util

func DisallowedAddrReason ¶ added in v1.32.0

func DisallowedAddrReason(ip net.IP) string

DisallowedAddrReason returns why a connection must not reach ip, or "" when the address is allowed. It checks ip itself, then every IPv4 address that ip embeds (see EmbeddedIPv4), so a NAT64, 6to4 or Teredo form cannot hide a refused IPv4 address.

func EmbeddedIPv4 ¶ added in v1.32.0

func EmbeddedIPv4(ip net.IP) []net.IP

EmbeddedIPv4 returns the IPv4 addresses that an IPv6 address carries under the IPv4-compatible (::/96), NAT64 (64:ff9b::/96, 64:ff9b:1::/48), 6to4 (2002::/16) and Teredo (2001::/32) prefixes. IPv4 and ::ffff: forms return nil, because the class checks already read them as IPv4.

func GuardedDialContext ¶ added in v1.34.0

func GuardedDialContext(allowLoopback bool) func(ctx context.Context, network, addr string) (net.Conn, error)

GuardedDialContext returns a dial function that checks each resolved address against the process-wide egress policy before connecting.

func GuardedHTTPTransport ¶ added in v1.34.0

func GuardedHTTPTransport(allowLoopback bool) *http.Transport

GuardedHTTPTransport returns a clone of http.DefaultTransport whose DialContext is guarded by the egress policy. Use it for the HTTPS-based connectors (snowflake, trino, databricks), so the TCP connection underneath each HTTPS request is checked against the dialled IP.

func RefusedClass ¶ added in v1.32.0

func RefusedClass(ip net.IP) (string, net.IP)

RefusedClass returns the shared-fixture class of ip and the embedded IPv4 address the class was decided on. The class is "" when ip is allowed, and the embedded address is nil unless an embedded IPv4 address decided it.

func SetBlockedCIDRs ¶ added in v1.34.0

func SetBlockedCIDRs(cidrs []*net.IPNet)

SetBlockedCIDRs replaces the process-wide blocked ranges. It copies the ranges so callers cannot change the active policy after setting it.

func ValidateHost ¶

func ValidateHost(hostname string, opts ...HostValidationOption) error

ValidateHost checks that the hostname is resolvable and that none of the addresses it resolves to are ones a warehouse connection should ever reach.

Rejected: unspecified (0.0.0.0, ::), loopback, link-local — which covers the instance metadata endpoint 169.254.169.254 — multicast, and AWS's reserved prefix for instance metadata over IPv6. An IPv6 answer that embeds an IPv4 address (NAT64, 6to4, Teredo) is also checked on the embedded address.

Private RFC1918/ULA space is deliberately NOT rejected. Warehouses reached over AWS PrivateLink resolve to a private address in the customer's VPC, so rejecting private space would break every such connection. Those ranges are customer-chosen and can overlap our own, which means they cannot be told apart from in-cluster addresses by inspecting the IP alone — blocking in-cluster services needs an operator-supplied CIDR list instead, which is tracked separately.

Note this cannot defend against DNS rebinding: the address checked here is not necessarily the address dialled later. It raises the bar for a caller-supplied host without claiming to close that gap.