+ Q(i* fRt^RIHt^RIt^RIt^RIt^RIt^RIHt^RI H t ^RI H t ^RI t ^RIHt]!]4tRRlt!R R ]4t!R R ]4tR RltR%RRllt] !RR44t] !RR44tR&RRlltRRRRRRRR/RR lltRRRRRRRRR!RR"R/R#R$lltR#)'zSSRF-safe HTTP utilities for FastMCP. This module provides SSRF-protected HTTP fetching with: - DNS resolution and IP validation before requests - DNS pinning to prevent rebinding TOCTOU attacks - Support for both CIMD and JWKS fetches ) annotationsN)Mapping) dataclass)urlparse) get_loggerc V^8dQhRRRR/#)ip_strstrreturn)formats"^/Users/agent/.openclaw/workspace/venv/lib/python3.14/site-packages/fastmcp/server/auth/ssrf.py __annotate__rsccc\P!V4p\V\P4'dRV R2#V# \dTu#i;i)a2Format IP address for use in URL (bracket IPv6 addresses). IPv6 addresses must be bracketed in URLs to distinguish the address from the port separator. For example: https://[2001:db8::1]:443/path Args: ip_str: IP address string Returns: IP string suitable for URL (IPv6 addresses are bracketed) []) ipaddress ip_address isinstance IPv6Address ValueError)r ips& rformat_ip_for_urlrsQ  ! !& ) b)// 0 0vha=   s;AA AAc]tRt^/tRtRtR#) SSRFErrorz+Raised when an SSRF protection check fails.r N__name__ __module__ __qualname____firstlineno____doc____static_attributes__r rrrr/s5rrc]tRt^3tRtRtR#)SSRFFetchErrorz"Raised when SSRF-safe fetch fails.r Nrr rrr%r%3s,rr%c V^8dQhRRRR/#)rr r r boolr )r s"rrr7s((#($(rcH\P!V4pTP'gR#TP'dR#\ T\P 4'dTP'd\\TP44#TP'd\\TP44#TP'd?TPwr#\\T44;'d\\T44#R# \dR#i;i)aCheck if an IP address is allowed (must be globally routable unicast). Uses ip.is_global which catches: - Private (10.x, 172.16-31.x, 192.168.x) - Loopback (127.x, ::1) - Link-local (169.254.x, fe80::) - includes AWS metadata! - Reserved, unspecified - RFC6598 Carrier-Grade NAT (100.64.0.0/10) - can point to internal networks Additionally blocks multicast addresses (not caught by is_global). Args: ip_str: IP address string to check Returns: True if the IP is allowed (public unicast internet), False if blocked FT) rrr is_global is_multicastrr ipv4_mapped is_ip_allowedr sixtofourteredo)r rserverclients& rr,r,7s$  ! !& ) <<< "i++,, >>> R^^!45 5 <<< R\\!23 3 999YYNF V-LL-F 2L L ) sD D! D!c$V^8dQhRRRRRR/#)rhostnamer portintr list[str]r )r s"rrrbs&MMSMMiMrcdaa"\P!4pVPRVV3Rl4GRjxL p\VUu0uFqD^,^,kK up4pV'g\ RS 24hV#LDuupi \ P dp\ RS RT 24ThRp?ii;i5i)zResolve hostname to IP addresses using DNS. Args: hostname: Hostname to resolve port: Port number (used for getaddrinfo) Returns: List of resolved IP addresses Raises: SSRFError: If resolution fails Ncn<\P!SS\P\P4#)N)socket getaddrinfo AF_UNSPEC SOCK_STREAM)r2r3sr"resolve_hostname..ss%F&&$ 0 0&2D2Drz)DNS resolution returned no addresses for zDNS resolution failed for : )asyncioget_running_looprun_in_executorlistrr8gaierror)r2r3loopinfosinfoipsesff rresolve_hostnamerIbs  # # %D M**     5154GAJJ512GzRS S  2 ??M4XJbDE1LMsPB0BA: BA<B*B9B0:B<BB-B((B--B0cN]tRt^t$RtR]R&R]R&R]R&R]R&R]R &R tR #) ValidatedURLz9A URL that has been validated for SSRF with resolved IPs.r original_urlr2r4r3pathr5 resolved_ipsr Nrrr r!r"__annotations__r#r rrrKrKs CM I IrrKc:]tRt^t$RtR]R&R]R&R]R&RtR #) SSRFFetchResponsez)Response payload from an SSRF-safe fetch.bytescontentr4 status_codezdict[str, str]headersr NrOr rrrRrRs3 N rrRFc$V^8dQhRRRRRR/#)rurlr require_pathr'r rKr )r s"rrrs!..C.t. .rc"\V4pTPR8wd\RTP 24hTP 'g \R4hT'dTP R 9d \R4hTP;'g TP pTP;'gRp\YE4GRjxL pTUu.uFp\T4'dKTNK ppT'd\R T R 24h\TTTTP TP'dR TP,MR,TR 7# \\3dp\RT 24ThRp?ii;iLuupi5i)zValidate URL for SSRF and resolve to IPs. Args: url: URL to validate require_path: If True, require non-root path (for CIMD) Returns: ValidatedURL with resolved IPs Raises: SSRFError: If URL is invalid or resolves to blocked IPs z Invalid URL: NhttpszURL must use HTTPS, got: zURL must have a hostzURL must have a non-root pathz(URL resolves to blocked IP address(es): zB. Private, loopback, link-local, and reserved IPs are not allowed.?)rLr2r3rMrN)r\/) rrAttributeErrorrschemenetlocrMr2r3rIr,rKquery) rXrYparsedrHr2r3rNrblockeds && r validate_urlrfsJ4#}}3FMM?CDD ===.