@sproutboat/runtime 0.13.5 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @sproutboat/runtime
 
+## 0.14.0
+
+### Minor Changes
+
+- 4dd16b7: `fetch()` reaches any public address and never a private or reserved one (baronunread/sproutboat#174). The `outbound` allowlist is gone.
+  
+  - Both backends, the broker and the standalone client, check the address they resolved, not the hostname, so DNS rebinding can't get past the check. The broker connects to the vetted address and verifies TLS against the name.
+  - Blocked: loopback, RFC 1918, link-local and cloud metadata, CGNAT, benchmarking, documentation, multicast and reserved ranges, IPv6 ULA and link-local, and the IPv4 address inside IPv4-mapped, NAT64 and 6to4 addresses.
+  - An operator can let addresses through with `SB_EGRESS_ALLOW` (`*` or exact addresses) in the broker's or the binary's environment. Handler code can't.
+  - `@sproutboat/runtime`: `URL.hostname` and `URL.port` handle IPv6 literals (`[::1]:9` used to give hostname `[`). Every sprout gets `fetch()`, with no binding needed. `validateHttpSyncSource` no longer takes an `outboundAllowed` argument, and `Bindings` loses `outbound`.
+  - `@sproutboat/wire`: `Bindings` loses `outbound`.
+  - `@sproutboat/config`: `outbound` is accepted but ignored, with a warning in the new `warnings` field of a successful parse (`OUTBOUND_IGNORED`). It will be refused in a later minor release.
+
 ## 0.13.5
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.13.5",
+  "version": "0.14.0",
   "license": "MIT",
   "type": "module",
   "repository": {
@@ -11,6 +11,7 @@
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "scripts": {
-    "test": "bun test ./"
+    "test": "bun test ./",
+    "gen:egress": "bun src/gen-egress.ts"
   }
 }

