faraday-restrict-ip-addresses 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 62485d16c4a53ef8a30e2b940b858dc44e8077bd
-  data.tar.gz: 35a0b0937db1175f7d2eaaa0c4b16271b2f85283
+  metadata.gz: 9f59a971b3f267be404539a95d9b7feda50211b7
+  data.tar.gz: f85376e90f9fb7ff8b483e176afb2884a3010db3
 SHA512:
-  metadata.gz: 531fae725622bc033b69d27973ebfd4bc151f7626fe8c1da52c075bd5382323c081acc1dbd79e8e28c3c9729fe7fdd9f9d790286a8c975243cef5b903b7909d9
-  data.tar.gz: d38b0a07810abc7065bf0fe37e3643d0daa712af6630a9b9b911ac69b07a39ce1c83295ff3a2c646912b0cb5206ff3b1cafadcbd04cfda33dc2da5538065d5a4
+  metadata.gz: 9b97db3e5b0a806db906853175767c7a92c0c28e39af3a4606d4d0d6654bbff1d1479c38db8f87c2dab5e533e58b491219e6f9d4909db112e324700de2acfc6d
+  data.tar.gz: 46e04a74e074757bebbfef126d24deb0bcf05ee42467bbc0f66ac68ae381e4de84a85ed32763d6fea6a7eff78ffb5b2fceca51d907f76b10e30d4a140f4ab976

data/README.md

@@ -2,9 +2,11 @@ Faraday::RestrictIPAddresses
 ============================
 
 Prevent Faraday from hitting an arbitrary list of IP addresses, with helpers
-for RFC 1918 networks and localhost.
+for RFC 1918 networks, RFC 6890 networks, and localhost.
 
-System DNS facilities are used, so lookups should be cached.
+System DNS facilities are used, so lookups should be cached instead of making
+another request. Addresses are invalid if a host has has at least one invalid
+DNS entry.
 
 Usage
 =====
@@ -12,8 +14,8 @@ Usage
 ```ruby
 faraday = Faraday.new do |builder|
   builder.request :url_encoded
-  builder.use     :restrict_ip_addresses, deny_rfc1918: true,
-                                          allow_localhost: true
+  builder.use     :restrict_ip_addresses, deny_rfc6890: true,
+                                          allow_localhost: true,
                                           deny: ['8.0.0.0/8',
                                                  '224.0.0.0/7'],
                                           allow: ['192.168.0.0/24']
@@ -23,7 +25,7 @@ end
 faraday.get 'http://www.badgerbadgerbadger.com' # 150.0.0.150 or something
 # => cool
 
-faraday.get 'http://malicious-callback.com      # 172.0.0.150, maybe a secret internal server? Maybe not?
+faraday.get 'http://malicious-callback.com'      # 172.0.0.150, maybe a secret internal server? Maybe not?
 # => raises Faraday::RestrictIPAddresses::AddressNotAllowed
 ```
 
@@ -40,5 +42,3 @@ Dat @bhuga with shoutouts to @mastahyeti's [gist.](https://gist.github.com/masta
 #### UNLICENSE
 
 It's right there.
-
-

data/lib/faraday/restrict_ip_addresses.rb

@@ -4,7 +4,7 @@ require 'ipaddr'
 module Faraday
   class RestrictIPAddresses < Faraday::Middleware
     class AddressNotAllowed < Faraday::Error::ClientError ; end
-    VERSION = '0.0.1'
+    VERSION = '0.0.2'
 
     RFC_1918_NETWORKS = %w(
       127.0.0.0/8
@@ -13,12 +13,32 @@ module Faraday
       192.168.0.0/16
     ).map { |net| IPAddr.new(net) }
 
