radioactive 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db78ab47dc98a9125d0dde9cb3ec17e95b83cafc3fae5922fa3f48cbcb85f0f2
-  data.tar.gz: 8da7cf85d58c94bab1a13466ef7a236b24a2da1d6e021835bd5bf959b690d38c
+  metadata.gz: c3fafb950586fcfeabd5b472d69d2d039011c4e7f33d94bfee8edff8b8a42b91
+  data.tar.gz: e2785593bc12e88e6ece524df9dab17dd85edfbb557c884d57621d80c996b950
 SHA512:
-  metadata.gz: 594fcc7d8f2f3d670154b11d9d0194df8f9fe2da2e8d4eadf222516cb76b6b1d82ac70214e873ccdaaf9947f95f0ca6012aba1079ee8942e25ad50845b2035be
-  data.tar.gz: 35ee0b007e1e41807b9376d80c1e98d6b933af4388b8e4dae0aef6d5dc451d6ec0f012284619d9390cb4f055db82a5efce4199f73220df2ba8c26680a5006331
+  metadata.gz: 55759e34aa89a393659815cb995c26e2299da4c01a19da7e0ffac8bef9aac9d9f55bc6d60321279f275f98079e79500f187a26a3622d8dd18e144b13bbd333c0
+  data.tar.gz: ecdcfa862aec8714e722ae6a69ba996dc058dd2f8a6684d65cf9cf12bc8930f43be4284ea10b70dcd0c6880c8db8a05e8f595a4b00e518c158292bcab5554b1b

data/CHANGELOG.md

@@ -4,7 +4,42 @@ All notable changes to this project will be documented in this file. The format
 is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [Released]
+
+## [0.1.2] - 2026-05-06
+
+### Fixed
+
+- Dual-stack hosts whose resolver returns AAAA before A on a network without
+  IPv6 reachability no longer surface `ResponseError: transport error:
+  Errno::EHOSTUNREACH`. `Fetcher#perform_request` now iterates over the full
+  pre-validated candidate list returned by `pin_addresses`, advancing to the
+  next address on connect-phase transport errors (`Errno::EHOSTUNREACH`,
+  `Errno::ENETUNREACH`, `Errno::ECONNREFUSED`, `Net::OpenTimeout`). Errors
+  raised after a connection is established (TLS handshake failure, read
+  timeout, post-connect `ECONNRESET`, non-2xx response) do **not** trigger
+  fallback — silently retrying against a different IP would mask real
+  problems.
+
+### Security
+
+- Strict dual-A SSRF rejection is preserved end-to-end. Validation runs
+  across the entire resolved address list before any socket opens, so the
+  fallback added above cannot weaken the "if any resolved address is in a
+  forbidden range, refuse the request" rule. A new HTTP-level test
+  exercises the dual-stack-with-one-forbidden-address case to lock this in.
+- Caller-supplied header validation now provably runs before any socket
+  attempt across the candidate list (regression-tested via the existing
+  CRLF / NUL header tests, which previously passed only because the single
+  pinned IP refused the connection first).
+
+### Documentation
+
+- `docs/REQUIREMENTS.md` §175 ("DNS resolution and IP pinning") rewritten:
+  step 4 now describes a candidate list rather than "the first remaining
+  address," and a new step 6 specifies the connect-phase fallback
+  semantics, what does *not* trigger fallback, and the exhaustion-error
+  shape (`TimeoutError` for `Net::OpenTimeout`, otherwise `ResponseError`).
 
 ## [0.1.1] - 2026-05-04
 

data/README.md

@@ -455,6 +455,18 @@ If anything fails midway (e.g. push rejected, MFA timeout), the tag may already
 - Bump `lib/radioactive/version.rb` to the next anticipated version with a `.dev` or `.alpha` suffix if you want subsequent local builds to be distinguishable from the release.
 - Push that commit; future changes accumulate under `[Unreleased]` until the next release.
 
