httpdial

Documentation

Overview

Package httpdial is the single source of truth for iterion's SSRF guard: resolving an operator/admin-supplied host to a safe IP and dialing only that pinned IP (DNS-rebinding-proof). It backs the studio preview proxy (pkg/server), completion webhooks (pkg/notify), and the per-org OIDC SSO connectors (pkg/auth/oidc), which fetch discovery/token/userinfo/JWKS endpoints derived from an org-admin-supplied issuer URL.

The guard blocks the conventional SSRF categories — loopback, private (RFC1918 / ULA), link-local, multicast, unspecified — plus the cloud metadata endpoints, and refuses conventional cluster-internal hostname aliases that service meshes re-route even with no DNS record.

Index

• func IsLoopbackBind(bind string) bool
• func IsPublicUnicast(ip net.IP) bool
• func ResolvePublicHost(ctx context.Context, host string, strict bool) (net.IP, error)
• func SafeClient(strict bool, timeout time.Duration) *http.Client
• func SafeTransport(strict bool) *http.Transport

Functions

func IsLoopbackBind

func IsLoopbackBind(bind string) bool

IsLoopbackBind returns true when bind is one of the conventional loopback identifiers. Callers use it to decide whether the permissive "let the user embed/reach their own dev servers" mode is safe (loopback-bound = safe).

func IsPublicUnicast

func IsPublicUnicast(ip net.IP) bool

IsPublicUnicast reports whether ip is safe to dial from a cloud pod context. The blocked set matches the typical SSRF blocklist plus AWS/GCP/Azure/Alibaba metadata endpoints.

func ResolvePublicHost

func ResolvePublicHost(ctx context.Context, host string, strict bool) (net.IP, error)

ResolvePublicHost resolves host and returns a single IP safe to dial. When strict, every resolved IP must be public unicast — any private/link-local/ loopback/multicast/metadata hit (or a reserved cluster-internal alias) refuses. When non-strict, the first resolved address is returned regardless (loopback-bound local mode embedding the user's own dev servers). Resolution always fails closed.

func SafeClient

func SafeClient(strict bool, timeout time.Duration) *http.Client

SafeClient wraps SafeTransport in an *http.Client that does NOT auto-follow redirects (each hop would re-target an unvalidated host; the caller decides whether to chase a 3xx, re-entering the guard).

func SafeTransport

func SafeTransport(strict bool) *http.Transport

SafeTransport returns an *http.Transport whose DialContext resolves the target host through ResolvePublicHost (strict→public-unicast) and pins the dial to that validated IP. Because the guard runs on *every* new connection, endpoints discovered at runtime (an OIDC token/userinfo/JWKS URL read from a discovery doc) are re-validated too — closing second-order SSRF. The original host travels in the Host header / TLS SNI so virtual-hosted and TLS-terminated upstreams behave correctly.