Skip to main content

is_blocked_address

helios_sof::remote_resolver

Function is_blocked_address 

Source 
pub fn is_blocked_address(ip: IpAddr, allow_private: bool) -> bool
Expand description

SSRF guard parameterised by whether private/internal addresses are permitted.

Applied by the fetch stage to addresses obtained from DNS resolution (to defeat DNS rebinding): an allowlisted hostname that resolves to a blocked address is refused.

  • The always-blocked ranges are refused regardless of allow_private: loopback, link-local (incl. the 169.254.169.254 cloud-metadata endpoint), unspecified, broadcast, multicast, carrier-grade NAT, documentation/test, and reserved (0.0.0.0/8, 240.0.0.0/4).
  • The private/internal ranges — RFC1918 (10/8, 172.16/12, 192.168/16) and IPv6 ULA (fc00::/7) — are refused only when allow_private is false. Setting it true (via SOF_RESOLVE_ALLOW_PRIVATE_ADDRESSES) lets an allowlisted hostname point at an internal load balancer / reverse proxy.