netguard

func BlockedIP ¶

func BlockedIP(ip netip.Addr) bool

BlockedIP reports whether an outbound connection to ip must be refused to prevent SSRF: loopback, link-local (incl. the cloud metadata endpoint), multicast, and unspecified addresses are blocked. Private RFC-1918 ranges are intentionally allowed (legitimate private clusters live there).

func GuardedDialContext ¶

func GuardedDialContext(base *net.Dialer) func(ctx context.Context, network, addr string) (net.Conn, error)

GuardedDialContext returns a DialContext that resolves the host, refuses the dial if ANY resolved address is blocked (matching the validation-time guard's all-addresses policy), and connects to the exact validated IPs in order to close the resolve->dial TOCTOU window (DNS rebinding) while preserving multi-address failover for HA hosts. base may be nil (a default dialer with a sane timeout is used).

After confirming that no resolved address is blocked, each IP is tried in the order returned by the resolver; the first successful connection is returned. If every IP fails, the last dial error is returned (wrapped). The hostname is never re-resolved between attempts so the TOCTOU guarantee is preserved.

func ValidateHost ¶

func ValidateHost(host string) error

ValidateHost resolves host (a "host" or "host:port") and returns an error if it is empty or any resolved address is blocked (see BlockedIP).

This is a pre-flight check that turns obviously unsafe destinations into a friendly validation error before any connection is attempted. It is not the enforcement point: DNS can change between this check and the dial, so outbound connections must still go through GuardedDialContext.

func ValidateURL ¶

func ValidateURL(raw string) error

ValidateURL parses raw, requires an http(s) scheme, and validates its host with ValidateHost. Like ValidateHost it is a pre-flight check only.