Struct DnsPolicy 

pub struct DnsPolicy {
    pub block_private: bool,
}

Policy for DNS resolution and IP validation

When block_private is enabled, resolved IP addresses are checked against known private/reserved ranges before the connection is established.

Examples

use fetchkit::DnsPolicy;

let policy = DnsPolicy::block_private_ips();
assert!(policy.is_blocked_ip("127.0.0.1".parse().unwrap()));
assert!(policy.is_blocked_ip("10.0.0.1".parse().unwrap()));
assert!(!policy.is_blocked_ip("8.8.8.8".parse().unwrap()));

Fields

block_private: bool

Block private/reserved IP ranges

Implementations

impl DnsPolicy

pub fn block_private_ips() -> Self

Create a policy that blocks private/reserved IP ranges

Blocks:

• Loopback (127.0.0.0/8, ::1)
• Private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Link-local (169.254.0.0/16, fe80::/10)
• Unspecified (0.0.0.0, ::)
• Documentation (192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24)
• Benchmarking (198.18.0.0/15)
• Carrier-grade NAT (100.64.0.0/10)
• Unique local IPv6 (fc00::/7)
• Multicast (224.0.0.0/4, ff00::/8)
• Broadcast (255.255.255.255)

pub fn allow_all() -> Self

Create a permissive policy (no IP blocking)

pub fn is_blocked_ip(&self, ip: IpAddr) -> bool

Check if an IP address is in a blocked range

Handles IPv6-mapped IPv4 addresses by canonicalizing first.

pub fn pinned_addrs( &self, host: &str, port: u16, ) -> Result<Vec<SocketAddr>, DnsPolicyError>

Produce the pinned socket addresses for a host that a transport must connect to.

When the policy blocks private IPs this runs resolve-then-check and returns the validated address (TM-SSRF-001, TM-SSRF-005). When the policy is permissive (allow_all) it returns an empty vec, signalling that the transport may resolve the host itself.

Arguments

• host - Hostname to resolve
• port - Port to use in the returned SocketAddr

pub fn resolve_and_validate( &self, host: &str, port: u16, ) -> Result<SocketAddr, DnsPolicyError>

Resolve a hostname and validate all resolved IPs against the policy

Returns the first valid (non-blocked) socket address, or an error if all resolved addresses are blocked or resolution fails.

Arguments

• host - Hostname to resolve
• port - Port to use in the returned SocketAddr

Trait Implementations

impl Clone for DnsPolicy

fn clone(&self) -> DnsPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DnsPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DnsPolicy

Default is safe: blocks private/reserved IPs

fn default() -> Self

Returns the “default value” for a type.