surfguard 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 743b735d0f0abcce2bcfa3660b7f658cceb1a760b90d970a86df76e91cb19622
+  data.tar.gz: 866a867fbde519a8512ae93c4fb6d8051d01b7de1591210e7f40f071376860a0
+SHA512:
+  metadata.gz: c3c1b340115fa7bc1190bec41e76ae2171ec23dfab10855122ddc91c3efb74864cdeed7960c4ab6c8d60770f04f520712e36118bf5c39750486b69a9f735f310
+  data.tar.gz: 587059deea1f701b3a8df14558a7b85c4dc24deb229a4fb61bdb02358c4120647c2e2624da498d4ce15658cbe5de77a1e394af50bf8acd8ac5f9ec080ee6cdef

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 37signals LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,120 @@
+# Surfguard
+
+[![CI](https://github.com/basecamp/surfguard/actions/workflows/ci.yml/badge.svg)](https://github.com/basecamp/surfguard/actions/workflows/ci.yml)
+
+One SSRF address policy for Ruby apps that fetch a URL someone else supplied.
+
+It consolidates several drifting in-house copies of this policy into one — copies that had grown
+four different ideas of what "internal" means, including one that decoded a NAT64 prefix whose length
+is not recoverable from the address. This gem is their union, decided once and tested against the
+full IPv4 × IPv6 range matrix.
+
+## Installation
+
+Not yet published to RubyGems — `v0.1.0` will be the first packaged release. Until it ships,
+install from source:
+
+```ruby
+gem "surfguard", github: "basecamp/surfguard"
+```
+
+Once `v0.1.0` is published:
+
+```ruby
+gem "surfguard"
+```
+
+## What it does
+
+Resolve **and classify only**. It cannot stop DNS rebinding by itself — the caller owns the fetch
+and must **pin** the connection to an address this returned.
+
+```ruby
+# Pinning caller (preferred): validate, then pin each address you try.
+Surfguard.resolve_public_ips("feeds.example.com")
+# => ["93.184.216.34", "2606:2800:220:1:248:1893:25c8:1946"]   (IPv4 first, blocked removed)
+# Iterate THIS list on failover; do not resolve again inside a retry loop.
+
+# Non-pinning caller (hands the hostname straight to Net::HTTP, which resolves again):
+Surfguard.resolvable_public_ip?("https://feeds.example.com/atom")  # => true only if EVERY address is public
+Surfguard.enforce_public_ip(url)                                   # raises otherwise
+
+# Single-address compatibility shim:
+Surfguard.resolve_public_ip(url)   # => "93.184.216.34" or nil
+
+# The classification core, if you already hold an address:
+Surfguard.blocked_address?(IPAddr.new("169.254.169.254"))  # => true
+```
+
+## Refused vs. unresolvable
+
+"We refuse that address" and "the host didn't answer" are different answers, and
+collapsing them bites callers that treat a refusal as permanent. A webhook that
+deactivates a customer's endpoint on `Violation` would retire it on one bad DNS
+minute if a failed lookup arrived the same way.
+
+| | resolves to something public | resolves, all blocked | resolves to nothing | malformed URL |
+|---|---|---|---|---|
+| `resolve_public_ips` (takes a host) | the public addresses | `[]` | raises `Unresolvable` | — |
+| `resolve_public_ip` | first public address | `nil` | raises `Unresolvable` | `nil` |
+| `enforce_public_ip` | returns | raises `Violation` | raises `Unresolvable` | raises `Violation` |
+| `resolvable_public_ip?` | `true` | `false` | `false` | `false` |
+
+`Unresolvable` is **not** a subclass of `Violation` — that's the whole point.
+Rescue both where you don't care which it was. Note the predicate answers the
+question it was asked and never raises; use `enforce_public_ip` or
+`resolve_public_ip` when you need to tell the cases apart.