// y0788//&--H ;;  #D*(99L(BLb b0ArrLGB6wi@O P    [[&,,,C&,,.B G!  3  '4-s+,!34 :BsdE2 E:E2 E2.E2 E2,E2=E+>E2E-E-$AE2E(E##E((E2-E2rYmax_sizeitimeoutg$@overall_timeoutg>@c 0V^8dQhRRRRRRRRR RR R /#) rrXr rYr'rgr4rhfloatrir rSr )r s"rrrsF(( (( (  (  ( (rc Z"\VVVVV^0R7GRjxL pVP#L5i)auFetch URL with comprehensive SSRF protection and DNS pinning. Security measures: 1. HTTPS only 2. DNS resolution with IP validation 3. Connects to validated IP directly (DNS pinning prevents rebinding) 4. Response size limit 5. Redirects disabled 6. Overall timeout Args: url: URL to fetch require_path: If True, require non-root path max_size: Maximum response size in bytes (default 5KB) timeout: Per-operation timeout in seconds overall_timeout: Overall timeout for entire operation Returns: Response body as bytes Raises: SSRFError: If SSRF validation fails SSRFFetchError: If fetch fails )rYrgrhriallowed_status_codesN)ssrf_safe_fetch_responserT)rXrYrgrhriresponses&$$$$ rssrf_safe_fetchrps>@. !'!U H   s +)+request_headersrmc8V^8dQhRRRRRRRRR RR R R R RR/#)rrXr rYr'rgr4rhrkrirqzMapping[str, str] | Nonermzset[int] | Noner rRr )r s"rrrsnuMuM uMuM uM  uM  uM.uM*uMuMrc "\P!4p\WR7GRjxL pRp T;'g^0p VPEFp \P!4V, p W8d\ RV 24h\ RWL, 4p R\ V 4 RVP VP 2p\PRVVV 4RVP/pV'd7VP4F"wppVP4R 8XdKVVV&K$ \P!\P !\#W=4\#W=4\#W=4\#W=4R 7R R R 7;_uu_4GRjxL pVP%RVVRVP/R7;_uu_4GRjxL p\P!4V, V8d\ RV 24hVP&V 9d\ RVP& RV 24hVP(P+R4pV'd'\-V4pVV8d\ RV RV R24h.p^pVP14RjxL p\P!4V, V8d\ RV 24hV\3V4, pVV8d\ RV R24hVP5V4Kt V eB\AV \P<4'd\ RV 24V h\ RV RV 24V h\ RV R24hEL ELEL \.dLi;iLD\7RP9T4TP&\;TP(4R7uuRRR4GRjxL uuRRR4GRjxL u# +GRjxL 'giM;iRRR4GRjxL EK +GRjxL 'giEK;i \P<dpTp Rp?EKRp?i\P>dpTp Rp?EKRp?ii;i5i)zFetch URL with SSRF protection and return response metadata. This is equivalent to :func:`ssrf_safe_fetch` but returns response headers and status code, and supports conditional request headers. )rYNzOverall timeout exceeded: g?zhttps://:z(SSRF-safe fetch: %s -> %s (pinned to %s)Hosthost)connectreadwritepoolFT)rhfollow_redirectsverifyGET sni_hostname)rV extensionszHTTP z fetching zcontent-lengthzResponse too large: z bytes (max )zResponse too large: exceeded z bytesr)rTrUrVzTimeout fetching zError fetching r>z: no resolved IPs succeeded)!time monotonicrfrNr%maxrr3rMloggerdebugr2itemslowerhttpx AsyncClientTimeoutminstreamrUrVgetr4r aiter_byteslenappendrRjoindictTimeoutException RequestErrorr)rXrYrgrhrirqrm start_time validated last_errorexpected_statuses pinned_ipelapsed remaining pinned_urlrVkeyvaluer0rocontent_lengthsizechunkstotalchunkrHs&$$$$$$ rrnrns!J#3BBI#'J,55++ .."Z/  $ #=cU!CD D_67 (34Ainn5EinnEU V   6     9--. -335 U99;&($ 6 > !!!MM #G 7 4!'5 4  &+    # . 0B0BC  >>#j0?B(+EcU)KLL''/@@(51E1E0FjQTPU)VWW"*!1!1!5!56F!G!">2(?"0"6tfL RS T#+#+#7#7#9))%~~'*4F,/I#-OPPSZ'Ex',;H:VLMM%(U,r j%"8"8 9 9 #4SE!:; Kse2j\BCS ?3%/JK LLGCB ,& )#9)HHV, ( 4 4 !1!12M         l%% J !! J  s]%QL3QC!QA!P:L6 ;P>.O",L9-O"0A>N2 0$L< N2 )M -M .M 1A,N2 AQ6P9O"< M N2 M N2 M :N2 O"N O" P)N,*P/Q2O 8N;9 O O O" POPQ"O= (O+) O= 4O= 6P:Q=PQPQQ5Q6P?8Q?QQ)r])F)r" __future__rr?rr8rcollections.abcr dataclassesr urllib.parserrfastmcp.utilities.loggingrrrr Exceptionrr%r,rIrKrRrfrprnr rrrs# #!! 0 H *6 6-Y-(VM:    .b(( (  ( " (VuMuM uM  uM " uM15uM-1uMuMr