+### Release Cheatsheet
+
+1. Edit  CHANGELOG.md             — add the [0.1.2] - 2026-05-06 section
+2. Edit  lib/radioactive/version.rb  — "0.1.1" → "0.1.2"
+3. Run   bundle exec rake         — confirm tests + lint + types still green
+4. Run   git status               — sanity check what's about to be committed
+5. Run   git add -A && git commit — single commit covering fix + version + changelog
+6. Run   git push origin main     — gets the commit on the remote before the tag
+7. Run   bundle exec rake gem:release   — guard_clean → build → tag → push → publish (MFA)
+8. Edit  lib/radioactive/version.rb  — bump to 0.1.3.dev (post-release commit)
+9. Run   git add ... && git commit && git push
+ 
 ### Stronger publishing setup (optional)
 
 For a security-focused gem, consider [RubyGems Trusted Publishing](https://guides.rubygems.org/trusted-publishing/) instead of pushing from a developer machine: a tagged commit triggers a GitHub Actions workflow that authenticates to rubygems via OIDC and publishes without any long-lived API key on disk. Removes the "stolen laptop = compromised gem" risk and complements the MFA requirement.

data/lib/radioactive/fetcher.rb

@@ -15,6 +15,18 @@ module Radioactive
     CHUNK_SIZE = 16 * 1024
     DEFAULT_USER_AGENT = "Radioactive/#{Radioactive::VERSION}"
 
+    # Connect-phase transport failures that justify trying the next pinned
+    # candidate. Anything else (TLS handshake failure, read timeout,
+    # post-connect ECONNRESET) is terminal — the server engaged with us, so
+    # silently retrying against a different IP would mask real problems and
+    # risks duplicating side-effecting requests in a future non-GET world.
+    CONNECT_FALLBACK_ERRORS = [
+      Errno::EHOSTUNREACH,
+      Errno::ENETUNREACH,
+      Errno::ECONNREFUSED,
+      Net::OpenTimeout
+    ].freeze
+
     # Single-label hosts that are entirely digits or 0x-prefix hex are not
     # valid RFC 1123 hostnames; they're SSRF-bypass attempts that some libc
     # getaddrinfo implementations historically resolved as IPs.
@@ -110,8 +122,8 @@ module Radioactive
       loop do
         check_deadline(deadline, clock)
 
-        ip = pin_address(current, resolver, opts)
-        kind, status, headers, body = perform_request(current, ip, opts, deadline, clock, &chunk_block)
+        ips = pin_addresses(current, resolver, opts)
+        kind, status, headers, body = perform_request(current, ips, opts, deadline, clock, &chunk_block)
 
         case kind
         when :redirect
@@ -170,7 +182,12 @@ module Radioactive
       host
     end
 
-    def pin_address(uri, resolver, opts)
+    # Resolve the host once and validate every address against the forbidden
+    # ranges before returning. Returns the full list in resolver order so the
+    # connect loop can fall back across dual-stack records when one path is
+    # down — the strict "any forbidden → reject" rule still defeats dual-A
+    # SSRF because validation runs upfront, before any socket opens.
+    def pin_addresses(uri, resolver, opts)
       host = uri.host or raise AddressError, "URL has no host"
       addresses = AddressCheck.resolve(host, resolver)
       raise AddressError, "no addresses for #{host}" if addresses.empty?
@@ -183,7 +200,7 @@ module Radioactive
         end
       end
 
-      addresses.first
+      addresses
     end
 
     def resolve_redirect(current, location, opts)
@@ -209,37 +226,68 @@ module Radioactive
       [value, remaining].min
     end
 
-    def perform_request(uri, ip, opts, deadline, clock, &chunk_block)
-      http = build_http(uri, ip, opts, deadline, clock)
+    def perform_request(uri, ips, opts, deadline, clock, &chunk_block)
+      # Build the request up front so caller-supplied input (e.g. CRLF in
+      # headers) is rejected before any socket opens — independent of which
+      # candidate we'd reach.
       req = build_request(uri, opts)
+      last_connect_error = nil
 