+
+## The policy
+
+| Range | Handling |
+|---|---|
+| IPv4 private (10/8, 172.16/12, 192.168/16), loopback (127/8), link-local (169.254/16) | refuse |
+| CGNAT (100.64/10), benchmark (198.18/15), TEST-NETs, IETF (192.0.0/24), 6to4 relay anycast (192.88.99/24), multicast (224/4), reserved (240/4), "this" (0/8) | refuse |
+| IPv6 ULA (fc00::/7, incl. IMDSv6 `fd00:ec2::254`), loopback (::1), link-local (fe80::/10), site-local (fec0::/10), multicast (ff00::/8), unspecified (::), discard (100::/64), Teredo (2001::/32), docs (2001:db8::/32), benchmark (2001:2::/48) | refuse |
+| IPv4-mapped `::ffff:0:0/96`, IPv4-compatible `::/96` | refuse outright |
+| **SIIT `::ffff:0:0:0/96`** | decode embedded IPv4 (low 32 bits), re-check |
+| NAT64 well-known `64:ff9b::/96` | decode embedded IPv4 (low 32 bits), re-check |
+| **RFC 8215 NAT64 local-use `64:ff9b:1::/48`** | **refuse outright** — the Pref64 length is not recoverable from the address (RFC 6052 §2.2), so a low-32-bit decode reads the wrong octets; and the block is never globally routed |
+| 6to4 `2002::/16` | refuse (a 6to4 address is just an IPv4 address in disguise) |
+
+## Two things worth knowing
+
+**1. The resolver is part of the policy.** Surfguard resolves with `Resolv.getaddresses`, which
+honours `/etc/hosts` and search domains **and** returns every address. The obvious alternatives each
+drop something a guard can't afford to lose:
+
+- `Resolv.getaddress` honours `/etc/hosts` but returns only the **first** address — so an AAAA-only
+  host deterministically takes the IPv6 path, and a multi-homed host is validated on one address
+  while the connection may use another.
+- `Resolv::DNS.open` returns every address but **ignores** `/etc/hosts` and search domains — so it
+  validates a different set than `Net::HTTP` (which resolves through `getaddrinfo`) will actually
+  connect to. Demonstrable: `Resolv.getaddresses("localhost")` → `["::1","127.0.0.1"]` while
+  `Resolv::DNS.open`'s `each_address("localhost")` → `["::","0.0.0.0"]`.
+
+`getaddresses` is both complete (every address) and faithful (the same chain the connection layer
+uses).
+
+**2. A resolver-level "no AAAA" switch is not a mitigation.** Disabling AAAA at the system resolver
+(for example Kamal's `dns-opt: no-aaaa`) is a glibc `getaddrinfo` option. Surfguard resolves through
+pure-Ruby `Resolv`, which requests AAAA regardless, so IPv6 answers still reach it. Don't treat that
+deploy setting as if it narrowed Surfguard's input.
+
+## Testing
+
+```bash
+ruby -Ilib test/surfguard_test.rb
+# The full BLOCKED/ALLOWED matrix, checked as execution. Bare Ruby, no gems needed.
+```
+
+## Security
+
+Surfguard is a security control, so classification bugs are vulnerabilities. Report them privately
+per the [security policy](https://github.com/basecamp/surfguard/security/policy) — not the public
+issue tracker.
+
+## Status
+
+Extracted and consolidated from several in-house SSRF guards, tested against the full
+IPv4 × IPv6 special-use matrix. Resolve-and-classify only; callers pin. See the
+[releases page](https://github.com/basecamp/surfguard/releases) for versions and changes.

data/SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy
+
+Surfguard is a security control — an SSRF address guard — so classification bugs are security
+vulnerabilities, not ordinary defects. Please report them privately.
+
+## Reporting a vulnerability
+
+Report privately via GitHub's vulnerability reporting:
+[**Report a vulnerability**](https://github.com/basecamp/surfguard/security/advisories/new)
+(the repo's **Security** tab → **Report a vulnerability**).
