Package co.ankatech.ankasecure.sdk.auth

Class RejectedEgressAddresses

java.lang.Object
co.ankatech.ankasecure.sdk.auth.RejectedEgressAddresses
public final class RejectedEgressAddresses extends Object
The addresses this SDK will never open a connection to, whatever names a configuration or a response supplies.

This is a COPY, and the original is named on purpose

The authoritative predicate is co.ankatech.ankasecure.integration.support.net.InternalAddressRules, in ankasecure-integration-support, and specifically its isRejectedEgressTarget(InetAddress) composition. That module cannot be imported here: the SDK is a client-layer leaf with zero internal dependencies, and depending on the integration tier would drag spring-context, caffeine and common-security onto a consumer's classpath. So the rules are copied, verbatim in behaviour, and the copy says where it came from.

All four disjuncts are copied together, and that is the whole point

The narrow isNonRoutable(InetAddress) is only ONE of them, and the original's own javadoc records why: carrier-grade NAT is deliberately excluded from it so the time-stamping planes keep the reject set they were measured against. Porting only the narrow predicate would silently drop CGNAT, the IPv4-transition prefixes and the ::a.b.c.d form - the exact ranges that made the client-side rule set weaker than the one this workspace had already hardened.

Each disjunct exists because no JDK predicate reports the range it covers. The verdicts of this copy are pinned row-for-row against the original's own fixture table, in ExternalIssuerAdmissionTest, so the two cannot drift apart in silence.

  • Method Details

    • isNonRoutable

      public static boolean isNonRoutable(InetAddress address)
      Loopback, any-local, link-local (including the 169.254.169.254 cloud metadata address), site-local (RFC 1918), IPv6 unique-local (fc00::/7) or multicast.

      ONE of the four disjuncts, never the whole rule. A caller deciding whether an address may be dialled wants isRejectedEgressTarget(InetAddress).

      Parameters:
      address - a resolved or literal address; must not be null
      Returns:
      true when the address is non-routable in the sense above

    • isCarrierGradeNat

      public static boolean isCarrierGradeNat(InetAddress address)
      Carrier-grade NAT (100.64.0.0/10, RFC 6598). No JDK predicate recognizes this range - InetAddress.isSiteLocalAddress() included - yet it is routable INSIDE a cloud VPC and is therefore a live target for a client whose endpoint is configurable.
      Parameters:
      address - a resolved or literal address; must not be null
      Returns:
      true for an IPv4 address in 100.64.0.0/10

    • isIpv4TransitionPrefix

      public static boolean isIpv4TransitionPrefix(InetAddress address)
      The fixed, well-known IPv6 prefixes that CARRY or ALIAS an IPv4 address - the transition mechanisms. No JDK predicate reports any of them, and each reaches an IPv4 destination on a network that operates the matching translator, so each is a live path to an internal address that the plain reject set cannot see.

      Covered: 64:ff9b::/96 (NAT64 well-known, RFC 6052), 64:ff9b:1::/48 (NAT64 local-use, RFC 8215), ::ffff:0:0:0/96 (IPv4-translated, RFC 2765), 2002::/16 (6to4, RFC 3056) and 2001:0::/32 (Teredo, RFC 4380).

      The whole PREFIX is refused and the embedded IPv4 is never read back out: un-embedding would mean picking a reading of a translation this process neither performs nor can observe. No legitimate external authorization server is addressed through one of these prefixes, so refusing the prefix costs nothing.

      Parameters:
      address - a resolved or literal address; must not be null
      Returns:
      true for an IPv6 address under a well-known IPv4-transition prefix

    • carriesIpv4InLow32

      public static boolean carriesIpv4InLow32(InetAddress address)
      The IPv4-COMPATIBLE form (::a.b.c.d, RFC 4291 2.5.5.1, deprecated): an IPv6 address whose high 96 bits are zero, so its low 32 bits ARE an IPv4 address. Such a literal stays an Inet6Address and none of the JDK predicates reports it, so ::169.254.169.254 would otherwise pass the entire reject set.

      It does NOT cover the IPv4-MAPPED form (::ffff:a.b.c.d) and cannot: the mapped form carries 0xFFFF in bytes 10-11, so its high 96 bits are not zero. Mapped literals are refused by a different mechanism - InetAddress.getByName(String) folds them to an Inet4Address, after which the ordinary predicates see them. The distinction is pinned by a canary fixture so a JDK that stopped folding turns a test red rather than opening a hole.

      Parameters:
      address - a resolved or literal address; must not be null
      Returns:
      true for an IPv6 address whose high 96 bits are zero

    • isRejectedEgressTarget

      public static boolean isRejectedEgressTarget(InetAddress address)
      The EGRESS reject set - the FOUR disjuncts, composed once. This is the predicate a caller deciding whether to dial an address wants; isNonRoutable(InetAddress) on its own is strictly weaker, and reaching for it here was the defect this composition exists to prevent.
      Parameters:
      address - a resolved or literal address; must not be null
      Returns:
      true when the address must never be an egress target