+    RFC_6890_NETWORKS = RFC_1918_NETWORKS + [
+      '0.0.0.0/8',         #  "This" Network [RFC1700, page 4]
+      '100.64.0.0/10',     #  Shared address space [6598, 6890]
+      #'128.0.0.0/16',      #  Reserved in 3330, not in 6890, has been assigned
+      '169.254.0.0/16',    #  Link Local [3927, 6890]
+      # '191.255.0.0/16'   #  Reserved in 3330, not in 6890, has been assigned
+      '192.0.0.0/24',      #  Reserved but subject to allocation [6890]
+      '192.0.0.0/29',      #  DS-Lite                        [6333, 6890]. Redundant with above, included for completeness.
+      '192.0.2.0/24',      #  Documentation                  [5737, 6890]
+      '192.88.99.0/24',    #  6to4 Relay Anycast             [3068, 6890]
+      '198.18.0.0/15',     #  Network Interconnect Device Benchmark Testing [2544, 6890]
+      '198.51.100.0/24',   #  Documentation                  [5737, 6890]
+      '203.0.113.0/24',    #  Documentation                  [5737, 6890]
+      '224.0.0.0/4',       #  Multicast                      [11112]
+      '240.0.0.0/4',       #  Reserved for Future Use        [6890]
+      '255.255.255.255/32' #  Reserved for Future Use        [6890]
+    ].map { |net| IPAddr.new(net) }
+
     def initialize(app, options = {})
       super(app)
       @denied_networks   = (options[:deny] || []).map  { |n| IPAddr.new(n) }
       @allowed_networks  = (options[:allow] || []).map { |n| IPAddr.new(n) }
 
       @denied_networks += RFC_1918_NETWORKS if options[:deny_rfc1918]
+      @denied_networks += RFC_6890_NETWORKS if options[:deny_rfc6890]
+      @denied_networks.uniq!
       @allowed_networks += [IPAddr.new('127.0.0.1')] if options[:allow_localhost]
     end
 

data/spec/restrict_ip_addresses_spec.rb

@@ -6,18 +6,24 @@ describe Faraday::RestrictIPAddresses do
     @rip = described_class.new(lambda{|env| env}, opts)
   end
 
-  def allowed(string_address)
+  def allowed(*addresses)
     url = URI.parse("http://test.com")
-    ip  = IPAddr.new(string_address).hton
+    ips  = addresses.map { |add| IPAddr.new(add).hton }
 
-    Socket.expects(:gethostbyname).with(url.host).returns(['garbage', [], 30, ip])
+    # Socket returns a bunch of other stuff with gethostbyname. ipv6 addresses,
+    # other socket information, whatever. We ignore it all internally and return
+    # only valid ipv4 addresses, so just append what we're checking to some
+    # garbage data like we expect.
+    return_addresses = ['garbage', [], 30]
+    return_addresses += ips
+    Socket.expects(:gethostbyname).with(url.host).returns(return_addresses)
 
     env = { url: url }
     @rip.call(env)
   end
 
-  def denied(string_address)
-    expect(-> { allowed(string_address) }).to raise_error(Faraday::RestrictIPAddresses::AddressNotAllowed)
+  def denied(*addresses)
+    expect(-> { allowed(*addresses) }).to raise_error(Faraday::RestrictIPAddresses::AddressNotAllowed)
   end
 
     it "defaults to allowing everything" do
@@ -34,6 +40,14 @@ describe Faraday::RestrictIPAddresses do
       denied  '8.0.0.1'
     end
 
+    it "disallows addresses when any IP address is disallowed" do
+      middleware deny: ["8.0.0.0/8"]
+
+      denied '10.0.0.10', '8.8.8.8'
+      allowed '10.0.0.10'
+      denied '10.0.0.10', '8.8.8.8'
+    end
+
     it "blacklists RFC1918 addresses" do
       middleware deny_rfc1918: true
 
@@ -43,6 +57,15 @@ describe Faraday::RestrictIPAddresses do
       denied  '10.0.0.252'
     end
 
+    it "blacklists RFC6890 addresses" do
+      middleware deny_rfc6890: true
+
+      allowed '5.5.5.5'
+      denied  '240.15.15.15'
+      denied  '192.168.15.55'
+      denied  '10.0.0.252'
+    end
+
     it "allows exceptions to disallowed addresses" do
       middleware deny_rfc1918: true,
                  allow: ["192.168.0.0/24"]
@@ -70,4 +93,3 @@ describe Faraday::RestrictIPAddresses do
     end
 
 end
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: faraday-restrict-ip-addresses
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Ben Lavender
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-01-24 00:00:00.000000000 Z
+date: 2014-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday