feat(go/ressrf-static): native Go SSRF evaluator (no WASM)

[arajkumar]

Summary

Adds a new sibling package go/ressrf-static — a pure-Go SSRF evaluator that
re-implements the full ressrf-core algorithm in Go and consumes the same
JSON policy data via //go:embed. The existing WASM-backed go/ressrf
package is untouched; the two coexist behind a behavioral parity gate.

Motivation. The user observed that the host-side Go bindings already do
their own URL parsing and net.ParseIP work before crossing the WASM
boundary, so the "shared parser" argument for WASM is weaker than it first
appears. Replacing wazero with a native evaluator drops a runtime dependency,
shrinks binaries, and makes future Java support a straight port instead of
a WASM-runtime integration. The cost is that cross-language conformance
vectors become load-bearing — and the new TestParityIPLevel /
TestParityURLLevel gates (129 cases) keep both backends in lockstep.

What landed

Core evaluator (mirrors crates/ressrf-core/src/* in Go):

• cidr.go — strict CIDR parser (rejects octal/hex/zone-IDs/host-bits), IPv4-mapped IPv6 normalization, CIDRSet linear-scan containment.
• uri_validator.go — scheme allowlist, userinfo bypass guard (@ + %40), domain-suffix boundary matching, control-char rejection (raw + %00/%0d/%0a), punycode passthrough, embedded IP-literal extraction, BS-5 backslash normalization, BS-6 UNC rejection.
• url_rules.go — host glob (* = one label), path glob (* = one segment, ** = any depth, recursive backtrack), regex via Go regexp/RE2; deny-first → no-allows-NoMatch → first-allow-wins → none-matched-Denied precedence.
• policy.go — PolicyBuilder fluent API. IsAllowed orchestrates URL rules → URI validator → bare-IP IP check. IsNetworkAllowed and ValidateHost handle IP-level decisions with preset-aware allow/deny semantics; empty IP list → dns_empty_response (Rust parity).
• cloud.go + cloudmod/ + cloud/{aws,azure,gcp,all}/ — tree-shakable cloud provider modules, see below.
• audit.go — AuditSink interface + typed event variants (HostValidated, URLValidated, ConnectionAttempt, RedirectIntercepted, PolicyCreated) + RecordingSink test helper.

Protocol adapters (mirror go/ressrf/protocol_*.go):

• protocol_tcp.go — SafeDialer / DialContext with a Control hook that runs after Go's DNS resolution, defeating DNS rebinding.
• protocol_http.go — HTTPTransport / HTTPClient / CheckRedirect with per-hop policy enforcement, max-redirects cap, and configurable HTTPS→HTTP downgrade rejection.
• protocol_ssh.go — SSHDial (defense in depth: URL-layer + post-DNS IP check via SafeDialer).

Data plumbing:

• embed.go — //go:embed config/ip_ranges.json (IANA tiers always needed).
• gen.go — four //go:generate directives copying the canonical files from crates/ressrf-core/config/. CI drift gate: go generate then git diff --exit-code.
• disabled.go, errors.go — process-wide Disabled() toggle + ErrBlocked sentinel matching go/ressrf so callers can swap imports.

Tree-shakable cloud providers (cloud/aws, cloud/azure, cloud/gcp, cloud/all):

• Each provider lives in its own sub-package with its own //go:embed. Only the providers you actually import are linked.
• Build the policy with b.WithCloudModule(aws.Module()) (type-safe — forgetting an import is a compile error).
• Provider sub-packages also expose DeniedSuffixes() / ServiceSuffixes() so callers can opt into domain-level cloud denial via WithDeniedSuffixes / WithTrustedSuffixes.
• Measured size impact (minimal program): aws-only = 6.7 MB; aws+azure+gcp = 9.9 MB → 3.2 MB savings when only AWS is needed (matches the Azure dataset size — the linker actually prunes it).
• A tiny cloudmod package holds the CloudModule value type to keep the dependency graph acyclic (sub-packages depend on cloudmod, not on ressrf-static). ressrfstatic.CloudModule is a type alias of cloudmod.Module so the user-facing name stays canonical.

Testing:

• All 8 cross-language vector files under tests/vectors/*.json are wired in. 354 subtests, zero failures.
• TestParityIPLevel + TestParityURLLevel (129 cases) run the same inputs through both go/ressrf (WASM) and go/ressrf-static (native) and assert identical allow/block outcomes. Zero divergences.
• bench_test.go mirrors go/ressrf/bench_test.go for direct comparison.

Tooling:

• New top-level go.work enables side-by-side development of the two modules; required for the cross-module parity test.

