Repository navigation
sec(httpclient): extend the dial guard to NAT64/6to4 metadata forms and unspecified addresses; track private-range SSRF #152
Description
Follow-ups from the review of #148 (closes #48):
- pkg/httpclient/httpclient.go ~34: NAT64 64:ff9b::a9fe:a9fe and 6to4 2002:a9fe:a9fe::/48 are still dialled (relevant on IPv6-only hosts with DNS64/NAT64). Add 64:ff9b::a9fe:a9fe/128 and 2002:a9fe::/32 to metadataPrefixes.
- 0.0.0.0 and [::] are dialled and reach local services on macOS/Linux. Block unspecified addresses (httptest never uses them), or document it next to the loopback carve-out.
- sec(httpclient): the IMDS guard matches the hostname, not a resolved IP, so it is inert on the common case #48 also asked to block RFC 1918, CGNAT, ULA and loopback. sec(httpclient): enforce the metadata block on the resolved dial address #148 deliberately left them open (Azure Private Link and httptest need them). Decide whether to make them opt-in-blocked per client, to close SSRF into internal networks.
- Document that a caller-supplied *http.Client in providers/azure/services/{managedredis,savingsplans,synapse} bypasses the guard.
- Nit: resolve_test.go ~95 uses a fake resolver for the hex case, so it doesn't prove decimal/octal decoding; add a real-resolver case.
Activity
fix(httpclient): block NAT64, 6to4 and IPv4-compatible metadata forms…
IAmJSD commentedon Oct 16, 2026
Claiming: working on this
test(httpclient): cover IPv4-mapped and DNS-resolved embedded forms; …
cristim commentedon Nov 5, 2026
Status check against main (claude-ui-fix-1, fleet):
64:ff9b::/96and 6to42002::/16forms that embed a metadata address, plus IPv4-compatible forms, are blocked by fix(httpclient): block NAT64, 6to4 and IPv4-compatible metadata forms and unspecified addresses #234 (920bc33). The embedded IPv4 goes throughmetadataPrefixes, so every listed endpoint is covered.0.0.0.0,::) are refused by fix(httpclient): block NAT64, 6to4 and IPv4-compatible metadata forms and unspecified addresses #234.*http.Clientbypass is documented atpkg/httpclient/httpclient.go:12-13.The earlier claim (2026-10-16) has had no activity. Unless a decision on item 3 lands, this issue could be closed as done, with item 3 split out if wanted.
cristim commentedon Nov 9, 2026
Closing as completed (claude-ui-fix-1, 2026-11-10). Items 1, 2, 4 and 5 are done on main: NAT64/6to4 metadata forms and unspecified addresses are refused (#234), the caller-supplied *http.Client bypass is documented (pkg/httpclient/httpclient.go), and the resolver cases landed with #473. Item 3 (opt-in blocking of RFC 1918, CGNAT, ULA and loopback per client) is declined for now by decision (default A, recorded in the maintainer decision doc of 2026-11-10): no current caller passes untrusted URLs (the JWKS URL and the cloud endpoints are operator-configured), and Azure Private Link and httptest need the private ranges open by default, so an opt-in knob would have no real caller. File a new issue naming the caller when something fetching untrusted URLs needs it.