Function IsBlockedLocalHostname

internal/netutil/netutil.go:49–68

IsBlockedLocalHostname returns true if given hostname is resolved to a local network address that is implicitly blocked (i.e. not exempted from the allowlist).

(hostname string, allowlist []string)

// network address that is implicitly blocked (i.e. not exempted from the
// allowlist).
func IsBlockedLocalHostname(hostname string, allowlist []string) bool {
	for _, allow := range allowlist {
		if hostname == allow || allow == "*" {
			return false
		}
	}

	ips, err := net.LookupIP(hostname)
	if err != nil {
		return true
	}
	for _, ip := range ips {
		for _, cidr := range localCIDRs {
			if cidr.Contains(ip) {
				return true
			}
		}
	}
	return false
}