camada 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66753d06b68709a8360519bc64f67cc2278112b804da0d83bebfbe74ab211ae6
-  data.tar.gz: fc1423d70058d49223d3a3462d882fc6898013266c130d4be2835bb5696e9f5b
+  metadata.gz: 67d03ce5257d9e94c2b52c35d9c612077918e82dbb1ccd81de6399300368773d
+  data.tar.gz: 867e0652bc76b81a367b679b16e52ffa8e8e1248307d0e435d74197224433980
 SHA512:
-  metadata.gz: 94a9c22c64a0f100c47c6312bc81cd9d4cf0b38a73d30f901a7951815b42b9f111d617f69acd2fa5541945b9626a4259c9ad39e5a2021fd7c8a6a03d38d30809
-  data.tar.gz: 07d7bfc337bc64e69781e507efcd1269acbd79e626608e27631aec91004a4de820ad80bc5ba3fbe02d3192005a8f1278fd7825a66df31ea6b7063f87c13c5f9a
+  metadata.gz: 61724d07eb1e27c2709f5f56c5e13e82497a1c21896dc57dc434c09b26a40bdc74f7485151b6d4e692dc3c71fae3f6d1ec03ca003fd57877e2b7ca08dd4ff8da
+  data.tar.gz: 3236651e617c201a84d7c68d17c267f564f3ec2519fbe9b20359ff354efa2619bffc891eab86af36205aa2ac5e787ddd9382bd61a52bdd6d2a94521328825508

data/README.md

@@ -72,6 +72,23 @@ use Camada::Rack, engine
    header on its own is never the ip: any caller can set it. **Never `request.ip`**:
    `Rack::Request#ip` trusts `X-Forwarded-For` from anyone, which is exactly the spoof camada
    refuses; the middleware reads `env["REMOTE_ADDR"]` and applies your trusted-proxy rules itself.
+   Entries may carry a port (`ip:port`, `[v6]:port`, as Azure Application Gateway writes them) or
+   the `::ffff:a.b.c.d` form, and are trimmed of spaces and tabs only. The resolved ip is always a
+   valid address or none. Under `cidrs` (and the dashboard's Cloudflare option, stored as `cidrs`)
+   the socket peer must itself be one of the trusted ranges or a loopback address (a local front end
+   or sidecar); otherwise the peer is the client and `X-Forwarded-For` is ignored, so a direct hit on
+   your origin cannot pick its own ip. A `REMOTE_ADDR` that is not an ip (a socket path, `ip:port`)
+   could not be read: the ip is then none and `X-Forwarded-For` is never walked. Only an empty or
+   absent `REMOTE_ADDR` (Puma or Unicorn bound to a unix socket path) means no peer: the walk then
+   runs over `X-Forwarded-For` alone and trusts your network edge, so the app must not be reachable
+   around it.
+
+   **Servers that rewrite the peer from a forwarded header.** camada needs the real socket peer in
+   `REMOTE_ADDR`. Puma's `set_remote_address header: "X-Forwarded-For"` replaces it with the leftmost
+   `X-Forwarded-For` entry, which the client wrote. camada then takes that forged value as the peer,
+   and so as the client ip. Leave Puma's default (`set_remote_address :socket`, the real peer) and
+   declare your proxy as camada's trusted proxy instead. A Rack middleware that rewrites
+   `REMOTE_ADDR` must sit inside camada (after it in the stack), so camada reads the address first.
 3. Enforces before anything else, beacon endpoints included: your ordered custom rules first (first
    match wins; they read ip, path, user-agent and request headers), then allow → block → challenge.
    A block answers `403 Forbidden` with `x-block-reason`, `x-block-version` and, when a rule
@@ -79,13 +96,16 @@ use Camada::Rack, engine
    `wrn`; a `skip` rule passes with nothing stamped. Cold (no snapshot yet) passes: fail open.
 4. Challenge: a `challenge` verdict gets the self-contained proof-of-work page (or 403 JSON for a
    non-HTML request); `POST /__camada/challenge` verifies the solution, sets `_cch` (bound to the
-   ip, one hour) and 302s back. A request whose ip cannot be resolved is never challenged.
+   ip, one hour) and 302s back. A request whose ip cannot be resolved is never challenged. The page
+   carries its own `Content-Security-Policy` (its inline solver and style by hash, nothing else)
+   and replaces any policy your app set on it (Rails' `content_security_policy`,
+   `secure_headers`), so a strict site CSP cannot block it.
 5. Serves the beacon: `GET /_cam/b.js` (the `@camada/browser` build, vendored) and `POST /_cam/fp`
    (≤ 32 KB, relayed onto the event batch as a `sig: 1` row with the ip camada resolved). Both
    fall through to your app when the tenant switched the beacon off.
 6. Runs your app with `x-rid` (the rid of the request's event row; never on a 101 handshake) and
    the `_sfp` session cookie on its response, and when the server closes the response body ships
-   one redacted event: method, host, path, scrubbed query, status, latency, header
+   one redacted event: method, host, path, scrubbed query (and `Referer` query and fragment), status, latency, header
    names/sizes/order, the auth scheme (never the credential), cookie count (never values), the
    matched route pattern when the framework names it (`sinatra.route`, Rails' `route_uri_pattern`). An exception in your app ships as `st: 500` and propagates unchanged.
 