package/src/egress.test.ts

@@ -0,0 +1,155 @@
+import { expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  blockedRange,
+  egressAllowList,
+  egressRefusal,
+  parseAddress,
+  spliceEgressTable,
+} from "./egress";
+import { validateHttpSyncSource } from "./source";
+import { wrapNativeFetchHandler } from "./wrap";
+
+const BLOCKED = [
+  "0.0.0.0",
+  "10.1.2.3",
+  "100.64.0.1",
+  "100.127.255.255",
+  "127.0.0.1",
+  "127.255.255.254",
+  "169.254.169.254",
+  "172.16.0.1",
+  "172.31.255.255",
+  "192.0.0.8",
+  "192.0.2.1",
+  "192.168.1.1",
+  "198.18.0.1",
+  "198.19.255.255",
+  "224.0.0.1",
+  "255.255.255.255",
+  "::",
+  "::1",
+  "::ffff:127.0.0.1",
+  "64:ff9b::7f00:1",
+  "64:ff9b::a00:1",
+  "64:ff9b:1::1",
+  "2002:7f00:1::1",
+  "2001:db8::1",
+  "fc00::1",
+  "fd12::1",
+  "fe80::1",
+  "ff02::1",
+];
+const PUBLIC = [
+  "1.1.1.1",
+  "8.8.8.8",
+  "100.128.0.1",
+  "172.15.255.255",
+  "172.32.0.1",
+  "198.20.0.1",
+  "::ffff:8.8.8.8",
+  "64:ff9b::808:808",
+  "2002:808:808::1",
+  "2001:4860:4860::8888",
+  "2606:4700::1111",
+];
+const ALLOW = "8.8.4.4, 10.9.9.9";
+
+test("private and reserved addresses are blocked, public ones are not", () => {
+  for (const address of BLOCKED)
+    expect([address, blockedRange(address)]).not.toEqual([address, null]);
+  for (const address of PUBLIC) expect([address, blockedRange(address)]).toEqual([address, null]);
+  expect(blockedRange("::ffff:127.0.0.1")).toBe("127.0.0.0/8");
+  expect(blockedRange("64:ff9b::a00:1")).toBe("10.0.0.0/8");
+});
+
+test("the operator allow list lets an exact address or everything through", () => {
+  expect(egressRefusal("db", "10.9.9.9", egressAllowList(ALLOW))).toBeNull();
+  expect(egressRefusal("db", "10.9.9.8", egressAllowList(ALLOW))).toContain(
+    "SB_EGRESS_ALLOW=10.9.9.8",
+  );
+  expect(egressRefusal("db", "127.0.0.1", ["*"])).toBeNull();
+  expect(egressRefusal("x", "169.254.169.254", [])).toBe(
+    "fetch() refused: x resolves to 169.254.169.254, a private or reserved address (169.254.0.0/16). An operator can allow it with SB_EGRESS_ALLOW=169.254.169.254",
+  );
+});
+
+test("parseAddress rejects what is not an address", () => {
+  for (const bad of [
+    "",
+    "1.2.3",
+    "256.1.1.1",
+    "example.com",
+    "1::2::3",
+    "1:2:3:4:5:6:7:8:9",
+    "12345::",
+  ])
+    expect([bad, parseAddress(bad)]).toEqual([bad, null]);
+});
+
+const transportFile = new URL("./transport-embedded.js", import.meta.url);
+
+test("the C table in transport-embedded.js is generated from this one (bun run gen:egress)", () => {
+  const source = readFileSync(transportFile, "utf8");
+  expect(spliceEgressTable(source)).toBe(source);
+});
+
+test("the C check gives the same answer and message as the TS one", () => {
+  const source = readFileSync(transportFile, "utf8");
+  const block = source.slice(source.indexOf("// EGRESS:BEGIN"), source.indexOf("// EGRESS:END"));
+  const dir = mkdtempSync(join(tmpdir(), "sb-egress-"));
+  try {
+    writeFileSync(
+      join(dir, "check.c"),
+      `#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+${block}
+int main(int argc, char** argv) {
+  for (int i = 1; i < argc; i++) {
+    struct sockaddr_storage ss;
+    memset(&ss, 0, sizeof(ss));
+    struct sockaddr_in* v4 = (struct sockaddr_in*)&ss;
+    struct sockaddr_in6* v6 = (struct sockaddr_in6*)&ss;
+    if (inet_pton(AF_INET, argv[i], &v4->sin_addr) == 1) v4->sin_family = AF_INET;
+    else if (inet_pton(AF_INET6, argv[i], &v6->sin6_addr) == 1) v6->sin6_family = AF_INET6;
+    else { printf("unparsed\\n"); continue; }
+    char msg[512];
+    printf("%s\\n", sb_egress_refused("h", (struct sockaddr*)&ss, msg, sizeof(msg)) ? msg : "ok");
+  }
+  return 0;
+}
+`,
+    );
+    const cc = Bun.spawnSync([
+      "cc",
+      "-Wall",
+      "-Werror",
+      "-o",
+      join(dir, "check"),
+      join(dir, "check.c"),
+    ]);
+    expect(cc.stderr.toString()).toBe("");
+    const addresses = [...BLOCKED, ...PUBLIC, "10.9.9.9"];
+    const run = Bun.spawnSync([join(dir, "check"), ...addresses], {
+      env: { ...process.env, SB_EGRESS_ALLOW: ALLOW },
+    });
+    const fromC = run.stdout.toString().trimEnd().split("\n");
+    const fromTs = addresses.map((a) => egressRefusal("h", a, egressAllowList(ALLOW)) ?? "ok");
+    expect(fromC).toEqual(fromTs);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("#174: fetch() needs no config, so every sprout gets it", () => {
+  const handler = `export default { async fetch() { return await fetch("https://api.example.com/"); } };`;
+  expect(validateHttpSyncSource(handler)).toEqual({ ok: true });
+  const prelude = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+  expect(wrapNativeFetchHandler(handler, prelude)).toContain("__sbInstallFetch();");
+});

