{"record":{"id":"fdd790239bbc20f9","repo":"zeroclaw-labs/zeroclaw","slug":"blocked-host-host-resolved-to-non-global-addre","errorCode":null,"errorMessage":"Blocked host '{host}' resolved to non-global address {ip}","messagePattern":"Blocked host '(.+?)' resolved to non-global address (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-infra/src/net_guard.rs","lineNumber":872,"sourceCode":"            for (prefix, embedded) in network_specific_embedded_ipv4s(*v6, nat64_prefixes) {\n                if is_cloud_metadata_ip(std::net::IpAddr::V4(embedded)) {\n                    return Err(nat64_metadata_block_error(host, *v6, prefix, embedded));\n                }\n                if is_non_global_v4(embedded) {\n                    anyhow::bail!(\n                        \"Blocked host '{host}' resolved to {v6}, which the configured NAT64 prefix \\\n                         {prefix} translates to non-global address {embedded}\"\n                    );\n                }\n            }\n        }\n\n        let non_global = match ip {\n            std::net::IpAddr::V4(v4) => is_non_global_v4(*v4),\n            std::net::IpAddr::V6(v6) => is_non_global_v6(*v6),\n        };\n        if non_global {\n            anyhow::bail!(\"Blocked host '{host}' resolved to non-global address {ip}\");\n        }\n    }\n\n    Ok(())\n}\n\n/// Reject a resolution that contains a known metadata address, but permit\n/// other private and loopback addresses. For callers that carry an explicit\n/// operator opt-in for private destinations; the known metadata endpoints\n/// remain blocked regardless.\n///\n/// The private opt-in never extends to metadata addresses, so an IPv6 answer\n/// inside one of `nat64_prefixes` is rejected when the IPv4 address it embeds\n/// is a metadata address. Overlapping prefixes decode one answer to several\n/// destinations; the answer is rejected when any of them is a metadata\n/// address.\n///\n/// # DNS pinning","sourceCodeStart":854,"sourceCodeEnd":890,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-infra/src/net_guard.rs#L854-L890","documentation":"Error \"Blocked host '{host}' resolved to non-global address {ip}\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-infra/src/net_guard.rs:872 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The host resolves to a non-global address; allow it explicitly via allowed_private_hosts only if intended, or remove it."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}