thepraandClaude Opus 5.5
ccc3597699
Infrastructure/Http adds the client the roadmap's S3 and S4 ask for: - the connect callback resolves the name itself and refuses loopback, private, link-local, CGNAT, documentation, multicast, ULA, NAT64, 6to4, Teredo and IPv4-mapped/compatible forms, then connects to the vetted address, so DNS rebinding cannot swap it afterwards; - redirects are followed by hand, at most three, each one re-checked; - bodies are capped at 1 MB after decompression, only JSON media types are read, every request has a 15 s budget, and a refused URL is not asked again for five minutes. Actor and WebFinger fetches and inbox deliveries all use it. Test networks can switch on Federation:AllowPrivateNetworks/AllowPlainHttp; startup refuses both in Production. PrivaPub.Tests (xUnit v3) starts with the address table and the fetcher's limits against an in-process peer; build.yml and deploy.yml run it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
87 lines
2.7 KiB
C#
87 lines
2.7 KiB
C#
using System.Net;
|
|
|
|
using PrivaPub.Infrastructure.Http;
|
|
|
|
namespace PrivaPub.Tests.Infrastructure
|
|
{
|
|
public class IpRangeGuardTests
|
|
{
|
|
[Theory]
|
|
[InlineData("1.1.1.1")]
|
|
[InlineData("8.8.8.8")]
|
|
[InlineData("93.184.215.14")]
|
|
[InlineData("172.15.255.255")]
|
|
[InlineData("172.32.0.1")]
|
|
[InlineData("100.63.255.255")]
|
|
[InlineData("100.128.0.0")]
|
|
[InlineData("2a01:4f8::1")]
|
|
[InlineData("2606:4700:4700::1111")]
|
|
[InlineData("::ffff:1.1.1.1")]
|
|
public void Public_addresses_are_allowed(string address) =>
|
|
Assert.True(IpRangeGuard.IsPublic(IPAddress.Parse(address)));
|
|
|
|
[Theory]
|
|
[InlineData("0.0.0.0")]
|
|
[InlineData("10.1.2.3")]
|
|
[InlineData("100.64.0.1")]
|
|
[InlineData("100.127.255.255")]
|
|
[InlineData("127.0.0.1")]
|
|
[InlineData("127.255.255.254")]
|
|
[InlineData("169.254.169.254")]
|
|
[InlineData("172.16.0.1")]
|
|
[InlineData("172.31.255.255")]
|
|
[InlineData("192.0.0.170")]
|
|
[InlineData("192.0.2.1")]
|
|
[InlineData("192.88.99.1")]
|
|
[InlineData("192.168.1.1")]
|
|
[InlineData("198.18.0.1")]
|
|
[InlineData("198.51.100.7")]
|
|
[InlineData("203.0.113.9")]
|
|
[InlineData("224.0.0.251")]
|
|
[InlineData("239.255.255.250")]
|
|
[InlineData("240.0.0.1")]
|
|
[InlineData("255.255.255.255")]
|
|
[InlineData("::")]
|
|
[InlineData("::1")]
|
|
[InlineData("::127.0.0.1")]
|
|
[InlineData("::ffff:127.0.0.1")]
|
|
[InlineData("::ffff:10.0.0.1")]
|
|
[InlineData("::ffff:169.254.169.254")]
|
|
[InlineData("64:ff9b::7f00:1")]
|
|
[InlineData("64:ff9b::808:808")]
|
|
[InlineData("64:ff9b:1::1")]
|
|
[InlineData("100::1")]
|
|
[InlineData("2001::1")]
|
|
[InlineData("2001:0:4136:e378:8000:63bf:3fff:fdd2")]
|
|
[InlineData("2001:db8::1")]
|
|
[InlineData("2001:10::1")]
|
|
[InlineData("2002:7f00:1::1")]
|
|
[InlineData("2002:c0a8:101::1")]
|
|
[InlineData("3fff::1")]
|
|
[InlineData("fc00::1")]
|
|
[InlineData("fd12:3456:789a::1")]
|
|
[InlineData("fe80::1")]
|
|
[InlineData("fec0::1")]
|
|
[InlineData("ff02::1")]
|
|
public void Private_and_special_addresses_are_refused(string address) =>
|
|
Assert.False(IpRangeGuard.IsPublic(IPAddress.Parse(address)));
|
|
|
|
[Fact]
|
|
public async Task Connect_refuses_a_name_that_resolves_to_loopback()
|
|
{
|
|
await Assert.ThrowsAsync<BlockedDestinationException>(async () =>
|
|
await SafeHttpHandlerFactory.Connect(new DnsEndPoint("localhost", 443), allowPrivateNetworks: false, TestContext.Current.CancellationToken));
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("127.0.0.1")]
|
|
[InlineData("[::1]")]
|
|
[InlineData("169.254.169.254")]
|
|
public async Task Connect_refuses_a_private_literal(string host)
|
|
{
|
|
await Assert.ThrowsAsync<BlockedDestinationException>(async () =>
|
|
await SafeHttpHandlerFactory.Connect(new DnsEndPoint(host, 443), allowPrivateNetworks: false, TestContext.Current.CancellationToken));
|
|
}
|
|
}
|
|
}
|