security: reconstruct special-purpose IP policy on current main - #173
security: reconstruct special-purpose IP policy on current main#173seonghobae wants to merge 20 commits into
Conversation
|
Warning Review limit reached
Next review available in: 57 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughCPython 버전별 특수 목적 주소 분류 차이를 보정하는 정적 오버레이를 추가했습니다. 원격 주소 검증은 오버레이 범위를 먼저 적용합니다. 관련 정책 문서, 변경 기록, 호환성 테스트 및 문서 일치성 테스트를 추가했습니다. Changes특수 목적 주소 호환성
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant RemoteHost as 원격 호스트
participant Validation as validation.py
participant Overlay as 특수 목적 주소 오버레이
participant Ipaddress as ipaddress
RemoteHost->>Validation: 원격 주소 전달
Validation->>Overlay: 검토된 범위 확인
Overlay-->>Validation: 허용, 거부 또는 미일치 결과
Validation->>Ipaddress: 미일치 주소 분류
Ipaddress-->>Validation: 런타임 분류 결과
Validation-->>RemoteHost: EgressWeave 접근 판정
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
|
|
@coderabbitai review Please review the unchanged exact current head |
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/research/special-purpose-address-classification.md`:
- Line 9: Python 문서 버전 참조를 현재 3.14.7로 갱신하십시오.
docs/research/special-purpose-address-classification.md의 9행 검증 근거와 52행 APA 참고문헌을
업데이트하고, tests/test_special_address_registry_documentation.py의 19-29행 테스트 토큰도 동일한
3.14.7 버전을 검증하도록 변경하십시오.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ea0a904b-8d11-45e3-baba-38ce87c332da
📒 Files selected for processing (6)
CHANGELOG.mddocs/research/README.mddocs/research/special-purpose-address-classification.mdsrc/egressweave/validation.pytests/test_special_address_registry_compatibility.pytests/test_special_address_registry_documentation.py
|
@coderabbitai review Please review the unchanged exact current head |
|
I will report only actionable findings on this exact head. I will not use predecessor-head evidence or the resolved Python-version finding.
|
|
@coderabbitai review |
|
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='52a5c6a0862e0d035b0698b79a0e8556269e0b00'
head='2ce54e912cdb6cf267dcacef427dc38893f6fb0d'
echo '== Commit identity and ancestry =='
git rev-parse HEAD
git cat-file -t "$base"
git cat-file -t "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=yes'
echo '== Exact changed files =='
git diff --name-status "$base" "$head"
echo '== Exact diff stat =='
git diff --stat "$base" "$head"
echo '== Validation outline =='
ast-grep outline src/egressweave/validation.py --items all --view expanded || true
echo '== Test outlines =='
fd -t f 'special_address|special-purpose|registry' tests docs src \
-x sh -c 'echo "== $1 =="; ast-grep outline "$1" --items all --view expanded || true' sh {}
echo '== Exact diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
src/egressweave/validation.py \
tests/test_special_address_registry_compatibility.py \
tests/test_special_address_registry_documentation.py \
docs/research/README.md \
docs/research/special-purpose-address-classification.md \
CHANGELOG.mdLength of output: 52255 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Validation functions and call sites =='
rg -n -C 12 \
'def (_validate_global_address|_validate_bounded_unique_addresses|_resolve_all_global_addresses_blocking|_revalidate_pinned_egress_url|validate_egress_url_details)|_validate_global_address\s*\(' \
src tests
echo '== Authority validation and validation entry points =='
sed -n '330,525p' src/egressweave/validation.py
echo '== EgressPolicy outline and relevant source =='
policy_file=$(fd -t f '^policy\.py$' src | head -n 1)
printf 'policy file: %s\n' "$policy_file"
ast-grep outline "$policy_file" --items all --view expanded
rg -n -C 10 \
'class EgressPolicy|def from_hosts|def is_allowlisted_local_host|def is_allowed|allow_local|allowed_hosts|allowed_ports' \
"$policy_file"
echo '== Packaging and test configuration =='
fd -t f '^(pyproject\.toml|tox\.ini|setup\.cfg|\.python-version)$' . \
-x sh -c 'echo "== $1 =="; sed -n "1,260p" "$1"' sh {}
echo '== All references to overlay constants and validation entry points =='
rg -n -C 4 \
'_SPECIAL_PURPOSE_(GLOBAL_EXCEPTIONS|NON_GLOBAL_NETWORKS)|_special_purpose_global_override|validate_egress_url_details|_revalidate_pinned_egress_url' \
.Length of output: 101555 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='52a5c6a0862e0d035b0698b79a0e8556269e0b00'
head='2ce54e912cdb6cf267dcacef427dc38893f6fb0d'
echo '== Diff hygiene =='
git diff --check "$base" "$head"
git diff --numstat "$base" "$head"
echo '== Workflow files and Python matrix references =='
fd -HI -t f .github \
-x sh -c 'echo "== $1 =="; rg -n -C 5 "(python-version|python-version-file|3\\.10|3\\.11|3\\.12|3\\.13|3\\.14|pytest|coverage)" "$1" || true' sh {}
echo '== Exact current changed-file hashes =='
git diff --no-ext-diff --name-only "$base" "$head" | while IFS= read -r file; do
printf '%s ' "$file"
git show "$head:$file" | sha256sum | cut -d' ' -f1
doneLength of output: 1794 🤖 web_search executed:
Length of output: 18685 🤖 web_search executed:
Length of output: 13682
The exact diff otherwise preserves authority validation, local-development restrictions, DNS validation, pinned-address revalidation, and fail-closed address handling. I did not transfer the resolved predecessor-head thread.
