net

func SafeDialContext ¶

func SafeDialContext(dialer *net.Dialer) func(
	ctx context.Context,
	network string,
	addr string,
) (net.Conn, error)

SafeDialContext returns a DialContext function that blocks connections to link-local IP addresses (169.254.0.0/16 and fe80::/10). This prevents SSRF attacks targeting cloud instance metadata endpoints (e.g. 169.254.169.254).

The returned function resolves the hostname before connecting and rejects the connection if all resolved addresses are link-local.

func SafeTransport ¶

func SafeTransport(t *http.Transport) *http.Transport

SafeTransport wraps the given transport's DialContext to block connections to link-local IP addresses.