package/src/egress.ts

@@ -0,0 +1,156 @@
+/**
+ * baronunread/sproutboat#174 — `fetch()` never reaches a private or reserved
+ * address. A sprout is a real OS process, so without this it could reach the
+ * operator's loopback services, their private network, or a cloud metadata
+ * endpoint, none of which a Worker can touch.
+ *
+ * Both backends check the address they are about to connect to, never the
+ * hostname: the broker (`@sproutboat/wire`) here in TS, the standalone client
+ * in C (`transport-embedded.js`). This table is the one source of truth; the C
+ * copy is generated from it (`bun run gen:egress`) and a test fails if the two
+ * drift, while another runs the C check against this one on the same vectors.
+ *
+ * The override belongs to the operator, not the handler: `SB_EGRESS_ALLOW` in
+ * the broker's or the binary's environment, either `*` or a comma-separated
+ * list of exact addresses.
+ * ponytail: exact addresses only, add CIDR entries if an operator needs a subnet.
+ */
+
+/** Blocked ranges. IPv4-mapped (`::ffff:0:0/96`), NAT64 (`64:ff9b::/96`) and
+ *  6to4 (`2002::/16`) addresses are checked by the IPv4 address they embed. */
+export const BLOCKED_RANGES = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "64:ff9b:1::/48",
+  "100::/64",
+  "2001:db8::/32",
+  "fc00::/7",
+  "fe80::/10",
+  "fec0::/10",
+  "ff00::/8",
+] as const;
+
+/** Parse an IPv4 or IPv6 literal to its bytes; `null` when it is neither. */
+export function parseAddress(text: string): Uint8Array | null {
+  const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(text);
+  if (v4) {
+    const bytes = v4.slice(1).map(Number);
+    return bytes.every((b) => b <= 255) ? Uint8Array.from(bytes) : null;
+  }
+  if (!text.includes(":")) return null;
+  let tail: number[] = [];
+  let body = text;
+  const dotted = /^(.*:)(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
+  if (dotted) {
+    const embedded = parseAddress(dotted[2]);
+    if (!embedded) return null;
+    body = `${dotted[1]}0:0`;
+    tail = [...embedded];
+  }
+  const halves = body.split("::");
+  if (halves.length > 2) return null;
+  const groups = (part: string) => (part === "" ? [] : part.split(":"));
+  const head = groups(halves[0]);
+  const rest = halves.length === 2 ? groups(halves[1]) : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0) return null;
+  const all = [...head, ...Array<string>(missing).fill("0"), ...rest];
+  const out = new Uint8Array(16);
+  for (let i = 0; i < 8; i++) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(all[i])) return null;
+    const n = parseInt(all[i], 16);
+    out[i * 2] = n >> 8;
+    out[i * 2 + 1] = n & 255;
+  }
+  if (tail.length) out.set(tail, 12);
+  return out;
+}
+
+type Range = { cidr: string; bytes: Uint8Array; bits: number };
+const RANGES: Range[] = BLOCKED_RANGES.map((cidr) => {
+  const [addr, bits] = cidr.split("/");
+  return { cidr, bytes: parseAddress(addr)!, bits: Number(bits) };
+});
+
+function inRange(bytes: Uint8Array, range: Range): boolean {
+  if (bytes.length !== range.bytes.length) return false;
+  const whole = range.bits >> 3;
+  for (let i = 0; i < whole; i++) if (bytes[i] !== range.bytes[i]) return false;
+  const rem = range.bits & 7;
+  if (rem === 0) return true;
+  const mask = (0xff << (8 - rem)) & 0xff;
+  return (bytes[whole] & mask) === (range.bytes[whole] & mask);
+}
+
+/** The IPv4 address an IPv6 one carries, for the mapped, NAT64 and 6to4 forms. */
+function embeddedV4(bytes: Uint8Array): Uint8Array | null {
+  if (bytes.length !== 16) return null;
+  const prefix = (p: number[]) => p.every((b, i) => bytes[i] === b);
+  if (prefix([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff])) return bytes.slice(12);
+  if (prefix([0, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0])) return bytes.slice(12);
+  if (prefix([0x20, 0x02])) return bytes.slice(2, 6);
+  return null;
+}
+
+/** The blocked range `address` falls in, or `null` when it may be reached. */
+export function blockedRange(address: string): string | null {
+  const parsed = parseAddress(address);
+  if (!parsed) return "unparseable address";
+  const bytes = embeddedV4(parsed) ?? parsed;
+  return RANGES.find((range) => inRange(bytes, range))?.cidr ?? null;
+}
+
+/** `SB_EGRESS_ALLOW` split into entries. */
+export function egressAllowList(raw: string | undefined): string[] {
+  return (raw ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+/** Why `fetch()` may not connect to `address`, or `null` when it may. The
+ *  message is identical in the C client; keep the two in step. */
+export function egressRefusal(
+  host: string,
+  address: string,
+  allow: readonly string[],
+): string | null {
+  if (allow.includes("*") || allow.includes(address)) return null;
+  const range = blockedRange(address);
+  if (range === null) return null;
+  return `fetch() refused: ${host} resolves to ${address}, a private or reserved address (${range}). An operator can allow it with SB_EGRESS_ALLOW=${address}`;
+}
+
+/** The C range table spliced into transport-embedded.js, inside
+ *  sb_egress_blocked: Porffor's header split mangles a file-scope array. */
+export function egressRangesC(): string {
+  const rows = RANGES.map(({ cidr, bytes, bits }) => {
+    const padded = [...bytes, ...Array<number>(16 - bytes.length).fill(0)];
+    return `    { ${bytes.length}, ${bits}, { ${padded.join(", ")} }, "${cidr}" },`;
+  });
+  return ["  static const sb_egress_range sb_egress_ranges[] = {", ...rows, "  };"].join("\n");
+}
+
+const TABLE_BEGIN = /( *\/\/ EGRESS-TABLE:BEGIN[^\n]*\n)[\s\S]*?( *\/\/ EGRESS-TABLE:END)/;
+
+/** `source` with the generated table between its EGRESS-TABLE markers replaced. */
+export function spliceEgressTable(source: string): string {
+  if (!TABLE_BEGIN.test(source)) throw new Error("EGRESS-TABLE markers not found");
+  return source.replace(
+    TABLE_BEGIN,
+    (_, begin: string, end: string) => `${begin}${egressRangesC()}\n${end}`,
+  );
+}

