fix(signing): block AS112, AMT and ORCHIDv2 special-use ranges

Review follow-up: the deny list covered the two highest-value ranges the
flag check misses, but not the rest of the flag-missed set.

Verified across the whole supported interpreter matrix (3.10, 3.11, 3.12,
3.13) rather than assumed — four more ranges are non-reserved under all
six flags on every one of them:

  192.31.196.0/24  RFC 7535 AS112-v4 anycast
  192.52.193.0/24  RFC 7450 AMT anycast
  192.175.48.0/24  RFC 7534 AS112 direct delegation
  2001:20::/28     RFC 7343 ORCHIDv2

None is ever a legitimate JWKS or webhook destination. The ORCHIDv2 entry
also makes the tuple's IPv4|IPv6 annotation accurate rather than
forward-looking.

Three ranges named in the follow-up are NOT added, because the flags
already reject them on every supported version: 6to4 2002::/16, Teredo
2001::/32, and IPv4 NAT64 192.0.0.8 (plus NAT64 64:ff9b::/96 from an
earlier round). Their embedded IPv4 needs no decoding — the whole prefix
is rejected before anything is unwrapped. Since that block depends on
CPython's classification rather than on our list,
test_ssrf_flag_covered_special_ranges_stay_blocked pins it, so a future
reclassification surfaces as a failure instead of a silent hole.

Two corrections to the follow-up, both measured:

- 100.64.0.0/10 is is_private == False on 3.12.9 and 3.13.11, not just on
  pre-3.12.4 interpreters. The entry is load-bearing on every supported
  version, so no "redundant on newer Python" comment is warranted.
- `not ip.is_global` is not a usable substitute gate: is_global reports
  True for the 6to4-relay, AS112, AMT and ORCHIDv2 ranges on every
  supported version, so it would close none of these holes.

Also fixes the getaddrinfo mock shape: parametrised cases now build
AF_INET 2-tuple vs AF_INET6 4-tuple sockaddrs via a helper, so the IPv6
cases exercise a record the stdlib would actually produce.

Purely additive rejection of never-legitimate destinations; no public API
change.

Author: KonstantinMirin

src/adcp/signing/jwks.py

@@ -68,9 +68,35 @@
 # * ``192.88.99.0/24`` — RFC 7526 deprecated 6to4 relay anycast. Traffic
 #   sent here is tunnelled by whatever relay answers, which makes the
 #   destination unattributable; ``is_reserved`` does not cover it.
+# * ``192.31.196.0/24`` (RFC 7535 AS112-v4), ``192.52.193.0/24`` (RFC 7450
+#   AMT), ``192.175.48.0/24`` (RFC 7534 AS112 direct delegation) and
+#   ``2001:20::/28`` (RFC 7343 ORCHIDv2) — IANA special-use anycast and
+#   non-routable identifier space. None is ever a legitimate JWKS or webhook
+#   destination, and none is caught by any flag.
+#
+# Verified empirically across the supported interpreter matrix (3.10, 3.11,
+# 3.12, 3.13): every range above is classified non-reserved by all six flags on
+# ALL of them, so each entry is load-bearing on every supported version — none
+# is redundant anywhere. In particular ``100.64.0.0/10`` is still
+# ``is_private == False`` on 3.12.9 and 3.13.11.
+#
+# ``not ip.is_global`` is NOT a usable substitute: it reports True (i.e.
+# globally reachable) for the 6to4-relay, AS112, AMT and ORCHIDv2 ranges on
+# every supported version, so it would close none of these holes.
+#
+# Ranges deliberately absent because the flags already cover them on every
+# supported version — 6to4 ``2002::/16``, Teredo ``2001::/32``, NAT64
+# ``64:ff9b::/96``, and IPv4 NAT64 ``192.0.0.8``. Their embedded IPv4 needs no
+# decoding: the whole prefix is rejected before any address is unwrapped.
+# ``test_ssrf_flag_covered_special_ranges_stay_blocked`` pins that so a future
+# CPython reclassification cannot silently open them.
 _EXTRA_BLOCKED_NETWORKS: tuple[ipaddress.IPv4Network | ipaddress.IPv6Network, ...] = (
     ipaddress.ip_network("100.64.0.0/10"),
     ipaddress.ip_network("192.88.99.0/24"),
+    ipaddress.ip_network("192.31.196.0/24"),
+    ipaddress.ip_network("192.52.193.0/24"),
+    ipaddress.ip_network("192.175.48.0/24"),
+    ipaddress.ip_network("2001:20::/28"),
 )
 
 # Recommended destination ports for hardened SSRF-validated outbound HTTP

tests/conformance/signing/test_jwks.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import socket
 from typing import Any
 from unittest.mock import patch
 