data/lib/camada/beacon_js.rb

@@ -4,7 +4,7 @@
 # dist/auto.global.js) vendored as a String literal: served at /_cam/b.js with no runtime file
 # read. spec/beacon_js_spec.rb pins it to the sibling build byte for byte.
 module Camada
-  BEACON_VERSION = "0.3.0"
-  BEACON_SHA256 = "0abf522f9d0004ae798ba22fec74e935f545f787847574c4800662d00d522e95"
-  BEACON_JS = "\"use strict\";(()=>{var k=\"0.3.0\";var _=\"@camada/browser\";var b=`${_}/${k}`;function n(t){try{return t()}catch{return null}}function x(t){let e=2166136261;for(let i=0;i<t.length;i++)e^=t.charCodeAt(i),e=Math.imul(e,16777619);return(e>>>0).toString(16)}function M(){let t=document.createElement(\"canvas\");t.width=240,t.height=60;let e=t.getContext(\"2d\");return e?(e.textBaseline=\"alphabetic\",e.fillStyle=\"#f60\",e.fillRect(120,5,60,20),e.fillStyle=\"#069\",e.font=\"15px Arial\",e.fillText(\"Sfp\\u2603 1.0\",2,15),e.fillStyle=\"rgba(102,204,0,0.7)\",e.font=\"17px Times\",e.fillText(\"Sfp\\u2603 1.0\",4,45),x(t.toDataURL())):null}function R(){let t=document.createElement(\"canvas\"),e=t.getContext(\"webgl\")||t.getContext(\"experimental-webgl\");if(!e)return null;let i=e.getExtension(\"WEBGL_debug_renderer_info\");return{v:i?e.getParameter(i.UNMASKED_VENDOR_WEBGL):e.getParameter(e.VENDOR),r:i?e.getParameter(i.UNMASKED_RENDERER_WEBGL):e.getParameter(e.RENDERER)}}function S(){return x([Math.tan(-1e300),Math.sinh(1),Math.expm1(1),Math.cbrt(100),Math.log1p(10),Math.atanh(.5)].join(\"|\"))}var N=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom/,L=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom|^_phantom/;function j(){let t=document,e=navigator,i=window,o=0;for(let s in t)N.test(s)&&o++;for(let s in i)L.test(s)&&o++;return{wd:e.webdriver===!0?1:0,cdc:o,chrome:typeof i.chrome<\"u\"?1:0,plugins:e.plugins?e.plugins.length:-1,langs:e.languages?e.languages.length:-1,outer:window.outerWidth===0&&window.outerHeight===0?1:0,perm:n(()=>Notification.permission),pdf:typeof e.pdfViewerEnabled==\"boolean\"?e.pdfViewerEnabled?1:0:-1,err:n(()=>{try{null.x}catch(s){let c=s.stack;return c?c.split(`\n`).length:0}})}}function T({endpoint:t,rid:e}){let i=e||null,o=performance.now(),s=0,c=0,m=0,h=0,f=0,u=null;function l(){u===null&&(u=Math.round(performance.now()-o))}addEventListener(\"mousemove\",()=>{s++,l()},{passive:!0}),addEventListener(\"scroll\",()=>{c++,l()},{passive:!0}),addEventListener(\"keydown\",()=>{m++,l()},{passive:!0}),addEventListener(\"touchstart\",()=>{h++,l()},{passive:!0}),addEventListener(\"click\",()=>{f++,l()},{passive:!0});function w(){let r=navigator,a=n(()=>performance.getEntriesByType(\"navigation\")[0]),D=n(()=>{let p=performance.getEntriesByType(\"paint\");return p.length?Math.round(p[p.length-1].startTime):null}),d=n(()=>r.connection)||{};return{sdk:b,rid:i,ts:Date.now(),scr:n(()=>[screen.width,screen.height,screen.availWidth,screen.availHeight,screen.colorDepth]),win:n(()=>[window.innerWidth,window.innerHeight,window.outerWidth,window.outerHeight]),dpr:n(()=>window.devicePixelRatio),tz:n(()=>Intl.DateTimeFormat().resolvedOptions().timeZone),tzo:n(()=>new Date().getTimezoneOffset()),lang:n(()=>r.language),langs:n(()=>r.languages?Array.prototype.slice.call(r.languages,0,5):null),plat:n(()=>r.platform),cores:n(()=>r.hardwareConcurrency),mem:n(()=>r.deviceMemory),touch:n(()=>r.maxTouchPoints),ua:n(()=>r.userAgent),dnt:n(()=>r.doNotTrack),cookies:n(()=>r.cookieEnabled?1:0),conn:n(()=>[d.effectiveType,d.rtt,d.downlink,d.saveData?1:0]),gl:n(R),cv:n(M),mf:n(S),auto:n(j),vis:n(()=>document.visibilityState),focus:n(()=>document.hasFocus()?1:0),timing:a?[Math.round(a.domContentLoadedEventEnd),Math.round(a.loadEventEnd),Math.round(a.responseEnd-a.requestStart)]:null,paint:D,input:{moves:s,scrolls:c,keys:m,touches:h,clicks:f,first:u,at:Math.round(performance.now()-o)}}}function v(r){let a=JSON.stringify(r?Object.assign(w(),{hi:r}):w());navigator.sendBeacon&&navigator.sendBeacon(t,new Blob([a],{type:\"application/json\"}))||fetch(t,{method:\"POST\",body:a,keepalive:!0,headers:{\"content-type\":\"application/json\"}}).catch(()=>{})}let g=navigator.userAgentData,E=g&&g.getHighEntropyValues?g.getHighEntropyValues([\"architecture\",\"bitness\",\"model\",\"platformVersion\",\"fullVersionList\"]).catch(()=>null):Promise.resolve(null);setTimeout(()=>{E.then(v)},2e3),addEventListener(\"pagehide\",()=>{E.then(r=>{v(r)})},{once:!0})}function O(t){let e=new URL(t,\"http://_\"),i=e.pathname.split(\"/\");return i[i.length-1]=\"fp\",{endpoint:i.join(\"/\"),rid:e.searchParams.get(\"r\")}}(function(){try{let t=document.currentScript,e=t&&t.src;if(!e)return;let{endpoint:i,rid:o}=O(e);T({endpoint:i,rid:o})}catch{}})();})();\n"
