{"record":{"id":"7cfe7489ed6d83a6","repo":"zeroclaw-labs/zeroclaw","slug":"failed-to-resolve-host-host","errorCode":null,"errorMessage":"Failed to resolve host '{host}'","messagePattern":"Failed to resolve host '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-infra/src/net_guard.rs","lineNumber":842,"sourceCode":"/// # DNS pinning\n///\n/// This function validates only the supplied DNS answer. After it succeeds,\n/// the caller must connect to one of these exact validated addresses and must\n/// not resolve `host` again; otherwise DNS rebinding can replace the checked\n/// destination.\n///\n/// # Errors\n///\n/// Returns an error when `ips` is empty, contains a known cloud metadata\n/// address, or contains any non-globally-routable address — including one\n/// reached through a configured NAT64 prefix.\npub fn validate_resolved_ips_are_public(\n    host: &str,\n    ips: &[std::net::IpAddr],\n    nat64_prefixes: &[Nat64Prefix],\n) -> anyhow::Result<()> {\n    if ips.is_empty() {\n        anyhow::bail!(\"Failed to resolve host '{host}'\");\n    }\n\n    for ip in ips {\n        if is_cloud_metadata_ip(*ip) {\n            return Err(metadata_block_error(host, *ip));\n        }\n\n        if let std::net::IpAddr::V6(v6) = ip {\n            // Overlapping prefixes translate one address to several different\n            // destinations. Every one of them is reachable, so the address is\n            // accepted only when all of them are acceptable.\n            for (prefix, embedded) in network_specific_embedded_ipv4s(*v6, nat64_prefixes) {\n                if is_cloud_metadata_ip(std::net::IpAddr::V4(embedded)) {\n                    return Err(nat64_metadata_block_error(host, *v6, prefix, embedded));\n                }\n                if is_non_global_v4(embedded) {\n                    anyhow::bail!(\n                        \"Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix \\","sourceCodeStart":824,"sourceCodeEnd":860,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-infra/src/net_guard.rs#L824-L860","documentation":"Error \"Failed to resolve host '{host}'\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-infra/src/net_guard.rs:842 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check DNS resolution and the hostname spelling; ensure the host is reachable from this machine."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}