package/src/gen-egress.ts

@@ -0,0 +1,6 @@
+// Regenerates the C range table in transport-embedded.js from egress.ts (#174).
+import { readFileSync, writeFileSync } from "node:fs";
+import { spliceEgressTable } from "./egress";
+
+const path = new URL("./transport-embedded.js", import.meta.url);
+writeFileSync(path, spliceEgressTable(readFileSync(path, "utf8")));

package/src/index.ts

@@ -8,3 +8,4 @@
 // src/native-fetch-prelude.js.
 export * from "./wrap";
 export * from "./source";
+export * from "./egress";

package/src/native-fetch-prelude.js

@@ -411,14 +411,18 @@ __sbDefineURLAccessor("host", function () {
   const i = this.origin.indexOf("://");
   return i === -1 ? "" : this.origin.slice(i + 3);
 });
+// The port colon is the one after an IPv6 literal's closing bracket: `[::1]:9`.
+function __sbPortColon(host) {
+  return host.indexOf(":", host.charAt(0) === "[" ? host.indexOf("]") : 0);
+}
 __sbDefineURLAccessor("hostname", function () {
   const h = this.host;
-  const c = h.indexOf(":");
+  const c = __sbPortColon(h);
   return c === -1 ? h : h.slice(0, c);
 });
 __sbDefineURLAccessor("port", function () {
   const h = this.host;
-  const c = h.indexOf(":");
+  const c = __sbPortColon(h);
   return c === -1 ? "" : h.slice(c + 1);
 });
 __sbDefineURLAccessor("hash", function () {
@@ -1605,7 +1609,7 @@ globalThis.__sbInstallBindings = function (target, bindings) {
 
   // #48 — worker-to-worker. Same wire shape as outbound fetch, but the broker
   // resolves the target itself and forwards it internally, so this is not
-  // egress and is not subject to the outbound allowlist.
+  // egress and is not subject to the private-address block.
   for (let i = 0; i < (bindings.services || []).length; i++) {
     const binding = bindings.services[i].binding;
     target[binding] = {
@@ -1635,30 +1639,35 @@ globalThis.__sbInstallBindings = function (target, bindings) {
     };
   }
 