+  BEACON_VERSION = "0.3.2"
+  BEACON_SHA256 = "3a9d99002ad5bae090043b26646378287f179cc1f1fd65934ebd00e9d1fd05cf"
+  BEACON_JS = "\"use strict\";(()=>{var k=\"0.3.2\";var _=\"@camada/browser\";var b=`${_}/${k}`;function t(n){try{return n()}catch{return null}}function x(n){let e=2166136261;for(let i=0;i<n.length;i++)e^=n.charCodeAt(i),e=Math.imul(e,16777619);return(e>>>0).toString(16)}function M(){let n=document.createElement(\"canvas\");n.width=240,n.height=60;let e=n.getContext(\"2d\");return e?(e.textBaseline=\"alphabetic\",e.fillStyle=\"#f60\",e.fillRect(120,5,60,20),e.fillStyle=\"#069\",e.font=\"15px Arial\",e.fillText(\"Sfp\\u2603 1.0\",2,15),e.fillStyle=\"rgba(102,204,0,0.7)\",e.font=\"17px Times\",e.fillText(\"Sfp\\u2603 1.0\",4,45),x(n.toDataURL())):null}function R(){let n=document.createElement(\"canvas\"),e=n.getContext(\"webgl\")||n.getContext(\"experimental-webgl\");if(!e)return null;let i=e.getExtension(\"WEBGL_debug_renderer_info\");return{v:i?e.getParameter(i.UNMASKED_VENDOR_WEBGL):e.getParameter(e.VENDOR),r:i?e.getParameter(i.UNMASKED_RENDERER_WEBGL):e.getParameter(e.RENDERER)}}function S(){return x([Math.tan(-1e300),Math.sinh(1),Math.expm1(1),Math.cbrt(100),Math.log1p(10),Math.atanh(.5)].join(\"|\"))}var N=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom/,L=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom|^_phantom/;function j(){let n=document,e=navigator,i=window,o=0;for(let s in n)N.test(s)&&o++;for(let s in i)L.test(s)&&o++;return{wd:e.webdriver===!0?1:0,cdc:o,chrome:typeof i.chrome<\"u\"?1:0,plugins:e.plugins?e.plugins.length:-1,langs:e.languages?e.languages.length:-1,outer:window.outerWidth===0&&window.outerHeight===0?1:0,perm:t(()=>Notification.permission),pdf:typeof e.pdfViewerEnabled==\"boolean\"?e.pdfViewerEnabled?1:0:-1,err:t(()=>{try{null.x}catch(s){let c=s.stack;return c?c.split(`\n`).length:0}})}}function T({endpoint:n,rid:e}){let i=e||null,o=performance.now(),s=0,c=0,m=0,f=0,h=0,u=null;function l(){u===null&&(u=Math.round(performance.now()-o))}addEventListener(\"mousemove\",()=>{s++,l()},{passive:!0}),addEventListener(\"scroll\",()=>{c++,l()},{passive:!0}),addEventListener(\"keydown\",()=>{m++,l()},{passive:!0}),addEventListener(\"touchstart\",()=>{f++,l()},{passive:!0}),addEventListener(\"click\",()=>{h++,l()},{passive:!0});function w(){let r=navigator,a=t(()=>performance.getEntriesByType(\"navigation\")[0]),D=t(()=>{let p=performance.getEntriesByType(\"paint\");return p.length?Math.round(p[p.length-1].startTime):null}),d=t(()=>r.connection)||{};return{sdk:b,rid:i,ts:Date.now(),scr:t(()=>[screen.width,screen.height,screen.availWidth,screen.availHeight,screen.colorDepth]),win:t(()=>[window.innerWidth,window.innerHeight,window.outerWidth,window.outerHeight]),dpr:t(()=>window.devicePixelRatio),tz:t(()=>Intl.DateTimeFormat().resolvedOptions().timeZone),tzo:t(()=>new Date().getTimezoneOffset()),lang:t(()=>r.language),langs:t(()=>r.languages?Array.prototype.slice.call(r.languages,0,5):null),plat:t(()=>r.platform),cores:t(()=>r.hardwareConcurrency),mem:t(()=>r.deviceMemory),touch:t(()=>r.maxTouchPoints),ua:t(()=>r.userAgent),dnt:t(()=>r.doNotTrack),cookies:t(()=>r.cookieEnabled?1:0),conn:t(()=>[d.effectiveType,d.rtt,d.downlink,d.saveData?1:0]),gl:t(R),cv:t(M),mf:t(S),auto:t(j),vis:t(()=>document.visibilityState),focus:t(()=>document.hasFocus()?1:0),timing:a?[Math.round(a.domContentLoadedEventEnd),Math.round(a.loadEventEnd),Math.round(a.responseEnd-a.requestStart)]:null,paint:D,input:{moves:s,scrolls:c,keys:m,touches:f,clicks:h,first:u,at:Math.round(performance.now()-o)}}}function v(r){let a=JSON.stringify(r?Object.assign(w(),{hi:r}):w());navigator.sendBeacon&&navigator.sendBeacon(n,new Blob([a],{type:\"application/json\"}))||fetch(n,{method:\"POST\",body:a,keepalive:!0,headers:{\"content-type\":\"application/json\"}}).catch(()=>{})}let g=navigator.userAgentData,E=g&&g.getHighEntropyValues?g.getHighEntropyValues([\"architecture\",\"bitness\",\"model\",\"platformVersion\",\"fullVersionList\"]).catch(()=>null):Promise.resolve(null);setTimeout(()=>{E.then(v)},2e3),addEventListener(\"pagehide\",()=>{E.then(r=>{v(r)})},{once:!0})}function O(n){let e=new URL(n,\"http://_\"),i=e.pathname.split(\"/\");return i[i.length-1]=\"fp\",{endpoint:i.join(\"/\"),rid:e.searchParams.get(\"r\")}}(function(){try{let n=document.currentScript,e=n&&n.src;if(!e)return;let{endpoint:i,rid:o}=O(e);T({endpoint:i,rid:o})}catch{}})();})();\n"
 end

