clawbot
3cfcda0730
check / check (push) Failing after 1s
Adds the blocked_networks config key: a list of CIDRs, parsed with net/netip, that is added to the built-in list of address ranges the fetcher refuses to contact and can never remove an entry from it. An invalid CIDR aborts startup naming the key and the value. The built-in list gains CGNAT 100.64.0.0/10, IETF protocol assignments 192.0.0.0/24, benchmark 198.18.0.0/15 and NAT64 64:ff9b::/96. Resolved addresses are unmapped before matching, so IPv4-mapped IPv6 forms are caught too. Enforcement stays in the dial-time re-resolution, which is what closes the DNS rebinding window. What a reader would trip over: 192.0.0.0/24 is now blocked but TEST-NET-1 (192.0.2.0/24), which the Fetch tests use as a public upstream, is a different range and stays dialable. The package-level dialer enforces the built-in ranges only; operator entries are applied by the fetcher. Disclosure: one nolint:gochecknoglobals on the immutable built-in prefix list. Model: opus-4-8 (implementation, review); fable-5-1 (landing message)
91 lines
2.2 KiB
Go
91 lines
2.2 KiB
Go
package config
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
// TestBlockedNetworksParsed loads a valid blocked_networks list and checks
|
|
// each CIDR is parsed into the resolved prefixes in order.
|
|
func TestBlockedNetworksParsed(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
yamlContent := signingKeyLine + `blocked_networks:
|
|
- 203.0.113.0/24
|
|
- 2001:db8::/32
|
|
`
|
|
|
|
c, err := configFromYAML(t, yamlContent)
|
|
if err != nil {
|
|
t.Fatalf("valid blocked_networks should load, got error: %v", err)
|
|
}
|
|
|
|
want := []string{"203.0.113.0/24", "2001:db8::/32"}
|
|
if len(c.BlockedNetworks) != len(want) {
|
|
t.Fatalf("BlockedNetworks = %v, want %d entries", c.BlockedNetworks, len(want))
|
|
}
|
|
|
|
for i, w := range want {
|
|
if got := c.BlockedNetworks[i].String(); got != w {
|
|
t.Errorf("BlockedNetworks[%d] = %q, want %q", i, got, w)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestBlockedNetworksOmittedIsEmpty confirms an omitted key leaves the
|
|
// operator list empty; the built-in defaults still apply in the fetcher.
|
|
func TestBlockedNetworksOmittedIsEmpty(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
c, err := configFromYAML(t, signingKeyLine)
|
|
if err != nil {
|
|
t.Fatalf("minimal config should be valid, got error: %v", err)
|
|
}
|
|
|
|
if len(c.BlockedNetworks) != 0 {
|
|
t.Errorf("BlockedNetworks = %v, want empty", c.BlockedNetworks)
|
|
}
|
|
}
|
|
|
|
// TestBlockedNetworksInvalidAbortsStartup checks that malformed values abort
|
|
// startup with an error naming the key and the offending value.
|
|
func TestBlockedNetworksInvalidAbortsStartup(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
runAbortCases(t, []abortCase{
|
|
{
|
|
name: "not-a-cidr",
|
|
yaml: signingKeyLine + `blocked_networks:
|
|
- not-a-cidr
|
|
`,
|
|
wantErrSubstrings: []string{keyBlockedNetworks, "not-a-cidr"},
|
|
},
|
|
{
|
|
name: "bare-address-without-prefix",
|
|
yaml: signingKeyLine + `blocked_networks:
|
|
- 10.0.0.1
|
|
`,
|
|
wantErrSubstrings: []string{keyBlockedNetworks, "10.0.0.1"},
|
|
},
|
|
{
|
|
name: "empty-entry",
|
|
yaml: signingKeyLine + `blocked_networks:
|
|
- ""
|
|
`,
|
|
wantErrSubstrings: []string{keyBlockedNetworks},
|
|
},
|
|
{
|
|
name: "non-string-entry",
|
|
yaml: signingKeyLine + `blocked_networks:
|
|
- 42
|
|
`,
|
|
wantErrSubstrings: []string{keyBlockedNetworks},
|
|
},
|
|
{
|
|
name: "null-value",
|
|
yaml: signingKeyLine + `blocked_networks:
|
|
`,
|
|
wantErrSubstrings: []string{keyBlockedNetworks, nullValueText},
|
|
},
|
|
})
|
|
}
|