customresolver

README

go-customresolver

go-customresolver provides a hacky middleware that can be used to override what net.Resolver returns. It's useful for things like filtering out IP addresses to prevent server-side request forgery when making HTTP requests with untrusted input.

Only A/AAAA records are currently supported. In other words, LookupAddr, LookupHost, LookupIP and LookupIPAddr should work, but other Resolver methods won't.

Installation & docs

go get go.mau.fi/customresolver

https://pkg.go.dev/go.mau.fi/customresolver

Documentation

Index

• func New(lookup LookupIPFunc) *net.Resolver
• type LookupIPFunc

Examples

• New

Functions

func New

func New(lookup LookupIPFunc) *net.Resolver

New returns a net.Resolver that uses the given LookupIPFunc for all queries through a fake in-memory dialer.

Example

package main

import (
	"context"
	"fmt"
	"net"
	"net/http"

	"go.mau.fi/customresolver"
)

func main() {
	// Create a custom resolver that filters out private IP addresses.
	resolver := customresolver.New(func(ctx context.Context, network, host string) ([]net.IP, error) {
		ips, err := net.DefaultResolver.LookupIP(ctx, network, host)
		if err != nil {
			return nil, err
		}

		var filtered []net.IP
		for _, ip := range ips {
			if !ip.IsPrivate() && !ip.IsLoopback() {
				filtered = append(filtered, ip)
			}
		}
		return filtered, nil
	})

	// Create an HTTP client that uses the custom resolver.
	client := &http.Client{
		Transport: &http.Transport{
			DialContext: (&net.Dialer{Resolver: resolver}).DialContext,
		},
	}

	// This request will fail, because 192.168.1.1.sslip.io resolves to 192.168.1.1, which is a private IP
	_, err := client.Get("https://192.168.1.1.sslip.io/")
	fmt.Println(err)
	// This request should succeed
	resp, err := client.Get("https://example.com/")
	fmt.Println(err)
	fmt.Println(resp.StatusCode)
	_ = resp.Body.Close()
}

Types

type LookupIPFunc

type LookupIPFunc func(ctx context.Context, network, host string) ([]net.IP, error)