@@ -19,6 +20,19 @@
 # ---- SSRF validation ----
 
 
+def _addrinfo(ip: str) -> tuple[int, int, int, str, tuple]:
+    """Build a `getaddrinfo` record with the sockaddr shape matching the family.
+
+    AF_INET carries a 2-tuple `(addr, port)`; AF_INET6 a 4-tuple
+    `(addr, port, flowinfo, scope_id)`. Parametrised tests mix both families,
+    and a v6 address in a v4-shaped record would exercise a resolution the
+    stdlib never actually produces.
+    """
+    if ":" in ip:
+        return (socket.AF_INET6, socket.SOCK_STREAM, 6, "", (ip, 0, 0, 0))
+    return (socket.AF_INET, socket.SOCK_STREAM, 6, "", (ip, 0))
+
+
 @pytest.mark.parametrize(
     "host_or_url",
     [
@@ -97,25 +111,67 @@ def test_ssrf_blocks_oracle_metadata() -> None:
         ("192.88.99.0", "RFC 7526 6to4 relay anycast lower bound"),
         ("192.88.99.1", "RFC 7526 deprecated 6to4 relay anycast"),
         ("192.88.99.255", "RFC 7526 6to4 relay anycast upper bound"),
+        ("192.31.196.1", "RFC 7535 AS112-v4 anycast"),
+        ("192.52.193.1", "RFC 7450 AMT anycast"),
+        ("192.175.48.1", "RFC 7534 AS112 direct delegation"),
+        ("2001:20::1", "RFC 7343 ORCHIDv2 (IPv6)"),
     ],
 )
 def test_ssrf_blocks_ranges_python_flags_miss(resolved_ip: str, why: str) -> None:
     """Reserved ranges that `ipaddress`'s own flags do not classify.
 
-    `is_private` is False across 100.64.0.0/10 — RFC 6598 designates shared
-    address space, not private space — so the flag check alone lets carrier
-    and container-network addresses through. AdCP 3.1.1 names the range in
-    the deny list a fetcher MUST apply ("Webhook URL validation (SSRF)",
-    step 2).
+    Every range here is non-reserved under all six flags on the whole
+    supported interpreter matrix (3.10-3.13) — verified empirically, not
+    assumed. `is_private` is False across 100.64.0.0/10 because RFC 6598
+    designates *shared* address space rather than private space, and it
+    remains False on 3.12.9 / 3.13.11, so the entry is load-bearing on every
+    supported version rather than redundant on newer ones.
+
+    AdCP 3.1.1 names 100.64.0.0/10 in the deny list a fetcher MUST apply
+    ("Webhook URL validation (SSRF)", step 2). The remainder are IANA
+    special-use anycast and non-routable identifier space, never a legitimate
+    JWKS or webhook destination.
     """
     with patch(
         "adcp.signing.jwks.socket.getaddrinfo",
-        return_value=[(2, 1, 6, "", (resolved_ip, 0))],
+        return_value=[_addrinfo(resolved_ip)],
     ):
         with pytest.raises(SSRFValidationError, match="reserved range"):
             validate_jwks_uri("https://buyer-supplied.example/jwks.json")
 
 
+@pytest.mark.parametrize(
+    ("resolved_ip", "why"),
+    [
+        ("2002:a9fe:a9fe::", "6to4 2002::/16 embedding 169.254.169.254"),
+        ("2002:0a00:0001::", "6to4 2002::/16 embedding 10.0.0.1"),
+        ("2001::1", "Teredo 2001::/32"),
+        ("64:ff9b::a9fe:a9fe", "NAT64 64:ff9b::/96 embedding 169.254.169.254"),
+        ("64:ff9b::a00:1", "NAT64 64:ff9b::/96 embedding 10.0.0.1"),
+        ("192.0.0.8", "IPv4 NAT64 dummy address"),
+    ],
+)
+def test_ssrf_flag_covered_special_ranges_stay_blocked(resolved_ip: str, why: str) -> None:
+    """Special-use ranges the flags already cover, pinned against regression.
+
+    These are deliberately NOT in `_EXTRA_BLOCKED_NETWORKS`: `ipaddress`
+    classifies the whole prefix reserved on every supported version, so the
+    embedded IPv4 in the tunnel forms needs no decoding — the address is
+    rejected before anything is unwrapped.
+
+    That makes the block a dependency on CPython's classification rather than
+    on our own list, which is exactly the kind of assumption worth pinning: if
+    a future release reclassified any of these, the deny list would need an
+    explicit entry and this test is what would say so.
+    """
+    with patch(
+        "adcp.signing.jwks.socket.getaddrinfo",
+        return_value=[_addrinfo(resolved_ip)],
+    ):
+        with pytest.raises(SSRFValidationError):
+            validate_jwks_uri("https://buyer-supplied.example/jwks.json")
+
+
 @pytest.mark.parametrize(
     ("resolved_ip", "why"),
     [