data/lib/camada/challenge/format.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "json"
 require "openssl"
 
 module Camada
@@ -83,9 +82,6 @@ module Camada
       s.gsub("&", "&amp;").gsub("<", "&lt;").gsub(">", "&gt;").gsub('"', "&quot;").gsub("'", "&#39;")
     end
 
-    # Safe to drop inside an inline <script>: `<` is escaped so no value can close the element early.
-    def self.escape_script(s) = JSON.generate(s).gsub("<", "\\u003c")
-
     # application/x-www-form-urlencoded, last value wins. Never raises on junk: an invalid
     # %-escape is kept as is, invalid UTF-8 is replaced.
     def self.parse_form_body(body)

data/lib/camada/challenge/page.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "openssl"
 require_relative "format"
 
 module Camada
@@ -13,6 +14,11 @@ module Camada
     #
     # The page carries its own SHA-256 rather than calling crypto.subtle: subtle is undefined on
     # non-secure origins (plain http on a LAN host), and 65k awaited digests would be slow anyway.
+    #
+    # CSP (camada-all-y38o, core's mwpo): the inline script and style depend on `bits` alone (the solver reads the
+    # nonce from the form), so their hashes are fixed per difficulty and challenge_page_csp(bits) can allow exactly
+    # them. The engine sends that policy with the page and the Rack middleware replaces any policy the app set on a
+    # served challenge, so a strict app CSP (Rails' content_security_policy, secure_headers) cannot block the solver.
 
     # FIPS 180-4 round constants (cube roots of the first 64 primes).
     K = "0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5," \
@@ -66,6 +72,25 @@ module Camada
       "@keyframes camada-slide{0%{transform:translateX(-120%)}100%{transform:translateX(400%)}}\n"
     ].join.freeze
 
+    # The page's one inline script. Depends on `bits` only: the nonce comes from the form.
+    def self.solver_script(bits)
+      [
+        SOLVER, "\n",
+        "(function(){\n",
+        "  if(typeof window==='undefined'||window.__camadaAutostart===false)return;\n",
+        "  var nonce=document.getElementById('camada-n').value,shift=#{32 - bits};\n",
+        "  function go(){\n",
+        "    for(var n=0;n<5000000;n++){\n",
+        "      if((__camadaSha256Words(nonce+'.'+n)[0]>>>shift)===0){\n",
+        "        document.getElementById('camada-s').value=String(n);\n",
+        "        document.getElementById('camada-f').submit();\n",
+        "        return}}\n",
+        "    document.getElementById('camada-msg').textContent='Could not complete the check. Please reload.'}\n",
+        "  setTimeout(go,30);\n",
+        "})();\n"
+      ].join
+    end
+
     # `action` is the verify endpoint path; `to` has already been through safe_return_to.
     def self.challenge_page(nonce:, action:, to:, bits: POW_BITS)
       bits = bits.clamp(1, 32) # shift 32-bits must stay in range
@@ -82,26 +107,27 @@ module Camada
         "<div class=\"bar\"><i></i></div>\n",
         "</main>\n",
         "<form id=\"camada-f\" method=\"POST\" action=\"#{escape_attr(action)}\">\n",
-        "<input type=\"hidden\" name=\"nonce\" value=\"#{escape_attr(nonce)}\">\n",
+        "<input type=\"hidden\" name=\"nonce\" value=\"#{escape_attr(nonce)}\" id=\"camada-n\">\n",
         "<input type=\"hidden\" name=\"solution\" id=\"camada-s\">\n",
         "<input type=\"hidden\" name=\"to\" value=\"#{escape_attr(to)}\">\n",
         "</form>\n",
-        "<script>#{SOLVER}\n",
-        "(function(){\n",
-        "  if(typeof window==='undefined'||window.__camadaAutostart===false)return;\n",
-        "  var nonce=#{escape_script(nonce)},shift=#{32 - bits};\n",
-        "  function go(){\n",
-        "    for(var n=0;n<5000000;n++){\n",
-        "      if((__camadaSha256Words(nonce+'.'+n)[0]>>>shift)===0){\n",
-        "        document.getElementById('camada-s').value=String(n);\n",
-        "        document.getElementById('camada-f').submit();\n",
-        "        return}}\n",
-        "    document.getElementById('camada-msg').textContent='Could not complete the check. Please reload.'}\n",
-        "  setTimeout(go,30);\n",
-        "})();\n",
-        "</script>\n",
+        "<script>#{solver_script(bits)}</script>\n",
         "</body></html>"
       ].join
     end
+
+    def self.sha256_src(text) = "'sha256-#{[OpenSSL::Digest::SHA256.digest(text)].pack("m0")}'"
+
+    # The Content-Security-Policy to send with challenge_page(bits:): it allows only the page's own inline script and
+    # style (by 'sha256-...' hash) and nothing else. There is no form-action: browsers apply it to the redirects that
+    # follow the POST too, so an app whose page 302s on to an external sign-in after verify's 302 would be blocked.
+    # Send it as the response's only CSP, removing any Content-Security-Policy or Content-Security-Policy-Report-Only
+    # the app set.
+    def self.challenge_page_csp(bits = POW_BITS)
+      bits = bits.clamp(1, 32)
+      @csp_cache ||= {} # bits -> policy; a racing first fill computes the same string twice, harmlessly
+      @csp_cache[bits] ||= "default-src 'none'; script-src #{sha256_src(solver_script(bits))}; " \
+                           "style-src #{sha256_src("\n#{STYLE}")}; base-uri 'none'; frame-ancestors 'self'"
+    end
   end
 end

