Skip recording DNS noise for all IP literals with no pending port - #330
Merged
Conversation
Summary by Aikido
⚡ Enhancements
|
Extends #325 from private-IP literals to any literal IPv4/IPv6 address. A literal IP reaching the getAllByName sink with no pending port is usually inbound IP parsing (e.g. Spring Security IpAddressMatcher) rather than an outbound request, and the two can't be told apart here, so it's no longer recorded as outbound telemetry. Uses IPValidator.isIP instead of IsPrivateIP so public IP literals are skipped too. Outbound blocking, SSRF checks and port-based recording stay unconditional, so a genuine outbound request to a literal IP is still blocked/SSRF-checked, just not recorded. Temporary fix (see #294) until outbound is detected at instrumented HTTP clients rather than the ambiguous InetAddress sink.
Mishenevd
force-pushed
the
fix/skip-recording-ip-literals-without-port
branch
from
August 3, 2026 14:00
63dcde1 to
e5694ac
Compare
hansott
approved these changes
Aug 3, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #325, which only skipped private IP literals. The same dashboard noise happens with public ones.
Spring Security's
IpAddressMatcher(and similar inbound access-control code) parses request IPs viaInetAddress.getByName, which lands in ourgetAllByNamesink with no pending port. So inbound client IPs — private or public — get recorded as outbound connections. This is the case reported in #294.The change is a one-liner: in the no-pending-port branch, record a hit only when the hostname isn't a literal IP (
IPValidator.isIP) instead of only skipping private ones. A literal IP with no port is usually inbound IP parsing rather than an outbound request, and we can't tell the two apart at this sink — so we skip it (see the trade-off below).Everything else stays unconditional and unchanged:
URLCollector, which supplies the port.Trade-off: a genuine outbound request to a literal public IP through a client we don't instrument (no pending port) won't show in outbound telemetry anymore. Blocking and SSRF still run for it, so it's a visibility gap, not a security one. Temporary until outbound is detected at the HTTP-client layer instead of the ambiguous
InetAddresssink.Tests: public IPv4/IPv6 with no port (not recorded), public IP with a pending port (still recorded), and public IP still blocked in lockdown.