PhoenixKit.Utils.PublicAddress (phoenix_kit v2.55.1)

Copy Markdown View Source

Whether an IP address is a globally routable unicast address — the only kind a server-side fetch of a user-supplied URL may connect to.

Everything in the IANA special-purpose registries is refused: loopback, private (RFC 1918 and unique-local), link-local (which includes the cloud metadata address 169.254.169.254), carrier-grade NAT, "this network", documentation and benchmarking ranges, multicast, reserved space, and the IPv6 forms that smuggle an IPv4 address (IPv4-mapped, IPv4-compatible, NAT64, 6to4, Teredo). Listing what is not public is how the registries themselves are organised; an address in none of these ranges is public.

A network can add its own: an IPv6-only host behind a NAT64 gateway with a network-specific prefix (not 64:ff9b::/96) sees every IPv4 address, internal ones included, as a global-looking IPv6 address under that prefix. List it, and anything else local to the network, in

config :phoenix_kit, :blocked_ip_ranges, ["2a00:abcd:1234:5678::/96"]

(CIDR strings; an unparsable entry is ignored).

Summary

Types

ip()

Functions

public?(ip)

Whether ip (a tuple or a string) is a public unicast address.

resolve_public(host)

Resolves host and returns {:ok, ip} — an address to connect to — only when EVERY address it resolves to is public, so a name with one public and one internal record cannot be used to reach the internal one. A literal IP is checked as it is.

Types

ip()

@type ip() :: :inet.ip_address()

Functions

public?(ip)

@spec public?(ip() | String.t()) :: boolean()

Whether ip (a tuple or a string) is a public unicast address.

resolve_public(host)

@spec resolve_public(String.t()) :: {:ok, ip()} | {:error, :blocked_host | :nxdomain}

Resolves host and returns {:ok, ip} — an address to connect to — only when EVERY address it resolves to is public, so a name with one public and one internal record cannot be used to reach the internal one. A literal IP is checked as it is.