data/lib/camada/engine.rb

@@ -212,7 +212,10 @@ module Camada
       # custom rules read the user agent and the request headers (§D3).
       v = @snap.verdict(Snapshot::MatchInput.new(ip: ip, path: req.path, ua: req.header("user-agent"), header: ->(n) { req.header(n) }))
       if v.block
-        headers = { "content-type" => "text/plain", "x-block-reason" => v.reason || "", "x-block-version" => v.version || "" }
+        headers = {
+          "content-type" => "text/plain", "cache-control" => "no-store", # per-visitor: no shared cache keeps it (camada-all-8lp6)
+          "x-block-reason" => v.reason || "", "x-block-version" => v.version || ""
+        }
         headers["x-block-rule"] = v.rule if v.rule # a custom rule blocked: name it, so the customer knows which row to edit
         ev = event(req, SecureRandom.uuid, nil, false, ip)
         ev["st"] = 403       # blocked requests always ship: silent expiry makes blocks oscillate
@@ -308,7 +311,11 @@ module Camada
 
     def page(ip, to)
       html = Challenge.challenge_page(nonce: @kit.nonce(ip, now_ms), action: @challenge_path, to: to)
-      Answer.new(status: 403, headers: CHALLENGE_HEADERS.merge("content-type" => "text/html; charset=utf-8"), body: html)
+      headers = CHALLENGE_HEADERS.merge(
+        "content-type" => "text/html; charset=utf-8",
+        "content-security-policy" => Challenge.challenge_page_csp # only its own inline solver and style (camada-all-y38o)
+      )
+      Answer.new(status: 403, headers: headers, body: html)
     end
 
     # 403 + the proof-of-work page (HTML navigations) or 403 JSON (everything else), plus the

data/lib/camada/events/build.rb

@@ -68,7 +68,8 @@ module Camada
         "chmob" => first["sec-ch-ua-mobile"], "chplat" => first["sec-ch-ua-platform"],
         "acc" => first["accept"], "lang" => first["accept-language"],
         "fs" => first["sec-fetch-site"], "fm" => first["sec-fetch-mode"],
-        "fd" => first["sec-fetch-dest"], "fu" => first["sec-fetch-user"], "ref" => first["referer"], "org" => first["origin"],
+        "fd" => first["sec-fetch-dest"], "fu" => first["sec-fetch-user"],
+        "ref" => Redact.scrub_url(first["referer"]), "org" => first["origin"], # ref: scrubbed like q (camada-all-ijsa)
         "xrw" => first["x-requested-with"], "auth" => auth_scheme(first["authorization"]), # scheme only, never the credential
         "hm" => mask, "hn" => hn, "hb" => hb, "ck" => cookie.empty? ? 0 : cookie.split(";", -1).length,
         "hord" => names.join(",")[0, 2048] # header order as this host reports it (the env's order under Rack)

data/lib/camada/ip.rb

@@ -9,8 +9,72 @@ module Camada
   module Ip
     Cidr = Struct.new(:base4, :base6, :bits) # base4: v4 base or -1; base6: words or nil
 