+
+Open-source reports aren't bounty-eligible, but we also accept them via
+[hackerone.com/basecamp](https://hackerone.com/basecamp) if you'd like the report on your
+HackerOne record — see the
+[37signals security response policy](https://37signals.com/policies/security/response/).
+
+**Do not open a public issue for security bugs.**
+
+## What qualifies
+
+Anything that lets a blocked address through, for example:
+
+- An address in a blocked range that Surfguard classifies as public.
+- A resolution path (encoding, embedding, transition mechanism) that reaches a blocked address
+  despite validation.
+- A discrepancy between what Surfguard validates and what a caller following the documented
+  pinning contract would connect to.
+
+Non-security bugs and questions belong in the
+[regular issue tracker](https://github.com/basecamp/surfguard/issues).
+
+## Supported versions
+
+No packaged release exists yet, so `main` is the supported version. Once releases ship, it
+becomes the latest released version. Fixes ship as a new release, not backports.
+
+## What to expect
+
+We'll acknowledge your report, work with you on a fix, and coordinate disclosure through a
+GitHub Security Advisory. Reporters are credited in the advisory unless they prefer otherwise.

data/lib/surfguard/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Surfguard
+  VERSION = "0.1.0"
+end

data/lib/surfguard.rb

@@ -0,0 +1,244 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "resolv"
+require "uri"
+
+require_relative "surfguard/version"
+
+# One SSRF address policy for a Ruby app that fetches a URL someone else supplied.
+# It consolidates several drifting in-house copies of this policy — copies that had
+# grown four different ideas of what "internal" means, including one that decoded a
+# NAT64 prefix whose length is not recoverable from the address. This is their
+# union, decided once.
+#
+# Two policy decisions the copies drifted on, settled here and explained where
+# they live in the code:
+#
+#   * Resolver (see .resolve_public_ips): resolve with Resolv.getaddresses, which
+#     honours /etc/hosts and search domains AND returns every address. One copy
+#     used Resolv.getaddress (honours hosts, but only the FIRST address, so an
+#     AAAA-only host deterministically selected the IPv6 path); another used
+#     Resolv::DNS.open (all addresses, but ignores /etc/hosts, so it validated a
+#     different set than Net::HTTP would actually connect to). getaddresses is
+#     both complete and faithful to what the connection layer resolves.
+#
+#   * `no-aaaa` in Kamal `dns-opt` is NOT a mitigation. It is a glibc
+#     getaddrinfo option; every guard here resolves through pure-Ruby Resolv,
+#     which asks for AAAA regardless. IPv6 answers reach this code in production.
+#     Do not treat the deploy config as if it narrowed the input.
+#
+# THREAT MODEL / caller contract: this only resolves and classifies. It cannot
+# stop DNS rebinding on its own. A caller must PIN the connection to an address
+# this returned (Net::HTTP#ipaddr=), because a second lookup at connect time can
+# answer differently than the one that was validated. The plural API exists so
+# that a caller failing over between addresses iterates the validated list rather
+# than resolving again inside its retry loop. A non-pinning caller must instead
+# use .resolvable_public_ip?/.enforce_public_ip, which refuse unless EVERY
+# resolved address is public.
+module Surfguard
+  class Violation < StandardError; end
+
+  # The host answered with no address at all. Deliberately NOT a Violation:
+  # nothing was refused here, the lookup simply came back empty, which is
+  # usually a transient upstream failure. A caller that gives up permanently on
+  # a Violation -- a webhook deactivating a customer's endpoint, say -- must not
+  # give up the same way on this, or one bad DNS minute retires the endpoint for
+  # good. Callers that don't care can rescue both.
+  class Unresolvable < StandardError; end
+
+  extend self
+
+  # IPv4 special-use ranges that must never be a fetch target (RFC 5735/6890,
+  # plus CGNAT and benchmarking). RFC1918 / loopback / link-local are also
+  # covered by the IPAddr predicates in #disallowed_ipv4?; they are restated here
+  # so the policy is complete and auditable in one place.
