isPrivateIP reports whether the IP is on a network that must not be reachable when fetching certificates. IPv4-mapped IPv6 addresses are canonicalized to IPv4 first so a literal like ::ffff:169.254.169.254 cannot bypass the IPv4 ranges.
(ip net.IP)
| 81 | // addresses are canonicalized to IPv4 first so a literal like |
| 82 | // ::ffff:169.254.169.254 cannot bypass the IPv4 ranges. |
| 83 | func isPrivateIP(ip net.IP) bool { |
| 84 | if v4 := ip.To4(); v4 != nil { |
| 85 | ip = v4 |
| 86 | } |
| 87 | if ip.IsLoopback() || |
| 88 | ip.IsPrivate() || |
| 89 | ip.IsLinkLocalUnicast() || |
| 90 | ip.IsLinkLocalMulticast() || |
| 91 | ip.IsMulticast() || |
| 92 | ip.IsUnspecified() || |
| 93 | ip.IsInterfaceLocalMulticast() { |
| 94 | return true |
| 95 | } |
| 96 | for _, network := range extraBlockedNetworks { |
| 97 | if network.Contains(ip) { |
| 98 | return true |
| 99 | } |
| 100 | } |
| 101 | return false |
| 102 | } |
| 103 | |
| 104 | // certFetchClient is an HTTP client that refuses to connect |
| 105 | // to private or link-local IP addresses. This provides |