relayDestinationAllowed function

bool relayDestinationAllowed(
  1. Uri url, {
  2. bool allowAnyHost = false,
})

The destination verdict for one relay envelope (issue #792 AC3): only allowlisted provider hosts, and never loopback, private, link-local (cloud metadata 169.254.169.254 included), or unspecified addresses — denied BEFORE any outbound attempt. allowAnyHost is the explicit development opt-in.

Implementation

// ponytail: every literal IP denies in one gate (loopback, RFC 1918,
// link-local, unspecified, public literals alike — providers are named
// hosts, never addresses); DNS that resolves a public name to an
// internal IP still passes — resolve-and-verify each hop if that
// matters someday.
bool relayDestinationAllowed(Uri url, {bool allowAnyHost = false}) {
  if (allowAnyHost) return true;
  final host = url.host.toLowerCase();
  if (host.isEmpty) return false;
  if (InternetAddress.tryParse(host) != null) return false;
  if (host == 'localhost' || host.endsWith('.localhost')) return false;
  return _relayAllowedHosts.any(
    (allowed) => host == allowed || host.endsWith('.$allowed'),
  );
}