Benchmark numbers (Apple M1 Max, Go 1.26, -benchtime=5s on both sides)

Op	Native	WASM	Speedup
PolicyBuild	56 µs	7.8 ms	~140×
IsAllowed (allowed)	1.29 µs	2.40 µs	~1.9×
IsAllowed (blocked)	815 ns	3.08 µs	~3.8×
IsNetworkAllowed	481 ns	1.51 µs	~3.1×

Per-check operations are 2–4× faster. The big win is PolicyBuild (~140×):
the WASM-backed version pays for module instantiation each time. For
long-running services that build a policy once, this barely matters; for
short-lived CLIs or per-request policy construction, it's significant. The
non-performance benefits (no wazero runtime, no embedded ~1 MB core.wasm,
smaller binaries that can drop unused cloud datasets via the sub-package
split) are arguably more important than the speedup.

Earlier in PR review: I posted numbers showing ~50–60× speedup on per-check
ops. Those were wrong — the WASM-side benchmark was capped at -benchtime=2x
(literally 2 iterations) which produced cold-start-dominated noise. Commit
a6b2e9b corrects this in the README; this PR body reflects the corrected
numbers.

Reproduce with:

go test -bench=. -benchmem -run=^$ -benchtime=5s ./go/ressrf-static/...
go test -bench=. -benchmem -run=^$ -benchtime=5s ./go/ressrf/...

Quick start

import (
    "github.com/timescale/ressrf/go/ressrf-static"
    "github.com/timescale/ressrf/go/ressrf-static/cloud/aws" // only the providers you need
)

p, _ := ressrfstatic.NewPolicyBuilder(ressrfstatic.PresetExternalOnly).
    WithCloudModule(aws.Module()).
    Build()

p.IsAllowed(ctx, "http://169.254.169.254/")             // *BlockedError
p.IsNetworkAllowed([]string{"10.0.0.1"})                // *BlockedError
client := p.HTTPClient(nil)                              // SSRF-safe http.Client
dialer := p.SafeDialer()                                 // SSRF-safe net.Dialer
sshClient, _ := p.SSHDial(ctx, "host:22", sshConfig)     // SSRF-safe ssh.Client

Reviewer notes

• The Python generator (scripts/generate_ip_ranges.py) is reused as-is — this PR explicitly does not port it. The Go package consumes the same crates/ressrf-core/config/*.json outputs via four //go:generate cp directives + drift gate.
• Cloud modules are deny-CIDRs-only (matches what crates/ressrf-wasm/src/lib.rs does via builder.with_cloud(...)). Domain-level cloud denial is an opt-in via WithDeniedSuffixes(aws.DeniedSuffixes()...). This keeps the parity gate clean — diverging here would make WASM↔native comparison impossible.
• Audit sink shape differs between this package (typed event variants) and go/ressrf (flat AuditEvent{Kind, Fields json.RawMessage}). Both implement the spirit of audit.rs; the API divergence was acceptable because audit isn't part of the parity gate.
• go/ressrf is untouched. This is a strict additive change. Recommendation is to keep both packages side-by-side for at least one release while ressrf-static gets production miles.
• Regex caveat: URL-rule regexes are compiled with Go regexp (RE2). The Rust core uses the regex crate, which is also linear-time. Same feature set for the common cases; Rust-specific Unicode classes might need translation if encountered (add a vector if you find one).

Test plan

• go test ./go/ressrf-static/... -count=1 — 354 subtests pass
• go test -run TestParity ./go/ressrf-static/... — 129 parity cases, zero divergences
• go generate ./go/ressrf-static/... && git diff --exit-code go/ressrf-static/{config,cloud}/ — drift gate clean
• go vet ./go/ressrf-static/... — clean
• Binary-size check (minimal main): aws-only = 6.7 MB, all-providers = 9.9 MB → 3.2 MB savings when only AWS is needed
• go test -bench=. -benchmem -benchtime=5s ./go/ressrf-static/... and same on ./go/ressrf/... — equal-budget benchmarks, numbers documented above
• go list -m -deps ./go/ressrf-static/... | grep -i wazero — empty (no WASM runtime dependency)
• Reviewer: run the parity gate on your machine and confirm zero divergences before merging
• Reviewer: skim README.md for the architecture / caveats overview

Out of scope

• Removing or deprecating go/ressrf (keep both for at least one release for diff testing).
• Python/Node/Java bindings — this PR only proves the Go side.
• Changing the JSON data files or adding new presets.
• Switching CI's monthly refresh from Python to Go.