-  if ((bindings.outbound || []).length > 0) {
-    globalThis.fetch = function (input, init) {
-      const url = __sbIsStr(input) ? input : String(input.url);
-      const opts = init || {};
-      const headers = [];
-      if (opts.headers) {
-        if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.push([k, v]));
-        else for (const k in opts.headers) headers.push([k, opts.headers[k]]);
-      }
-      const r = globalThis.__sbFetchUpstream("fetch", {
-        url,
-        method: opts.method || "GET",
-        headers,
-        ...__sbRequestBody(opts.body),
-      });
-      const respHeaders = new Headers();
-      for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
-      // #176: bytes from an outbound HTTP response, not a string this handler
-      // built -- must not be re-encoded if the handler proxies it straight
-      // through (see the assets binding for the same reasoning).
-      if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
-      return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
-    };
-  }
+};
+
+// fetch() reaches any public address; the transport refuses private and
+// reserved ones at connect (baronunread/sproutboat#174). No config, like a
+// Worker's fetch. Installed by the generated module (wrap.ts), not here: the
+// prelude must not replace fetch just by being evaluated.
+globalThis.__sbInstallFetch = function () {
+  globalThis.fetch = function (input, init) {
+    const url = __sbIsStr(input) ? input : String(input.url);
+    const opts = init || {};
+    const headers = [];
+    if (opts.headers) {
+      if (__sbIsFn(opts.headers.forEach)) opts.headers.forEach((v, k) => headers.push([k, v]));
+      else for (const k in opts.headers) headers.push([k, opts.headers[k]]);
+    }
+    const r = globalThis.__sbFetchUpstream("fetch", {
+      url,
+      method: opts.method || "GET",
+      headers,
+      ...__sbRequestBody(opts.body),
+    });
+    const respHeaders = new Headers();
+    for (let j = 0; j < (r.headers || []).length; j++) respHeaders.set(r.headers[j][0], r.headers[j][1]);
+    // #176: bytes from an outbound HTTP response, not a string this handler
+    // built -- must not be re-encoded if the handler proxies it straight
+    // through (see the assets binding for the same reasoning).
+    if (r.body != null) respHeaders.set("x-sb-raw-body", "1");
+    return __sbRawBodyResponse(r.body, { status: r.status || 502, headers: respHeaders });
+  };
 };
 
 // ---------------------------------------------------------------------------

package/src/source.ts

@@ -35,12 +35,7 @@ const alwaysForbidden: Array<[RegExp, string]> = [
   ],
 ];
 
-const fetchWithoutAllowlist: [RegExp, string] = [
-  /(?:\breturn\s+|\bawait\s+|=\s*)fetch\s*\(/,
-  "outbound networking needs an `outbound` host allowlist in sproutboat.jsonc",
-];
-
-export function validateHttpSyncSource(source: string, outboundAllowed = false): SourceValidation {
+export function validateHttpSyncSource(source: string): SourceValidation {
   const errors: string[] = [];
   // The default export must be an object literal with a `fetch` method. A module
   // may also declare Durable Object classes / helpers before it, so this is not
@@ -52,6 +47,5 @@ export function validateHttpSyncSource(source: string, outboundAllowed = false):
     errors.push("handler must default-export an object with fetch(request)");
   }
   for (const [pattern, message] of alwaysForbidden) if (pattern.test(source)) errors.push(message);
-  if (!outboundAllowed && fetchWithoutAllowlist[0].test(source)) errors.push(fetchWithoutAllowlist[1]);
   return errors.length ? { ok: false, errors } : { ok: true };
 }

package/src/transport-embedded.js

@@ -21,6 +21,8 @@ Porffor.c`
 #include <sys/stat.h>
 #include <sys/socket.h>
 #include <netdb.h>
+#include <arpa/inet.h>
+#include <string.h>
 #include <strings.h>
 #include <sys/time.h>
 #include <bearssl.h>
@@ -1006,7 +1008,7 @@ static char* sb_sql_backup(const char* src_path, const char* dest_path) {
 // response parser: the only thing that differs is how bytes move.
 
