# AWS: Enforce IMDSv2 (requires token-based access)
aws ec2 modify-instance-metadata-options \
  --instance-id i-1234567890 \
  --http-tokens required \
  --http-put-response-hop-limit 1

# Deploy metadata concealment proxy (like Shopify did)
# Block 169.254.169.254 at the host level with iptables/nftables.
# NOTE: AWS Security Groups and NACLs CANNOT block this - link-local
# traffic never leaves the ENI. Use IMDSv2 plus a host firewall rule.

# Kubernetes: Block metadata via NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: block-metadata
spec:
  podSelector: {}
  egress:
  - to:
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 169.254.169.254/32

import ipaddress
import urllib.parse
import socket

ALLOWED_SCHEMES = {'https'}
BLOCKED_NETWORKS = [
    ipaddress.ip_network('127.0.0.0/8'), # Loopback
    ipaddress.ip_network('10.0.0.0/8'), # Private
    ipaddress.ip_network('172.16.0.0/12'), # Private
    ipaddress.ip_network('192.168.0.0/16'), # Private
    ipaddress.ip_network('169.254.0.0/16'), # Link-local (metadata!)
    ipaddress.ip_network('0.0.0.0/8'), # Special
    ipaddress.ip_network('::1/128'), # IPv6 loopback
    ipaddress.ip_network('::ffff:0:0/96'), # IPv4-mapped IPv6
    ipaddress.ip_network('100.64.0.0/10'), # CGNAT — Alibaba IMDS lives at 100.100.100.200
    ipaddress.ip_network('fc00::/7'), # IPv6 unique-local
    ipaddress.ip_network('fd00:ec2::/32'), # AWS IPv6 IMDS
]

def validate_url(url: str) -> bool:
    parsed = urllib.parse.urlparse(url)
    
    # 1. Allowlist protocol
    if parsed.scheme not in ALLOWED_SCHEMES:
        return False
    
    # 2. Resolve the hostname and check EVERY answer, not just the first.
    #    A host that returns both a public and a private A record would
    #    otherwise pass on [0] and connect to the private one.
    try:
        answers = socket.getaddrinfo(parsed.hostname, None)
    except socket.gaierror:
        return False

    ips = set()
    for family, _, _, _, sockaddr in answers:
        try:
            ips.add(ipaddress.ip_address(sockaddr[0]))
        except ValueError:
            return False          # fail closed on anything unparseable
    if not ips:
        return False

    # 3. Fail closed if ANY resolved address is blocked
    for ip in ips:
        for network in BLOCKED_NETWORKS:
            if ip in network:
                return False

    # 4. This function has now validated a NAME, not a CONNECTION. Between
    #    this check and the socket connect, DNS can change under you — that
    #    is exactly the rebinding attack in Pattern 4. Pass the validated IP
    #    to a pinned connection (Strategy 3) and re-run this check on every
    #    redirect hop; do not call requests.get(url) after returning True.
    return True

# DNS pinning strategy
def safe_fetch(url: str) -> bytes:
    parsed = urllib.parse.urlparse(url)
    
    # Step 1: Resolve and validate
    resolved_ip = resolve_and_validate(parsed.hostname)
    
    # Step 2: Connect directly to the resolved IP (bypass DNS)
    # This prevents DNS rebinding between validation and request
    response = requests.get(
        url,
        headers={'Host': parsed.hostname},
        allow_redirects=False, # Handle redirects manually!
        timeout=5,
        # Force connection to validated IP
        # via custom adapter or socket override
    )
    
    # Step 3: Validate any redirect URLs before following
    if response.is_redirect:
        redirect_url = response.headers['Location']
        validate_url(redirect_url) # Re-validate!
    
    return response.content

# Smokescreen-style egress proxy (used by Stripe, Shopify)
# All outbound HTTP from the application routes through this proxy
# Proxy enforces:
# - No connections to internal IP ranges
# - No connections to cloud metadata endpoints
# - No connections to denied domains
# - DNS resolution happens in the proxy (prevents rebinding)

proxy_config:
  deny_ranges:
    - "127.0.0.0/8"
    - "10.0.0.0/8"
    - "169.254.0.0/16"
    - "172.16.0.0/12"
    - "192.168.0.0/16"
  deny_domains:
    - "*.internal"
    - "metadata.google.internal"