Module policy 

Destination policy: which targets this proxy is willing to reach.

RFC 9298 §7 and RFC 9114 §4.4 both warn about the same thing from different angles: a proxy that will dial anything is a reflector, a port scanner, and a way to borrow the proxy’s own source address. That last one is the sharpest — plenty of services trust 127.0.0.1 or a private range without further authentication, and the proxy is inside that perimeter.

So the defaults deny private address space, and the operator can open it with security.allow_private_networks for the deployments where the point of the proxy is to reach a private network.

Normalization comes first

::ffff:127.0.0.1 is loopback wearing an IPv6 hat: the kernel routes it to 127.0.0.1, while a naive matcher sees an IPv6 address that matches none of the IPv4 rules. Every check therefore starts by canonicalizing (canonical), and the deprecated ::/96 compatible range is folded in for the same reason.

Two buckets

• Never allowed — the unspecified address, the IPv4 broadcast address and all multicast. These are not unicast targets at all; sending to them is an amplification primitive, so allow_private_networks does not unlock them.
• Private — everything RFC 6890 calls special-purpose and this proxy might actually reach: 0.0.0.0/8, loopback, RFC 1918, link-local, shared address space, the benchmarking and documentation ranges, reserved space, 6to4 relay anycast, ULA, ORCHID, the local-use NAT64 prefix and the deprecated IPv4-compatible and IPv6 site-local spaces. Denied by default, unlocked by allow_private_networks.

Transition addresses are judged as IPv4

The well-known NAT64 prefix, 6to4 and Teredo addresses embed an IPv4 address at a fixed place, and a host that routes them reaches exactly that address. 64:ff9b::7f00:1 is therefore 127.0.0.1 with three extra steps, and letting it past because it is syntactically a global IPv6 address would undo the whole IPv4 half of this module. embedded_ipv4 unwraps them before any rule is applied.

The local-use NAT64 prefix 64:ff9b:1::/48 (RFC 8215) is the one transition form that is not unwrapped. Its operator chooses the layout, RFC 8215 §5 forbids a reader assuming one, and a guess can read a private target as public. The whole prefix sits in the private bucket instead.

Structs

Policy

The destination rules in force for a connection.

Functions

canonical

Normalizes an address into the form the kernel will actually route.

is_dns_blackhole

Whether every resolved address is the unspecified address (0.0.0.0 / ::).