Classification fixes in pkg/ssrf, each pinned by a test:
- Block fec0::/10 (deprecated site-local, still internal scope on legacy
gear), SIIT IPv4-translated ::ffff:0:0:0/96, and Teredo 2001::/32,
which embed v4 targets that To4() does not normalize.
- Stop blanket-blocking the NAT64 well-known prefix 64:ff9b::/96.
DNS64 resolvers synthesize it for every public IPv4-only endpoint, so
blocking the whole prefix broke all guarded dials in IPv6-only
networks. IsNonPublicIP now extracts the embedded v4 from the low 32
bits and classifies that instead, so 64:ff9b::a00:1 (10.0.0.1) stays
blocked while 64:ff9b::808:808 (8.8.8.8) is reachable. The RFC8215
local-use prefix stays blanket-blocked since its embedding layout is
operator-defined.
Analyzer client coverage: analyzers take their endpoints from scanned
content (a secret's domain, a connection string), but the clients built
in pkg/analyzer/analyzers used bare http.DefaultTransport. They now
build on a guarded transport behind an opt-in SetEgressRestriction
toggle, default off so the CLI and self-hosted behavior is unchanged.
This covers NewAnalyzeClient, NewAnalyzeClientUnrestricted, the
rate-limiter fallback transport, and HttpStatusTest.RunTest's bare
client.
Bill Rich
1923347d28