+  DISALLOWED_IPV4 = [
+    IPAddr.new("0.0.0.0/8"),        # "This" network (RFC 1122)
+    IPAddr.new("10.0.0.0/8"),       # Private (RFC 1918)
+    IPAddr.new("100.64.0.0/10"),    # Carrier-grade NAT (RFC 6598)
+    IPAddr.new("127.0.0.0/8"),      # Loopback (RFC 1122)
+    IPAddr.new("169.254.0.0/16"),   # Link-local (RFC 3927) — includes the cloud metadata endpoint
+    IPAddr.new("172.16.0.0/12"),    # Private (RFC 1918)
+    IPAddr.new("192.0.0.0/24"),     # IETF protocol assignments (RFC 6890)
+    IPAddr.new("192.0.2.0/24"),     # TEST-NET-1 (RFC 5737)
+    IPAddr.new("192.88.99.0/24"),   # 6to4 relay anycast (RFC 7526)
+    IPAddr.new("192.168.0.0/16"),   # Private (RFC 1918)
+    IPAddr.new("198.18.0.0/15"),    # Benchmark testing (RFC 2544)
+    IPAddr.new("198.51.100.0/24"),  # TEST-NET-2 (RFC 5737)
+    IPAddr.new("203.0.113.0/24"),   # TEST-NET-3 (RFC 5737)
+    IPAddr.new("224.0.0.0/4"),      # Multicast (RFC 5771)
+    IPAddr.new("240.0.0.0/4")       # Reserved / future use (RFC 1112)
+  ].freeze
+
+  # IPv6 special-use ranges beyond what private? (ULA fc00::/7, incl. the IMDSv6
+  # address fd00:ec2::254), loopback (::1) and link-local (fe80::/10) already
+  # cover. 6to4 and Teredo are deprecated transition mechanisms with no
+  # legitimate fetch target — 2002:7f00:1:: is just a 6to4 spelling of 127.0.0.1.
+  DISALLOWED_IPV6 = [
+    IPAddr.new("::/128"),           # Unspecified (RFC 4291)
+    IPAddr.new("100::/64"),         # Discard-only (RFC 6666)
+    IPAddr.new("2001::/32"),        # Teredo (RFC 4380)
+    IPAddr.new("2001:2::/48"),      # Benchmark testing (RFC 5180)
+    IPAddr.new("2001:db8::/32"),    # Documentation (RFC 3849)
+    IPAddr.new("2002::/16"),        # 6to4 (RFC 3056)
+    IPAddr.new("fec0::/10"),        # Deprecated site-local (RFC 3879)
+    IPAddr.new("ff00::/8")          # Multicast (RFC 4291)
+  ].freeze
+
+  # NAT64 embeds an IPv4 target that must be re-checked as IPv4. The well-known
+  # prefix is a fixed /96, so the embedded octets are always the low 32 bits:
+  # decode and re-check them, and NAT64 to a public address still resolves.
+  NAT64_WELL_KNOWN = IPAddr.new("64:ff9b::/96")   # RFC 6052
+
+  # The RFC 8215 local-use block is refused whole, not decoded. It can host a
+  # Pref64 of any length (/32…/96) whose embedded position is NOT recoverable
+  # from the address alone (RFC 6052 §2.2), so decoding the low 32 bits reads the
+  # wrong octets and can under-block. It is also never globally routed, so there
+  # is no legitimate feed behind it. This is the divergence some in-house copies
+  # got wrong by decoding both prefixes the same way.
+  NAT64_LOCAL_USE = IPAddr.new("64:ff9b:1::/48")  # RFC 8215
+
+  # SIIT's IPv4-translated form is the third way an IPv4 address rides inside an
+  # IPv6 one, and the only one Ruby has no predicate for: ipv4_mapped?,
+  # ipv4_compat?, private?, loopback? and link_local? are all false for
+  # ::ffff:0:169.254.169.254, so it would reach the metadata address straight
+  # through the branches below. Note the extra group — ::ffff:0:0:0/96 is NOT the
+  # familiar IPv4-mapped ::ffff:0:0/96, and the two ranges do not overlap. Like
+  # the NAT64 well-known prefix it is a fixed /96, so decode the low 32 bits.
