Module remote_resolver 

Remote reference resolution — configuration and the trusted-server gate.

This module holds the configuration and the allowlist + SSRF guard for remote resolve(). See the user-facing docs in book/src/ch06-sql-on-fhir.md (“Remote resolution against trusted servers”) and the storage-backed follow-up tracked in issue #167.

It contains no networking. It only decides whether a given reference URL is eligible to be fetched from a trusted server, under a default-deny policy. The actual prefetch/fetch stage (Phase 4) consumes RemoteResolveConfig and reuses is_disallowed_ip for the post-DNS rebinding re-check.

Security posture (default-deny, strict allowlist)

A reference is fetchable only if all of the following hold:

1. Remote resolution is enabled and the allowlist is non-empty.
2. The reference is an absolute http/https URL.
3. It matches an allowlist entry on scheme + host + port + path-prefix (parsed-URL comparison, never substring — so https://evil/?u=https://trusted.org does not match https://trusted.org).

Because matching requires scheme equality, an http:// reference can only match an http:// allowlist entry — i.e. plaintext is allowed only where an operator has explicitly opted in (typically a trusted internal/test server). Likewise, a reference to a private/loopback IP literal can only be fetched if that exact IP host was explicitly allowlisted; otherwise it fails to match.

The is_blocked_address guard runs at the fetch stage on DNS-resolved addresses (DNS-rebinding defense). By default an allowlisted hostname that resolves to a private/internal address is refused; setting SOF_RESOLVE_ALLOW_PRIVATE_ADDRESSES=true (RemoteResolveConfig::allow_private_addresses) permits RFC1918 / IPv6-ULA targets so references can point at an internal load balancer or reverse proxy (e.g. Traefik) by hostname. The most dangerous ranges — loopback and link-local (incl. the cloud-metadata endpoint) — stay blocked either way.

Modules

env_keys

Environment variable names (documented in book/src/ch06-sql-on-fhir.md).

Structs

AllowedBaseUrl

A parsed, normalised trusted base URL.

RemoteResolveConfig

Configuration for remote (trusted-server) resolve().

Enums

AllowlistParseError

Errors from parsing a single allowlist entry.

DenyReason

Why a reference was denied remote resolution.

FetchDecision

Outcome of RemoteResolveConfig::fetch_decision.

Functions

is_blocked_address

SSRF guard parameterised by whether private/internal addresses are permitted.

is_disallowed_ip

Strict SSRF guard: true if ip must never be the target of a fetch under the default (most restrictive) policy.

parse_allowed_base_urls

Parses a comma-separated allowlist into trusted base URLs, skipping (and warning about) malformed entries. Exposed for CLI/server wiring that builds a RemoteResolveConfig from flags rather than the environment.