-      result = nil
-      begin
-        http.start do |conn|
-          conn.request(req) do |res|
-            code = res.code.to_i
-            headers = headers_hash(res)
-
-            if REDIRECT_STATUSES.include?(code) && headers["location"]
-              result = [:redirect, code, headers, nil]
-            elsif (200..299).cover?(code)
-              # 2xx: stream chunks straight to caller; no buffering here.
-              read_body!(res, headers, opts, deadline, clock, &chunk_block)
-              result = [:final, code, headers, nil]
-            else
-              # Non-2xx: buffer body so ResponseError can carry partial data.
-              error_body = String.new(capacity: CHUNK_SIZE)
-              read_body!(res, headers, opts, deadline, clock) { |chunk| error_body << chunk }
-              result = [:final, code, headers, error_body]
-            end
+      ips.each do |ip|
+        http = build_http(uri, ip, opts, deadline, clock)
+
+        begin
+          http.start
+        rescue *CONNECT_FALLBACK_ERRORS => e
+          last_connect_error = e
+          next
+        rescue OpenSSL::SSL::SSLError, SocketError, Errno::ECONNRESET,
+          IOError => e
+          raise ResponseError, "transport error: #{e.class}: #{e.message}"
+        end
+
+        begin
+          return execute_request(http, req, opts, deadline, clock, &chunk_block)
+        rescue Net::OpenTimeout, Net::ReadTimeout => e
+          raise TimeoutError, e.message
+        rescue OpenSSL::SSL::SSLError, SocketError, Errno::ECONNREFUSED,
+          Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::ECONNRESET,
+          IOError => e
+          raise ResponseError, "transport error: #{e.class}: #{e.message}"
+        ensure
+          begin
+            http.finish if http.started?
+          rescue IOError
+            # already closed
           end
         end
-      rescue Net::OpenTimeout, Net::ReadTimeout => e
-        raise TimeoutError, e.message
-      rescue OpenSSL::SSL::SSLError, SocketError, Errno::ECONNREFUSED,
-        Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::ECONNRESET,
-        IOError => e
-        raise ResponseError, "transport error: #{e.class}: #{e.message}"
+      end
+
+      # All candidates failed at connect. Surface the last error in the same
+      # shape a single-address failure would have taken.
+      raise TimeoutError, last_connect_error.message if last_connect_error.is_a?(Net::OpenTimeout)
+      raise ResponseError, "transport error: #{last_connect_error.class}: #{last_connect_error.message}"
+    end
+
+    def execute_request(http, req, opts, deadline, clock, &chunk_block)
+      result = nil
+
+      http.request(req) do |res|
+        code = res.code.to_i
+        headers = headers_hash(res)
+
+        if REDIRECT_STATUSES.include?(code) && headers["location"]
+          result = [:redirect, code, headers, nil]
+        elsif (200..299).cover?(code)
+          # 2xx: stream chunks straight to caller; no buffering here.
+          read_body!(res, headers, opts, deadline, clock, &chunk_block)
+          result = [:final, code, headers, nil]
+        else
+          # Non-2xx: buffer body so ResponseError can carry partial data.
+          error_body = String.new(capacity: CHUNK_SIZE)
+          read_body!(res, headers, opts, deadline, clock) { |chunk| error_body << chunk }
+          result = [:final, code, headers, error_body]
+        end
       end
 
       result || raise(ResponseError, "request produced no response")

data/lib/radioactive/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Radioactive
-  VERSION = "0.1.1"
+  VERSION = "0.1.2"
 end

data/sig/radioactive.rbs

@@ -136,6 +136,7 @@ module Radioactive
     RESERVED_HEADERS: Array[String]
     CHUNK_SIZE: Integer
     DEFAULT_USER_AGENT: String
+    CONNECT_FALLBACK_ERRORS: Array[Class]
     NUMERIC_ONLY_HOST: Regexp
     HEADER_INVALID_CHAR: Regexp
     DEFAULTS: Hash[Symbol, untyped]
@@ -219,11 +220,12 @@ module Radioactive
     def run_streaming: (uri_like url, Hash[Symbol, untyped] call_opts) { (String) -> void } -> Hash[Symbol, untyped]
     def parse_url: (uri_like url, Hash[Symbol, untyped] opts) -> URI::Generic
     def canonicalize_host: (String host) -> String
-    def pin_address: (URI::Generic uri, AddressCheck::_Resolver resolver, Hash[Symbol, untyped] opts) -> IPAddr
+    def pin_addresses: (URI::Generic uri, AddressCheck::_Resolver resolver, Hash[Symbol, untyped] opts) -> Array[IPAddr]
     def resolve_redirect: (URI::Generic current, String location, Hash[Symbol, untyped] opts) -> URI::Generic
     def check_deadline: (Float? deadline, _Clock clock) -> void
     def clamp_timeout: ((Float | Integer)? value, Float? deadline, _Clock clock) -> (Float | Integer)?
-    def perform_request: (URI::Generic uri, IPAddr ip, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) { (String) -> void } -> Array[untyped]
+    def perform_request: (URI::Generic uri, Array[IPAddr] ips, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) { (String) -> void } -> Array[untyped]
+    def execute_request: (Net::HTTP http, Net::HTTPRequest req, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) { (String) -> void } -> Array[untyped]
     def build_http: (URI::Generic uri, IPAddr ip, Hash[Symbol, untyped] opts, Float? deadline, _Clock clock) -> Net::HTTP
     def build_request: (URI::Generic uri, Hash[Symbol, untyped] opts) -> Net::HTTPRequest
     def headers_hash: (Net::HTTPResponse res) -> header_hash

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: radioactive
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Pawel Osiczko