Class AddressRules

java.lang.Object
com.kingsrook.qqq.backend.core.utils.http.AddressRules
public final class AddressRules extends Object
Which network addresses an outbound request may reach.

Blocked by default: "this network" (0/8), private (10/8, 172.16/12, 192.168/16), carrier-grade NAT (100.64/10), loopback (127/8, ::1), link-local (169.254/16, fe80::/10, which covers cloud metadata), IETF protocol and documentation ranges, benchmarking (198.18/15), multicast, reserved and broadcast (224/4, 240/4), IPv6 unique-local (fc00::/7), site-local (fec0::/10), discard (100::/64) and documentation (2001:db8::/32). IPv4 addresses embedded in IPv6 (mapped, compatible, NAT64 64:ff9b::/96 and 6to4 2002::/16) are checked as IPv4.

An allowlist re-opens specific internal targets: CIDR blocks (10.100.22.0/24), single addresses, exact host names, or host suffixes written with a leading dot (.svc.cluster.local). The cloud metadata addresses (169.254.169.254, 100.100.100.200, fd00:ec2::254) and the unspecified addresses stay blocked even when allowlisted.

  • Constructor Details

    • AddressRules

      public AddressRules(List<String> allowlist)
      Rules with an allowlist (null or empty: nothing internal is allowed).
      Throws:
      IllegalArgumentException - for an entry that is not a CIDR, an address, a host name or a .suffix

  • Method Details

    • defaults

      public static AddressRules defaults()
      Rules with no allowlist.

    • isInternal

      public static boolean isInternal(InetAddress address)
      True when the address is in a blocked range (ignoring any allowlist).

    • check

      public String check(String host, InetAddress address)
      Null when the host may be reached at this address, else the reason.

    • hasAllowlist

      public boolean hasAllowlist()
      True when there is any allowlist entry.