+    # A plain IPv4 or IPv6 address (C6 v3), by our own grammar, never IPAddr (which accepts zone ids, brackets and
+    # embedded dotted quads). Stricter than IpParse.parse_ip6, which mirrors edge-analyst and must not drift: a single
+    # leading or trailing `:` (`:8:8:8`, `2001:db8::1:`) is rejected here only.
     def self.valid_ip?(s)
-      s.include?(":") ? !IpParse.parse_ip6(s).nil? : IpParse.parse_ip4(s) >= 0
+      return IpParse.parse_ip4(s) >= 0 unless s.include?(":")
+
+      n = s.bytesize
+      return false if n < 2 || (s.getbyte(0) == 58 && s.getbyte(1) != 58) || (s.getbyte(n - 1) == 58 && s.getbyte(n - 2) != 58)
+
+      !IpParse.parse_ip6(s).nil?
+    end
+
+    # `::ffff:a.b.c.d` (any case) -> `a.b.c.d`, only when a valid dotted quad follows; anything else comes back
+    # unchanged (`::ffff:7f00:1` stays an ordinary IPv6 address). C6 v2.
+    def self.unmap(s)
+      return s if s.bytesize < 14 || !s.byteslice(0, 7).casecmp?("::ffff:")
+
+      v4 = s.byteslice(7..)
+      IpParse.parse_ip4(v4) >= 0 ? v4 : s
+    end
+
+    # HTTP optional whitespace only (SP, HTAB), never String#strip (which also removes CR, LF, VT, FF and NUL). C6 v3.
+    def self.trim_ows(s)
+      a = 0
+      b = s.bytesize
+      a += 1 while a < b && (s.getbyte(a) == 32 || s.getbyte(a) == 9)
+      b -= 1 while b > a && (s.getbyte(b - 1) == 32 || s.getbyte(b - 1) == 9)
+      s.byteslice(a, b - a)
+    end
+
+    # Split on `,`, each entry OWS-trimmed, port-stripped and unmapped; empty entries dropped before `hops` counts.
+    def self.entries(xff)
+      xff.split(",", -1).map { |e| unmap(strip_port(trim_ows(e))) }.reject(&:empty?)
+    end
+
+    # A trusted hop: a valid ip inside a configured range. An entry that is not an ip never is (C6 v3).
+    def self.trusted?(ip, cidrs)
+      valid_ip?(ip) && cidrs.any? { |t| in_cidr?(ip, t) }
+    end
+
+    PORT_RE = /\A:[0-9]{1,5}\z/
+
+    # One X-Forwarded-For entry without its port (camada-all-0vho): `[v6]:port` and `[v6]` -> `v6`,
+    # `a.b.c.d:port` -> `a.b.c.d`. A bare IPv6 literal comes back whole (its last group is never a port); anything
+    # else malformed comes back unchanged, so validation still rejects it and the peer wins.
+    def self.strip_port(e)
+      if e.start_with?("[")
+        close = e.index("]")
+        return e if close.nil?
+
+        inner = e[1...close]
+        rest = e[(close + 1)..]
+        return inner.include?(":") && (rest.empty? || PORT_RE.match?(rest)) ? inner : e
+      end
+      return e if e.count(":") != 1 # no colon, or a bare IPv6 literal
+
+      host, port = e.split(":", 2)
+      IpParse.parse_ip4(host) >= 0 && PORT_RE.match?(":#{port}") ? host : e
+    end
+
+    # 127.0.0.0/8 or ::1 (camada-all-yfc6, decision D1), compared by value, never IPAddr#loopback?. The peer's
+    # `::ffff:127.x.x.x` form is already reduced to the dotted quad by unmap; `::ffff:7f00:1` is not loopback.
+    def self.loopback?(ip)
+      return IpParse.parse_ip4(ip) >> 24 == 127 unless ip.include?(":")
+
+      IpParse.parse_ip6(ip) == [0, 0, 0, 1]
     end
 
     def self.parse_cidr(c)
@@ -54,27 +118,53 @@ module Camada
       true
     end
 
-    # The client IP from the socket peer and X-Forwarded-For per the trusted-proxy config.
-    # Anything unresolvable falls back to the peer (fail safe).
+    # The client IP from the socket peer and X-Forwarded-For per the trusted-proxy config. The result is always a
+    # valid ip or nil, in every mode (C6 v3). Anything unresolvable falls back to the peer (fail safe).
+    #
+    # XFF entries are trimmed of SP/HTAB only, read without a port (`ip:port`, `[v6]:port`, as Azure writes them)
+    # and with `::ffff:a.b.c.d` reduced to `a.b.c.d`, in every mode. The peer is unmap(peer) when that is a valid ip,
+    # else nil: a non-empty peer that is not an ip (a socket path, `@`, `ip:port`, a zone id) could not be read, and
+    # the result falls back to nil, never to the XFF walk. The peer is never trimmed or port-stripped.
+    #
+    # `cidrs` (also what the dashboard's Cloudflare option stores) walks the chain `[...xff, peer]` from the right: if
+    # the peer is not a trusted proxy, the request did not come through one and the peer IS the client; XFF is
+    # ignored, since anyone hitting the origin directly can write it. A loopback peer (127.0.0.0/8, ::1,
+    # ::ffff:127.x.x.x) counts as a trusted hop: it is a local front end or sidecar (App Engine's is always
+    # 127.0.0.1), and no remote client can be one. Loopback is trusted only as the peer, never as an XFF entry; an
+    # XFF entry that is not an ip is never a trusted hop. With no peer at all (nil or "": a host that exposes no
+    # socket, or a unix-socket listener whose REMOTE_ADDR is empty) the walk runs over XFF alone: such a host trusts
+    # its network edge to have written XFF, and the app must not be reachable around that edge. `hops` and `vercel`
+    # trust XFF by definition and ignore the peer.
     def self.resolve_client_ip(peer, xff, cfg)
-      sock = peer&.start_with?("::ffff:") ? peer[7..] : peer # dual-stack v4-mapped form
+      ip = resolve(peer.nil? || peer.empty? ? nil : peer.b, xff&.b, cfg) # bytewise: valid ips are ASCII
+      ip&.force_encoding(Encoding::UTF_8)
+    end
+
+    def self.resolve(raw_peer, xff, cfg)
+      mapped = raw_peer && unmap(raw_peer) # dual-stack v4-mapped form
+      sock = mapped && valid_ip?(mapped) ? mapped : nil
       return sock if cfg.nil? || cfg["mode"] == "none" || xff.nil? || xff.empty?
 
