Documentation
¶
Overview ¶
Package netguard classifies a listen address as loopback-only or not, so the web and control surfaces can stay private by default and warn loudly when a deployment binds them where the world can reach. The check resolves the host and range-checks the resulting IP rather than string-matching a name, because string matching is exactly what let a trailing-dot hostname slip past OpenClaw's loopback guard (CVE-2026-41372).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsLoopback ¶
IsLoopback reports whether addr binds only to a loopback interface. addr may carry a port ("127.0.0.1:8765"), be a bare host ("::1", "localhost"), or be an IPv6 literal in brackets. An empty host, the unspecified address (0.0.0.0, ::), or anything that resolves to a routable IP is not loopback.
Every tricky spelling of loopback must land as true and every spelling of "all interfaces" as false: a bare decimal like 2130706433 is the inet_aton form of 127.0.0.1, a trailing dot ("localhost.") is the same name rooted at the DNS root, and case does not matter. Getting any of these wrong is how an instance ends up reachable from the internet by accident.
Types ¶
This section is empty.
Source Files