 // #56 — an outbound response is held whole in memory, and its size is chosen by
-// the remote host, not by us. Without a cap one allowlisted upstream can drive a
+// the remote host, not by us. Without a cap one upstream can drive a
 // sprout out of memory: a 100 MB body measured at 321 MB resident. 32 MiB by
 // default, raisable for a deployment that knowingly fetches something bigger.
 static size_t sb_fetch_max(void) {
@@ -1019,16 +1021,122 @@ static size_t sb_fetch_max(void) {
   return cached;
 }
 
-static int sb_tcp_connect(const char* host, int port) {
+// EGRESS:BEGIN
+// baronunread/sproutboat#174: fetch() never connects to a private or reserved
+// address. The resolved address is checked, never the hostname, so DNS
+// rebinding has nothing to race. Same table, algorithm and message as
+// @sproutboat/runtime's src/egress.ts; egress.test.ts compiles this block and
+// holds the two to the same answers.
+
+typedef struct { int len; int bits; unsigned char addr[16]; const char* cidr; } sb_egress_range;
+static const char* sb_egress_blocked(const unsigned char* a, int len) {
+  // EGRESS-TABLE:BEGIN generated by "bun run gen:egress" from src/egress.ts, do not edit
+  static const sb_egress_range sb_egress_ranges[] = {
+    { 4, 8, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "0.0.0.0/8" },
+    { 4, 8, { 10, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "10.0.0.0/8" },
+    { 4, 10, { 100, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "100.64.0.0/10" },
+    { 4, 8, { 127, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "127.0.0.0/8" },
+    { 4, 16, { 169, 254, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "169.254.0.0/16" },
+    { 4, 12, { 172, 16, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "172.16.0.0/12" },
+    { 4, 24, { 192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.0.0.0/24" },
+    { 4, 24, { 192, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.0.2.0/24" },
+    { 4, 16, { 192, 168, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.168.0.0/16" },
+    { 4, 15, { 198, 18, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "198.18.0.0/15" },
+    { 4, 24, { 198, 51, 100, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "198.51.100.0/24" },
+    { 4, 24, { 203, 0, 113, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "203.0.113.0/24" },
+    { 4, 4, { 224, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "224.0.0.0/4" },
+    { 4, 4, { 240, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "240.0.0.0/4" },
+    { 16, 96, { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "::/96" },
+    { 16, 48, { 0, 100, 255, 155, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "64:ff9b:1::/48" },
+    { 16, 64, { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "100::/64" },
+    { 16, 32, { 32, 1, 13, 184, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "2001:db8::/32" },
+    { 16, 7, { 252, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fc00::/7" },
+    { 16, 10, { 254, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fe80::/10" },
+    { 16, 10, { 254, 192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fec0::/10" },
+    { 16, 8, { 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "ff00::/8" },
+  };
+  // EGRESS-TABLE:END
+  static const unsigned char mapped[12] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff };
+  static const unsigned char nat64[12] = { 0, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0 };
+  if (len == 16 && (memcmp(a, mapped, 12) == 0 || memcmp(a, nat64, 12) == 0)) { a += 12; len = 4; }
+  else if (len == 16 && a[0] == 0x20 && a[1] == 0x02) { a += 2; len = 4; }
+  for (size_t i = 0; i < sizeof(sb_egress_ranges) / sizeof(sb_egress_ranges[0]); i++) {
+    if (sb_egress_ranges[i].len != len) continue;
+    int bits = sb_egress_ranges[i].bits, whole = bits >> 3, rem = bits & 7;
+    if (memcmp(a, sb_egress_ranges[i].addr, (size_t)whole) != 0) continue;
+    if (rem) {
+      unsigned char m = (unsigned char)(0xff << (8 - rem));
+      if ((a[whole] & m) != (sb_egress_ranges[i].addr[whole] & m)) continue;
