sneak/pixa
1
0
Fork 0
Code Issues 49 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

feat: blocked_networks config and extended SSRF ranges (closes #67) #124

Merged
clawbot merged 2 commits from issue-67-blocked-networks into next 2026-09-22 00:43:27 +02:00
Conversation 2 Commits 2 Files Changed 8
+400 -12
2 Commits
Author SHA1 Message Date
sneak fc720bfeee feat: blocked_networks config and extended SSRF ranges (closes #67)
check / check (push) Successful in 2m28s
Details 
Add a blocked_networks config key: a list of CIDRs parsed with net/netip,
added to (not replacing) the built-in SSRF blocklist. An invalid CIDR
aborts startup naming the key and the offending value.

Extend the built-in blocklist to CGNAT 100.64.0.0/10, IETF protocol
assignments 192.0.0.0/24, benchmark 198.18.0.0/15, and NAT64 64:ff9b::/96,
unmapping IPv4-mapped IPv6 so the IPv4 ranges are caught in both forms.
Enforcement stays in the dial-time re-resolution (dialSSRFSafe), which now
also consults the operator-supplied prefixes, so the DNS-rebinding window
remains closed.

Model: opus-4-8
 2026-09-21 19:11:01 +00:00
sneak a7dfbf4414 test: failing tests for blocked_networks config and extended SSRF ranges 
Table-driven coverage for the CGNAT, IETF-protocol, benchmark, and NAT64
ranges (IPv4, IPv6, and IPv4-mapped forms), an operator-supplied
blocked_networks entry enforced by the dialer, and strict parsing that
aborts startup naming the key and the offending value.

Model: opus-4-8
 2026-09-21 19:10:17 +00:00