|
|
@coderabbitai review Please re-review exact current head Also revalidate the resolved Python-version comment against current primary sources rather than the scheduled date alone: PEP 745 lists 3.14.7 as an expected 2026-08-04 bugfix release, while the current Python.org release/documentation listings and latest official 3.14 release announcement still identify 3.14.6 as the released 3.14 line. Do not require a future/unreleased patch number merely because its planned date has passed. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='52a5c6a0862e0d035b0698b79a0e8556269e0b00'
head='2ce54e912cdb6cf267dcacef427dc38893f6fb0d'
echo '== Exact commit verification =='
git rev-parse HEAD
git cat-file -t "$base"
git cat-file -t "$head"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=yes'
echo '== Exact changed files =='
git diff --name-status "$base" "$head"
git diff --check "$base" "$head"
echo '== Changed-file outlines =='
for file in \
src/egressweave/validation.py \
tests/test_special_address_registry_compatibility.py \
tests/test_special_address_registry_documentation.py; do
if git cat-file -e "$head:$file" 2>/dev/null; then
echo "== $file =="
ast-grep outline "$file" --items all --view expanded || true
fi
done
echo '== Exact review diff =='
git diff --find-renames --unified=50 "$base" "$head" -- \
src/egressweave/validation.py \
tests/test_special_address_registry_compatibility.py \
tests/test_special_address_registry_documentation.py \
docs/research/README.md \
docs/research/special-purpose-address-classification.md \
CHANGELOG.md
echo '== Validation call paths and policy interfaces =='
rg -n -C 10 \
'def (_validate_global_address|_validate_bounded_unique_addresses|_resolve_all_global_addresses_blocking|_revalidate_pinned_egress_url|validate_egress_url_details)|_validate_global_address\s*\(|_SPECIAL_PURPOSE_(GLOBAL_EXCEPTIONS|NON_GLOBAL_NETWORKS)|_special_purpose_global_override' \
src tests
policy_file="$(fd -t f '^policy\.py$' src | head -n 1)"
if [ -n "$policy_file" ]; then
echo "== $policy_file =="
rg -n -C 10 \
'class EgressPolicy|def (from_hosts|is_allowlisted_local_host|is_allowed)|allow_local|allowed_hosts|allowed_ports' \
"$policy_file"
fi
echo '== Documentation-test assertions =='
rg -n -C 6 \
'3\.14\.|special-purpose|Special-Purpose|IANA|_SPECIAL_PURPOSE' \
tests/test_special_address_registry_documentation.py \
docs/research/special-purpose-address-classification.md \
docs/research/README.md \
CHANGELOG.mdLength of output: 114467 🤖 web_search executed:
Length of output: 4044 🤖 web_search executed:
Length of output: 16767
The exact diff otherwise preserves local-development restrictions, authority validation, DNS pinning, and transport revalidation. The current IANA and Python
|
|
Current-head refresh complete: protected main |
|
@coderabbitai review |
|
|
Superseded by #223, which reconstructs the special-purpose registry compatibility boundary directly on exact protected |
1 participant
Purpose
Reconstruct issue #95 / historical PR #96 directly on the current protected
main. Historical #96 checks, reviews, approvals, base identity and mergeability do not transfer.Exact current identity
1d2e19049354115776804c66b9366fad2ea5b6c5;74211307bf83d8089ca0c935a8a6664ca897ffce;Security boundary
The reviewed compatibility overlay keeps known special-purpose ranges fail-closed across supported Python
ipaddressmetadata while preserving explicit current globally reachable exceptions, local-development semantics, normalized authority, DNS pinning/revalidation, generic denial errors, dependencies, credentials, workflows, release authority, and public API. No runtime registry download is used.Exact current-head local proof
On unchanged
74211307bf83d8089ca0c935a8a6664ca897ffce:Keep Draft pending fresh hosted current-head review/security evidence and the separately governed dependency-review prerequisite. Aggregate Security Scan success is not dependency-review acceptance while the actual pinned action is skipped. Do not self-approve, Admin-merge, bypass, or auto-merge.
Progresses #95; intended to supersede #96 only after current-tree proof preserves its unique work.