surfguard 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +1 -0
- data/lib/surfguard/version.rb +1 -1
- data/lib/surfguard.rb +6 -4
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 2bbb6e8891a860c9c927fbcced35382c1ecdaf965bc4d3e41d56b06f94c5adf2
|
|
4
|
+
data.tar.gz: 0f309037fa0b37414dd964a9d15afdf0b3a68dbd706a90ee5f24660d8721dd4e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 8f12a95962cfa260c0fc1754d09c78b34c95e3db42dd35837b77b6532a030fd0562cf227d57be5b979c243832cfdd1c71612c495e6c305031f519050dd33d28f
|
|
7
|
+
data.tar.gz: 6f571b898b5c21214b12c27e2dcf6b8cec6b0fce2005cc48aa9b82753a49b4fd7f1b743abe20bb84141cf393f5c9a7e04d98efe9c57d7bb2692452d5ef0346a5
|
data/README.md
CHANGED
|
@@ -77,6 +77,7 @@ question it was asked and never raises; use `enforce_public_ip` or
|
|
|
77
77
|
|---|---|
|
|
78
78
|
| IPv4 private (10/8, 172.16/12, 192.168/16), loopback (127/8), link-local (169.254/16) | refuse |
|
|
79
79
|
| CGNAT (100.64/10), benchmark (198.18/15), TEST-NETs, IETF (192.0.0/24), 6to4 relay anycast (192.88.99/24), multicast (224/4), reserved (240/4), "this" (0/8) | refuse |
|
|
80
|
+
| Azure WireServer `168.63.129.16/32` | refuse — a fixed Azure platform/fabric alias, not an RFC special-use range |
|
|
80
81
|
| IPv6 ULA (fc00::/7, incl. IMDSv6 `fd00:ec2::254`), loopback (::1), link-local (fe80::/10), site-local (fec0::/10), multicast (ff00::/8), unspecified (::), discard/dummy (100::/64, 100:0:0:1::/64), documentation (2001:db8::/32, 3fff::/20), SRv6 SID (5f00::/16) | refuse |
|
|
81
82
|
| IETF protocol assignments (2001::/23) | refuse by default, including Teredo, benchmark, PCP/TURN/DNS-SD anycast to nearby infrastructure, deprecated ORCHID, ORCHIDv2, DET, and unallocated space; allow only AMT (2001:3::/32) and AS112-v6 (2001:4:112::/48) |
|
|
82
83
|
| IPv4-mapped `::ffff:0:0/96`, IPv4-compatible `::/96` | refuse outright |
|
data/lib/surfguard/version.rb
CHANGED
data/lib/surfguard.rb
CHANGED
|
@@ -59,15 +59,17 @@ module Surfguard
|
|
|
59
59
|
|
|
60
60
|
extend self
|
|
61
61
|
|
|
62
|
-
# IPv4 special-use ranges that must never be a
|
|
63
|
-
# plus CGNAT and benchmarking). RFC1918 /
|
|
64
|
-
# covered by the IPAddr predicates in
|
|
65
|
-
# so the policy is complete and
|
|
62
|
+
# IPv4 special-use ranges and exact platform aliases that must never be a
|
|
63
|
+
# fetch target (RFC 5735/6890, plus CGNAT and benchmarking). RFC1918 /
|
|
64
|
+
# loopback / link-local are also covered by the IPAddr predicates in
|
|
65
|
+
# #disallowed_ipv4?; they are restated here so the policy is complete and
|
|
66
|
+
# auditable in one place.
|
|
66
67
|
DISALLOWED_IPV4 = [
|
|
67
68
|
IPAddr.new("0.0.0.0/8"), # "This" network (RFC 1122)
|
|
68
69
|
IPAddr.new("10.0.0.0/8"), # Private (RFC 1918)
|
|
69
70
|
IPAddr.new("100.64.0.0/10"), # Carrier-grade NAT (RFC 6598)
|
|
70
71
|
IPAddr.new("127.0.0.0/8"), # Loopback (RFC 1122)
|
|
72
|
+
IPAddr.new("168.63.129.16/32"), # Azure host-node WireServer virtual IP
|
|
71
73
|
IPAddr.new("169.254.0.0/16"), # Link-local (RFC 3927) — includes the cloud metadata endpoint
|
|
72
74
|
IPAddr.new("172.16.0.0/12"), # Private (RFC 1918)
|
|
73
75
|
IPAddr.new("192.0.0.0/24"), # IETF protocol assignments (RFC 6890)
|