "2001:db8::/32"}
+	if len(c.BlockedNetworks) != len(want) {
+		t.Fatalf("BlockedNetworks = %v, want %d entries", c.BlockedNetworks, len(want))
+	}
+
+	for i, w := range want {
+		if got := c.BlockedNetworks[i].String(); got != w {
+			t.Errorf("BlockedNetworks[%d] = %q, want %q", i, got, w)
+		}
+	}
+}
+
+// TestBlockedNetworksOmittedIsEmpty confirms an omitted key leaves the
+// operator list empty; the built-in defaults still apply in the fetcher.
+func TestBlockedNetworksOmittedIsEmpty(t *testing.T) {
+	t.Parallel()
+
+	c, err := configFromYAML(t, signingKeyLine)
+	if err != nil {
+		t.Fatalf("minimal config should be valid, got error: %v", err)
+	}
+
+	if len(c.BlockedNetworks) != 0 {
+		t.Errorf("BlockedNetworks = %v, want empty", c.BlockedNetworks)
+	}
+}
+
+// TestBlockedNetworksInvalidAbortsStartup checks that malformed values abort
+// startup with an error naming the key and the offending value.
+func TestBlockedNetworksInvalidAbortsStartup(t *testing.T) {
+	t.Parallel()
+
+	runAbortCases(t, []abortCase{
+		{
+			name: "not-a-cidr",
+			yaml: signingKeyLine + `blocked_networks:
+  - not-a-cidr
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks, "not-a-cidr"},
+		},
+		{
+			name: "bare-address-without-prefix",
+			yaml: signingKeyLine + `blocked_networks:
+  - 10.0.0.1
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks, "10.0.0.1"},
+		},
+		{
+			name: "empty-entry",
+			yaml: signingKeyLine + `blocked_networks:
+  - ""
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks},
+		},
+		{
+			name: "non-string-entry",
+			yaml: signingKeyLine + `blocked_networks:
+  - 42
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks},
+		},
+		{
+			name: "null-value",
+			yaml: signingKeyLine + `blocked_networks:
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks, nullValueText},
+		},
+	})
+}