+  IPV4_TRANSLATABLE = IPAddr.new("::ffff:0:0:0/96") # RFC 2765
+
+  # Every PUBLIC address the host resolves to, IPv4 ahead of IPv6, DNS order
+  # preserved within each family so a provider's round-robin still spreads load.
+  # Empty when the host resolves but every address is blocked; raises
+  # Unresolvable when it resolves to nothing at all, so the caller can tell a
+  # refusal from a lookup failure. A caller that fails over MUST iterate this
+  # list and pin each address; resolving again reopens the rebinding window.
+  # Accepts a hostname or an IP-literal host.
+  def resolve_public_ips(host)
+    addresses = resolve(host)
+    raise Unresolvable, "No address for #{host}" if addresses.empty?
+
+    addresses.reject { |ip| blocked_address?(ip) }
+             .partition(&:ipv4?)
+             .flatten
+             .map(&:to_s)
+  end
+
+  # True only if the URL's host resolves to at least one address and NONE are
+  # blocked. For non-pinning callers (they hand the hostname straight to
+  # Net::HTTP, which resolves again), so anything short of "every address is
+  # public" is unsafe. A predicate answers the question it was asked and doesn't
+  # raise: false covers unresolvable and malformed alike. Reach for
+  # .enforce_public_ip or .resolve_public_ip when you need to tell those apart.
+  def resolvable_public_ip?(url)
+    addresses = resolve(host_of(url))
+    addresses.any? && addresses.none? { |ip| blocked_address?(ip) }
+  rescue URI::InvalidURIError, IPAddr::InvalidAddressError, ArgumentError
+    false
+  end
+
+  # Raise unless the URL's host is safe, for call sites that want a hard stop
+  # rather than a boolean: Unresolvable when it answers with nothing, Violation
+  # when it answers with something we refuse. A malformed URL is a Violation --
+  # there was never a lookup to fail.
+  def enforce_public_ip(url)
+    addresses = resolve(host_of(url))
+    raise Unresolvable, "No address for #{url}" if addresses.empty?
+    raise Violation, "Refusing to fetch private/internal address for #{url}" if addresses.any? { |ip| blocked_address?(ip) }
+  rescue URI::InvalidURIError, IPAddr::InvalidAddressError, ArgumentError
+    raise Violation, "Refusing to fetch malformed address for #{url}"
+  end
+
+  # The single-address compatibility shim for callers migrating from an older
+  # first-address-only guard. Returns the first public address as a String, nil
+  # if the host is malformed or resolves to anything blocked, and raises
+  # Unresolvable if it resolves to nothing -- which is where an older guard
+  # built on Resolv.getaddress raised Resolv::ResolvError, so callers that
+  # distinguished a lookup failure keep doing so. Prefer .resolve_public_ips.
+  def resolve_public_ip(url)
+    addresses = resolve(host_of(url))
+    raise Unresolvable, "No address for #{url}" if addresses.empty?
+    return nil if addresses.any? { |ip| blocked_address?(ip) }
+
+    addresses.first.to_s
+  rescue URI::InvalidURIError, IPAddr::InvalidAddressError, ArgumentError
+    nil
+  end
+
+  # The classification core. True if this address must never be a fetch target.
+  # Accepts an IPAddr or anything IPAddr.new understands. Errs closed: an address
+  # it cannot parse is blocked.
+  def blocked_address?(ip)
+    ipaddr = ip.is_a?(IPAddr) ? ip : IPAddr.new(ip.to_s)
+
+    # DNS never legitimately returns an IPv4 address embedded these two ways, so
+    # refuse them regardless of the address they wrap.
