Repository navigation
Pin the connection to the address that was checked - #118
Open
Austin666k wants to merge 2 commits into
Open
Austin666k wants to merge 2 commits into
Austin666k wants to merge 2 commits into
Conversation
protect() resolves the hostname once and checks that single address, but got then resolves the hostname again when it connects. A DNS answer that changes between the two lookups, or a multi-record answer whose first record is public, lets the connection reach an address that was never checked (for example loopback). After the check, pin the connection's lookup to the validated address, and turn off the DNS cache so it cannot answer with another address. The caller's original dnsCache/dnsLookup is kept on the pinned lookup so that redirect hops still check against the right resolver. Adds a regression test that the connection uses the checked address. Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Apply the repository's .prettierrc.yml to the changed files so that lint:prettier passes. Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
protect()resolves the hostname once and checks that one address, but got resolves the hostname again when it connects. If the answer changes between the two lookups, or a multi-record answer has a public record first, the connection can reach an address that was never checked, such as loopback.This change pins the connection's lookup to the validated address and turns off the DNS cache for the connection. The caller's original
dnsCache/dnsLookupis kept on the pinned lookup, so redirect hops are still checked against the caller's resolver.Changes
index.ts: pin the connection lookup after the check; keep the original DNS settings across hops.index.test.ts: regression test that the connection uses the checked address..prettierrc.ymlso thatlint:prettierpasses.Testing
npx vitest run: 27 passed.npx tsc -p tsconfig.build.json --noEmit: clean.npx eslint index.ts index.test.ts: clean.I emailed a description of this issue to the npm-listed maintainer address before opening this PR.
🤖 Generated with Claude Code