Function is_link_local

crates/openshell-prover/src/queries.rs:51–57

Return true iff the host string parses as an IP in a reserved link-local range (IPv4 `169.254.0.0/16` or IPv6 `fe80::/10`). Hostname-only strings (not parseable as IPs) return false. We don't perform DNS resolution at validation time; the model evaluates the policy as written.

(host: &str)

/// perform DNS resolution at validation time; the model evaluates the
/// policy as written.
pub(crate) fn is_link_local(host: &str) -> bool {
    match host.parse::<IpAddr>() {
        Ok(IpAddr::V4(v4)) => v4.is_link_local(),
        Ok(IpAddr::V6(v6)) => v6.is_unicast_link_local(),
        Err(_) => false,
    }
}

/// Return true for static cloud metadata hostnames that should be treated like
/// link-local metadata reach without performing DNS resolution.