Harden relay SSRF validation with post-resolution IP filtering#278

Merged

kwsantiago merged 16 commits intomainfrom

Feb 26, 2026

Commits on Feb 26, 2026

Harden SSRF validation with post-resolution IP filtering

wksantiago
authored and
kwsantiago
committed
Fix cargo fmt formatting

wksantiago
authored and
kwsantiago
committed
Add allow-ws feature flag for test relay URLs

wksantiago
authored and
kwsantiago
committed
Block deprecated IPv6 site-local fec0::/10 in SSRF validation

wksantiago
authored and
kwsantiago
committed
Fix SSRF checks bypassed by workspace feature unification

wksantiago
authored and
kwsantiago
committed
Skip internal host check when allow-ws feature is enabled

wksantiago
authored and
kwsantiago
committed
Decouple SSRF guard from allow-ws and block NAT64 WKP embedded IPv4

wksantiago
authored and
kwsantiago
committed
Fix fmt and enable allow-internal for frost-net tests

wksantiago
authored and
kwsantiago
committed
Add URL-level tests for IPv4-compatible and NAT64 embedded address SSRF paths

wksantiago
authored and
kwsantiago
committed
Fix SSRF guard bypassed by Cargo feature unification

wksantiago
authored and
kwsantiago
committed
Fix allow-internal feature not activating for frost-net tests

wksantiago
authored and
kwsantiago
committed
Harden SSRF: 6to4, Teredo, doc-prefix, userinfo, .arpa/.onion
kwsantiago
committed
Simplify SSRF guard: use net type imports, consistent naming
kwsantiago
committed
Fix fmt
kwsantiago
committed
Add fec0::/10 test coverage and bunker relay empty-fallback
kwsantiago
committed
Run reproducible build only on push to main
kwsantiago
committed