Function guardedDialControl

internal/webhook/ssrf.go:38–51

guardedDialControl is a net.Dialer.Control hook that rejects a connection whose resolved address is a disallowed (private/loopback/link-local/…) IP. It runs AFTER DNS resolution with the concrete address the socket will connect to, so the IP that is validated is exactly the IP that is dialed — no re

(_, address string, _ syscall.RawConn)

// no resolve-then-re-resolve TOCTOU. This is the second line of defense the
// registration-time check cannot provide once a hostname's DNS can change.
func guardedDialControl(_, address string, _ syscall.RawConn) error {
	host, _, err := net.SplitHostPort(address)
	if err != nil {
		return fmt.Errorf("webhook dial: bad address %q: %w", address, err)
	}
	ip := net.ParseIP(host)
	if ip == nil {
		return fmt.Errorf("webhook dial: unparseable resolved address %q", host)
	}
	if IsDisallowedWebhookIP(ip) {
		return fmt.Errorf("webhook dial blocked: resolved to disallowed IP %s", ip)
	}
	return nil
}