net

func HardenTransport ¶ added in v1.8.17

func HardenTransport(transport *http.Transport, dialer *net.Dialer)

HardenTransport configures the given transport to block connections to link-local IP addresses (169.254.0.0/16 and fe80::/10) and the AWS EC2 IPv6 instance metadata address (fd00:ec2::254). This prevents SSRF attacks targeting cloud instance metadata endpoints. It modifies the transport in place. All four of the transport's dial functions are replaced or cleared. All other properties of the transport are left alone, including proxy and TLS configuration.

If dialer is nil, a new dialer with 30 second connect and keep-alive timeouts is used. Any supplied dialer is never modified.