kyleandClaude Opus 5.5
b426ca1958
A draft spec for the owner's review and 13 offline tasks with their given tests: shared tool arguments and host rules in proto, the sealed fetch target (M3a finding 14), the toolkit tools and SOCKS5 egress proxy, and brokerd's [runner], podman argument lists, runtime and proxy lifecycle. Each task's tests were run against a reference at that task's end state (560 to 638 tests, clippy clean); the reference is not in the repository. Adds the runner-unavailable runbook entry and tip T23 (ETXTBSY in script tests). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
117 lines
2.4 KiB
Rust
117 lines
2.4 KiB
Rust
//! `is_public`: the egress proxy connects only to public addresses. Every range in the M3b spec,
|
|
//! section 5, has a case at each end, and a public neighbour just outside it. Do not edit.
|
|
|
|
use std::net::IpAddr;
|
|
|
|
use toolkit::addr::is_public;
|
|
|
|
fn ip(s: &str) -> IpAddr {
|
|
s.parse().unwrap()
|
|
}
|
|
|
|
#[test]
|
|
fn refused_ipv4() {
|
|
for s in [
|
|
"0.0.0.0",
|
|
"0.255.255.255",
|
|
"10.0.0.0",
|
|
"10.255.255.255",
|
|
"100.64.0.0",
|
|
"100.100.100.100",
|
|
"100.127.255.255",
|
|
"127.0.0.1",
|
|
"127.255.255.255",
|
|
"169.254.0.1",
|
|
"169.254.255.255",
|
|
"172.16.0.0",
|
|
"172.31.255.255",
|
|
"192.0.0.0",
|
|
"192.0.0.255",
|
|
"192.0.2.1",
|
|
"192.168.0.1",
|
|
"192.168.255.255",
|
|
"198.18.0.0",
|
|
"198.19.255.255",
|
|
"198.51.100.7",
|
|
"203.0.113.9",
|
|
"224.0.0.1",
|
|
"239.255.255.255",
|
|
"240.0.0.0",
|
|
"255.255.255.255",
|
|
] {
|
|
assert!(!is_public(ip(s)), "{s} must be refused");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn public_ipv4() {
|
|
for s in [
|
|
"1.1.1.1",
|
|
"8.8.8.8",
|
|
"9.255.255.255",
|
|
"11.0.0.0",
|
|
"100.63.255.255",
|
|
"100.128.0.0",
|
|
"126.255.255.255",
|
|
"128.0.0.0",
|
|
"169.253.255.255",
|
|
"172.15.255.255",
|
|
"172.32.0.0",
|
|
"192.0.1.0",
|
|
"192.0.3.0",
|
|
"192.167.255.255",
|
|
"192.169.0.0",
|
|
"198.17.255.255",
|
|
"198.20.0.0",
|
|
"198.51.99.255",
|
|
"203.0.112.255",
|
|
"223.255.255.255",
|
|
"93.184.216.34",
|
|
] {
|
|
assert!(is_public(ip(s)), "{s} is public");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn refused_ipv6() {
|
|
for s in [
|
|
"::",
|
|
"::1",
|
|
"fc00::1",
|
|
"fdff:ffff::1",
|
|
"fd7a:115c:a1e0::1",
|
|
"fe80::1",
|
|
"febf::1",
|
|
"ff02::1",
|
|
"ff00::",
|
|
"2001:db8::1",
|
|
"2001:db8:ffff::1",
|
|
"::ffff:127.0.0.1",
|
|
"::ffff:10.1.2.3",
|
|
"::ffff:100.100.100.100",
|
|
"64:ff9b::7f00:1",
|
|
"64:ff9b::a01:203",
|
|
"::ffff:0.0.0.0",
|
|
"::127.0.0.1",
|
|
"::1.1.1.1",
|
|
"::ffff",
|
|
] {
|
|
assert!(!is_public(ip(s)), "{s} must be refused");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn public_ipv6() {
|
|
for s in [
|
|
"2606:4700:4700::1111",
|
|
"2a00:1450::1",
|
|
"fbff::1",
|
|
"fec0::1",
|
|
"2001:db9::1",
|
|
"::ffff:1.1.1.1",
|
|
"64:ff9b::101:101",
|
|
] {
|
|
assert!(is_public(ip(s)), "{s} is public");
|
|
}
|
|
}
|