Hacker News new | ask | show | jobs
by simonw 4118 days ago
Yes, that would be excellent - do you mean just public IP ranges?

One possible snag: I heard from a co-worker that if you are running on EC2 and you make an HTTP request to another site that coincidentally is also hosted on EC2 that traffic can sometimes be routed over a private IP range.
2 comments
evanphx 4118 days ago
Looking at that CPAN module, it wouldn't be hard at all to add a blacklist to Templar via a config file that is checked. The EC2 => EC2 issue is probably the biggest stumbling block to getting what you want. I'll have to investigate that, it seems like that would only happen if internal to EC2 they do ICMP redirects...
link
evanphx 4118 days ago
That's good point actually, I could see that happening.

What is your concern about the url used? That they point at something a user is trying to coerce you to hit? If so, that could be a public IP too..

link
jkarneges 4118 days ago
It's more about hitting internal services, where there may not be adequate protections in place. There's some earlier discussion here: https://news.ycombinator.com/item?id=7139176
link
evanphx 4118 days ago
Ah! Ok, I got it. Feels like the right way to handle this is the allow a blacklist to be defined via config file, then applied as request, something like "X-Templar-Blacklist: internal". The list would be a set of ip ranges and thus you'd have to construct the list so that the EC2 => EC2 problem doesn't crop up, but it's doable!
link