Additional IP range validations

[daenney]

Commits are individually reviewable.

Since I was looking at this code yesterday I decided to take another pass through it:

• Added a check on the network to ensure it's always TCP
• Added IPv4-mapped range to v6 blocklist and add test for it. The behaviour is different between net and netip so it's useful to test and ensure we don't break this at some point
• I've aligned the reserved blocks with the respective IANA Special Purpose registries for v4 and v6
• Added some tests to ensure things are blocked especially for all the magical /32's on v4

[daenney]

This test feels a little redundant now:

gotosocial/internal/httpclient/client_test.go

Line 141 in e6cd81b

func TestHTTPClientPrivateIP(t *testing.T) {

But it's also a little underspecified given what it tests for:

gotosocial/internal/httpclient/client_test.go

Lines 33 to 43 in e6cd81b

	var privateIPs = []string{
	"http://127.0.0.1:80",
	"http://0.0.0.0:80",
	"http://192.168.0.1:80",
	"http://192.168.1.0:80",
	"http://10.0.0.0:80",
	"http://172.16.0.0:80",
	"http://10.255.255.255:80",
	"http://172.31.255.255:80",
	"http://255.255.255.255:80",
	}

I'm not sure what to do about that one, because retaining at least one test to ensure the Sanitizer is properly hooked up is valuable.

[NyaaaWhatsUpDoc]

This test feels a little redundant now:

gotosocial/internal/httpclient/client_test.go

Line 141 in e6cd81b

func TestHTTPClientPrivateIP(t *testing.T) {

But it's also a little underspecified given what it tests for:

gotosocial/internal/httpclient/client_test.go

Lines 33 to 43 in e6cd81b

	var privateIPs = []string{
	"http://127.0.0.1:80",
	"http://0.0.0.0:80",
	"http://192.168.0.1:80",
	"http://192.168.1.0:80",
	"http://10.0.0.0:80",
	"http://172.16.0.0:80",
	"http://10.255.255.255:80",
	"http://172.31.255.255:80",
	"http://255.255.255.255:80",
	}

I'm not sure what to do about that one, because retaining at least one test to ensure the Sanitizer is properly hooked up is valuable.

Leave it for now. As you say it checks the sanitizer is at least hooked up correctly :)

[NyaaaWhatsUpDoc]

If you're happy with everything here @daenney I'll merge this. Looks good to me, and thank you for the contribution!

[daenney]

Good to go from my side!

(also wow you're fast, I was not expecting a review at this time on a weekend)

[NyaaaWhatsUpDoc]

Good to go from my side!

(also wow you're fast, I was not expecting a review at this time on a weekend)

I work on this project outside my main job so more often than not you'll probably find me working at odd hours :'). Also your code is well written and easily reviewable!