+    if ipaddr.ipv4_mapped? || ipaddr.ipv4_compat?
+      true
+    elsif ipaddr.ipv4?
+      disallowed_ipv4?(ipaddr)
+    elsif NAT64_LOCAL_USE.include?(ipaddr)
+      true
+    elsif NAT64_WELL_KNOWN.include?(ipaddr) || IPV4_TRANSLATABLE.include?(ipaddr)
+      disallowed_ipv4?(embedded_ipv4(ipaddr))
+    else
+      disallowed_ipv6?(ipaddr)
+    end
+  rescue IPAddr::InvalidAddressError
+    true
+  end
+
+  private
+
+  # An IP-literal host skips DNS so a public literal URL resolves directly and an
+  # internal literal is still caught by blocked_address?. Otherwise resolve via
+  # Resolv.getaddresses — the Hosts+DNS chain, matching what the connection layer
+  # will use, and returning every address. Returns [IPAddr].
+  def resolve(host)
+    literal = ip_literal(host)
+
+    if literal
+      [ literal ]
+    else
+      Resolv.getaddresses(host).map { |a| IPAddr.new(a) }
+    end
+  rescue Resolv::ResolvError, Resolv::ResolvTimeout
+    []
+  end
+
+  # nil for anything that isn't already an address. Kept separate so the DNS
+  # call above sits in the method body, where the ResolvError rescue can reach
+  # it — inside a sibling rescue clause it could not.
+  def ip_literal(host)
+    IPAddr.new(host)
+  rescue IPAddr::InvalidAddressError
+    nil
+  end
+
+  def host_of(url)
+    # URI#host is "" for "http://" and nil when there's no authority at all.
+    # Neither is a name to look up, so both are malformed rather than a lookup
+    # that failed. URI#host keeps IPv6 brackets ([::1]); IPAddr.new won't take them.
+    host = URI.parse(url).host
+    raise URI::InvalidURIError, "no host in #{url.inspect}" if host.nil? || host.empty?
+
+    host.delete_prefix("[").delete_suffix("]")
+  end
+
+  def disallowed_ipv4?(ipaddr)
+    ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? ||
+      DISALLOWED_IPV4.any? { |range| range.include?(ipaddr) }
+  end
+
+  def disallowed_ipv6?(ipaddr)
+    ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? ||
+      DISALLOWED_IPV6.any? { |range| range.include?(ipaddr) }
+  end
+
+  # RFC 6052 §2.2: a fixed /96 translation prefix carries the IPv4 target in the
+  # low 32 bits.
+  def embedded_ipv4(ipaddr)
+    IPAddr.new([ ipaddr.to_i & 0xffffffff ].pack("N").unpack("C4").join("."))
+  end
+end

metadata

@@ -0,0 +1,52 @@
+--- !ruby/object:Gem::Specification
+name: surfguard
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- 37signals
+bindir: bin
+cert_chain: []
+date: 2026-08-12 00:00:00.000000000 Z
+dependencies: []
+description: 'Surfguard resolves a hostname to the public IP addresses it points at
+  and refuses anything that would reach an internal network: private, loopback, link-local
+  and carrier-grade NAT space, plus the IPv6 transition ranges a naive guard misses
+  (IPv4-mapped, SIIT, NAT64, 6to4, Teredo). It resolves and classifies only; the caller
+  owns the fetch and pins the connection to a returned address so DNS rebinding cannot
+  swap in a blocked one. Standard library only, no runtime dependencies.'
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- SECURITY.md
+- lib/surfguard.rb
+- lib/surfguard/version.rb
+homepage: https://github.com/basecamp/surfguard
+licenses:
+- MIT
+metadata:
+  bug_tracker_uri: https://github.com/basecamp/surfguard/issues
+  changelog_uri: https://github.com/basecamp/surfguard/releases
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.18
+specification_version: 4
+summary: 'One SSRF address policy: resolve a host and classify special-use IPv4/IPv6
+  ranges'
+test_files: []