-      entries = xff.split(",").map(&:strip).reject(&:empty?)
-      return sock if entries.empty?
+      list = entries(xff)
+      return sock if list.empty?
 
       candidate = nil
       case cfg["mode"]
       when "hops"
         hops = cfg["hops"].to_i
-        candidate = entries[entries.length - hops] if hops.between?(1, entries.length)
+        candidate = list[list.length - hops] if hops.between?(1, list.length)
       when "vercel"
-        candidate = entries.last # Vercel overwrites XFF, so its rightmost entry is trustworthy
+        candidate = list.last # Vercel overwrites XFF, so its rightmost entry is trustworthy
       when "cidrs"
         trusted = (cfg["cidrs"] || []).filter_map { |x| parse_cidr(x.to_s) }
-        candidate = entries.reverse_each.find { |entry| trusted.none? { |t| in_cidr?(entry, t) } }
+        # the peer is the first hop: if it is not a trusted proxy, it is the client. An unreadable peer gives nil,
+        # never the walk; only no peer at all walks.
+        return sock if mapped && (sock.nil? || (!loopback?(sock) && !trusted?(sock, trusted)))
+
+        candidate = list.reverse_each.find { |entry| !trusted?(entry, trusted) }
       end
       candidate && valid_ip?(candidate) ? candidate : sock
     end
+    private_class_method :resolve
   end
 end

data/lib/camada/rack.rb

@@ -127,6 +127,8 @@ module Camada
       sinatra&.to_s&.sub(/\A[A-Z]+ /, "")
     end
 
+    CSP_HEADERS = %w[content-security-policy content-security-policy-report-only].freeze
+
     # `Camada::Rack.new(app)` wires the lazy default from the environment on the first request;
     # `Camada::Rack.new(app, engine)` uses the one you built.
     def initialize(app, engine = nil, **opts)
@@ -166,6 +168,7 @@ module Camada
         raise
       end
       headers = stamp(status, headers, passed)
+      headers = own_challenge_csp(headers) if passed.ctx && passed.ctx["challenged"]
       finish = passed.on_finish
       return [status, headers, body] if finish.nil?
 
@@ -194,6 +197,22 @@ module Camada
       headers
     end
 
+    # A challenge page the app returned (serve_challenge) keeps its own CSP: a policy the app or its middleware put on
+    # that response (Rails' content_security_policy, secure_headers) is dropped and the page's is set, or the solver
+    # would be blocked (camada-all-y38o). Any other response comes back unchanged.
+    # The headers are changed in place, so a Rack::Headers (or any Hash subclass) keeps its class.
+    def own_challenge_csp(headers)
+      value = ->(name) { Array(headers.find { |k, _| k.to_s.downcase == name }&.last).first.to_s }
+      return headers unless value.call("x-camada-challenge") == "1" && value.call("content-type").start_with?("text/html")
+
+      headers.delete_if { |k, _| CSP_HEADERS.include?(k.to_s.downcase) }
+      headers["content-security-policy"] = Challenge.challenge_page_csp
+      headers
+    rescue StandardError => e
+      Guarded.log_rate_limited(e)
+      headers
+    end
+
     def join_cookies(existing, cookie)
       return cookie if existing.nil? || (existing.respond_to?(:empty?) && existing.empty?)
 

data/lib/camada/redact.rb

@@ -9,33 +9,94 @@ module Camada
   # credentials, or raw user identifiers (HMAC-hashed here, inside the SDK, before anything
   # reaches the queue). Ported from @camada/core src/redact.ts.
   module Redact
-    NAME_RE = /(pass(word)?|tok(en)?|secret|key|api[-_]?key|auth|sess(ion)?|sig(nature)?|code|jwt|bearer|credential)/i
-    JWT_RE = /\AeyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/
-    HEX_RE = /\A[a-f0-9]{32,}\z/i
-    B64_RE = %r{\A[A-Za-z0-9+/_-]{40,}={0,2}\z}
+    # Exact patterns of C6 v3, matched bytewise on a binary copy (decoding yields any byte; every pattern is ASCII,
+    # so a byte >= 0x80 never matches). Whole-string anchors are \A...\z (Ruby's ^/$ are line anchors). Ruby's /i
+    # folds Unicode (U+212A Kelvin K matches k), so the name test is the lowercase-A-Z-then-substring form and hex
+    # spells out [a-fA-F0-9].
+    NAME_WORDS = %w[pass tok secret key auth sess sig code jwt bearer credential].freeze
+    JWT_RE = /\AeyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}/n # prefix match: anything may follow
+    HEX_RE = /\A[a-fA-F0-9]{32,}\z/n
+    B64_RE = %r{\A[A-Za-z0-9+/_-]{40,}={0,2}\z}n
+    ESC_RE = /%([0-9a-fA-F]{2})/n
 
     REDACT_ALLOWLIST = %w[plan role locale ab_variant].freeze # additions only, never narrowing
 
     def self.suspect_value?(v)
+      v = v.b
       JWT_RE.match?(v) || HEX_RE.match?(v) || B64_RE.match?(v)
     end
 
