IsDisallowedWebhookIP reports whether ip is in a range a webhook must never reach (loopback, RFC-1918 private, link-local incl. the cloud metadata endpoint 169.254.169.254, CGNAT shared space, multicast, unspecified, IPv6 ULA). Shared by registration-time validation (agent.ValidateWebhookURL) and th
(ip net.IP)
| 14 | // DNS-rebinding window where a host validates as public at registration then |
| 15 | // re-resolves to an internal address before delivery. |
| 16 | func IsDisallowedWebhookIP(ip net.IP) bool { |
| 17 | if ip == nil { |
| 18 | return true |
| 19 | } |
| 20 | if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || |
| 21 | ip.IsLinkLocalMulticast() || ip.IsMulticast() || ip.IsUnspecified() { |
| 22 | return true |
| 23 | } |
| 24 | // CGNAT shared address space (RFC 6598, 100.64.0.0/10) is not covered by |
| 25 | // IsPrivate but is just as unroutable/internal. |
| 26 | if ip4 := ip.To4(); ip4 != nil && ip4[0] == 100 && ip4[1] >= 64 && ip4[1] <= 127 { |
| 27 | return true |
| 28 | } |
| 29 | return false |
| 30 | } |
| 31 | |
| 32 | // guardedDialControl is a net.Dialer.Control hook that rejects a connection |
| 33 | // whose resolved address is a disallowed (private/loopback/link-local/…) IP. |
no outgoing calls