-    # Replaces credential-looking query values with ~r, preserving structure and order.
+    # core's NAME_RE (`pass(word)?|tok(en)?|secret|key|api[-_]?key|auth|sess(ion)?|sig(nature)?|code|jwt|bearer|
+    # credential`, unanchored, case-insensitive) in its ASCII-only form.
+    def self.name_hit?(n)
+      lower = n.b.tr("A-Z", "a-z")
+      NAME_WORDS.any? { |w| lower.include?(w) }
+    end
+
+    # Percent-decoding that never raises: bytewise, each `%HH` (ASCII hex) becomes that byte, any other `%` stays,
+    # `+` stays. Up to 4 passes, so double (or triple) encoding cannot hide a name or a nested query; text that still
+    # holds a `%HH` after 4 passes returns nil, which the caller scrubs. The cap keeps a crafted `%252525...` linear.
+    # Only ever used to TEST a part; the output keeps the raw text.
+    def self.decode(s)
+      s = s.b
+      4.times do
+        break unless ESC_RE.match?(s)
+
+        s = s.gsub(ESC_RE) { ::Regexp.last_match(1).hex.chr }
+      end
+      ESC_RE.match?(s) ? nil : s
+    end
+
+    # One `name=value` or bare segment of a decoded nested value (no further decoding, no recursion).
+    def self.cred_segment?(seg)
+      eq = seg.index("=")
+      eq.nil? ? suspect_value?(seg) : name_hit?(seg[0, eq]) || suspect_value?(seg[(eq + 1)..])
+    end
+
+    # A decoded value that carries a nested query (`?`, `&` or `=`) is a credential when any of its `[?&]`-separated
+    # segments is one (C6 v3). `q=a=b` or `q=1' or '1'='1` is not; `next=/r?token=x` is.
+    def self.nested_cred?(d)
+      /[?&=]/n.match?(d) && d.split(/[?&]/n, -1).any? { |seg| cred_segment?(seg) }
+    end
+
+    # Replaces credential-looking query parts with ~r, preserving structure and order (C6 v3). The string is split on
+    # `&`, never URL-parsed. Each part's name and value are percent-decoded (decode) before testing; the output keeps
+    # the raw text. `name=value` -> `name=~r` when the name looks like a credential, the value looks like one, or the
+    # value holds a nested query with a credential segment (replaced whole, so payloads like `q=1' or '1'='1` stay
+    # visible to the scorer). A bare part -> `~r` when it looks like a credential value or holds a credential
+    # segment. Either half still encoded after 4 decode passes counts as a credential.
     def self.scrub_query(query)
       return query || "" if query.nil? || query.length <= 1
 
       lead = query.start_with?("?") ? "?" : ""
       out = (lead.empty? ? query : query[1..]).split("&", -1).map do |p|
         eq = p.index("=")
-        next p if eq.nil?
+        if eq.nil?
+          d = decode(p)
+          next d.nil? || suspect_value?(d) || nested_cred?(d) ? "~r" : p
+        end
 
         name = p[0, eq]
-        value = p[(eq + 1)..]
-        NAME_RE.match?(name) || suspect_value?(value) ? "#{name}=~r" : p
+        dn = decode(name)
+        dv = decode(p[(eq + 1)..])
+        dn.nil? || dv.nil? || name_hit?(dn) || suspect_value?(dv) || nested_cred?(dv) ? "#{name}=~r" : p
       end
       lead + out.join("&")
     end
 
+    # A URL (a Referer) with its query and fragment run through scrub_query (camada-all-ijsa); the scheme, host and
+    # path are kept as they are. The path is left alone on purpose: it gets the same treatment as the request's own
+    # path `p` (none). A same-origin Referer's path already shipped as `p` on that page's own event, and a
+    # cross-origin one carries only the origin under the browsers' default Referrer-Policy.
+    def self.scrub_url(url)
+      return nil if url.nil?
+
+      head, hash, frag = url.partition("#")
+      path, q, query = head.partition("?")
+      scrubbed = q.empty? ? head : path + scrub_query(q + query)
+      hash.empty? ? scrubbed : "#{scrubbed}##{scrub_query(frag)}"
+    end
+
     # Body shape only: field names and byte sizes, never values. One level deep.
     def self.body_shape(obj)
       return nil unless obj.is_a?(Hash)

data/lib/camada/snapshot/match.rb

@@ -97,7 +97,7 @@ module Camada
       def blocked4?(n)
         s = @snap
         b = n >> 8
-        return false if (s.bm4[b >> 5] >> (b & 31)) & 1 == 0
+        return false if (s.bm4[b >> 5] >> (b & 31)).nobits?(1)
 
         hi = n >> 16
         left = s.idx4[hi]
@@ -122,7 +122,7 @@ module Camada
       def blocked6?(w)
         s = @snap
         b = w[0] >> 8
-        return false if (s.bm6[b >> 5] >> (b & 31)) & 1 == 0
+        return false if (s.bm6[b >> 5] >> (b & 31)).nobits?(1)
 
         left = 0
         right = s.n6 - 1
@@ -143,7 +143,7 @@ module Camada
 
       def blocked_asn?(asn)
         s = @snap
-        return (s.asn_bm[asn >> 5] >> (asn & 31)) & 1 != 0 if asn < 4_194_304
+        return (s.asn_bm[asn >> 5] >> (asn & 31)).anybits?(1) if asn < 4_194_304
 
         extra = s.asn_extra
         left = 0

data/lib/camada/version.rb

@@ -5,6 +5,6 @@ module Camada
   # source: camada.gemspec reads it at build, and the sibling drift guards (camada-backend,
   # camada-web, camada-mkt) parse this file with /^\s*VERSION = "([^"]+)"/m the way they parse
   # a package.json. Plain X.Y.Z only: the analyst's SDK_RE drops anything else.
-  VERSION = "0.1.3"
+  VERSION = "0.1.4"
   SDK_ID = "@camada/ruby/#{VERSION}".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: camada
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - camada
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-09 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies: []
 description: 'camada SDK for Ruby: inline enforcement of your snapshot (ordered custom
   rules, then allow, block, challenge), first-party beacon and proof-of-work challenge,