+    }
+    return sb_egress_ranges[i].cidr;
+  }
+  return 0;
+}
+
+// SB_EGRESS_ALLOW: "*" or a comma-separated list of exact addresses.
+static int sb_egress_allowed(const char* ip) {
+  const char* p = getenv("SB_EGRESS_ALLOW");
+  if (!p) return 0;
+  size_t n = strlen(ip);
+  while (*p) {
+    while (*p == ' ' || *p == ',') p++;
+    const char* start = p;
+    while (*p && *p != ',') p++;
+    const char* end = p;
+    while (end > start && end[-1] == ' ') end--;
+    size_t len = (size_t)(end - start);
+    if ((len == 1 && *start == '*') || (len == n && len > 0 && memcmp(start, ip, n) == 0)) return 1;
+  }
+  return 0;
+}
+
+// 1 and the refusal in msg when fetch() may not connect to sa.
+static int sb_egress_refused(const char* host, const struct sockaddr* sa, char* msg, size_t msglen) {
+  const unsigned char* bytes;
+  int len;
+  if (sa->sa_family == AF_INET) { bytes = (const unsigned char*)&((const struct sockaddr_in*)sa)->sin_addr; len = 4; }
+  else if (sa->sa_family == AF_INET6) { bytes = ((const struct sockaddr_in6*)sa)->sin6_addr.s6_addr; len = 16; }
+  else { snprintf(msg, msglen, "fetch() refused: %s resolves to a non-IP address", host); return 1; }
+  char ip[INET6_ADDRSTRLEN];
+  if (!inet_ntop(sa->sa_family, bytes, ip, sizeof(ip))) {
+    snprintf(msg, msglen, "fetch() refused: %s resolves to an unprintable address", host);
+    return 1;
+  }
+  if (sb_egress_allowed(ip)) return 0;
+  const char* cidr = sb_egress_blocked(bytes, len);
+  if (!cidr) return 0;
+  snprintf(msg, msglen,
+           "fetch() refused: %s resolves to %s, a private or reserved address (%s). An operator can allow it with SB_EGRESS_ALLOW=%s",
+           host, ip, cidr, ip);
+  return 1;
+}
+// EGRESS:END
+
+// refused gets the first refusal; a caller reports it when nothing connected.
+static int sb_tcp_connect(const char* host, int port, char* refused, size_t refused_len) {
   struct addrinfo hints, *res = 0, *it;
   memset(&hints, 0, sizeof(hints));
   hints.ai_family = AF_UNSPEC;
   hints.ai_socktype = SOCK_STREAM;
   char portstr[16];
   snprintf(portstr, sizeof(portstr), "%d", port);
-  if (getaddrinfo(host, portstr, &hints, &res) != 0 || !res) return -1;
+  // URL.hostname keeps an IPv6 literal's brackets; getaddrinfo wants it bare.
+  char bare[256];
+  size_t hl = strlen(host);
+  if (hl > 2 && hl < sizeof(bare) && host[0] == '[' && host[hl - 1] == ']') {
+    memcpy(bare, host + 1, hl - 2);
+    bare[hl - 2] = 0;
+  } else {
+    snprintf(bare, sizeof(bare), "%s", host);
+  }
+  if (getaddrinfo(bare, portstr, &hints, &res) != 0 || !res) return -1;
   int fd = -1;
   for (it = res; it; it = it->ai_next) {
+    char why[512];
+    if (sb_egress_refused(host, it->ai_addr, why, sizeof(why))) {
+      if (!refused[0]) snprintf(refused, refused_len, "%s", why);
+      continue;
+    }
     fd = socket(it->ai_family, it->ai_socktype, it->ai_protocol);
     if (fd < 0) continue;
     struct timeval tv; tv.tv_sec = 30; tv.tv_usec = 0;
@@ -1155,8 +1263,9 @@ static char* sb_error_json(const char* prefix, const char* detail) {
 
 static char* sb_http_plain(const char* host, int port, const char* path, const char* method,
                            const char* headers, const char* body, size_t body_len) {
-  int fd = sb_tcp_connect(host, port);
-  if (fd < 0) return sb_error_json("could not connect to ", host);
+  char refused[512] = "";
+  int fd = sb_tcp_connect(host, port, refused, sizeof(refused));
+  if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
   sb_buf req = { 0, 0, 0 };
   sb_build_request(&req, host, path, method, headers, body, body_len);
@@ -1345,8 +1454,9 @@ static int sb_sock_write(void* ctx, const unsigned char* buf, size_t len) {
 
 static char* sb_https(const char* host, int port, const char* path, const char* method,
                       const char* headers, const char* body, size_t body_len) {
-  int fd = sb_tcp_connect(host, port);
-  if (fd < 0) return sb_error_json("could not connect to ", host);
+  char refused[512] = "";
+  int fd = sb_tcp_connect(host, port, refused, sizeof(refused));
+  if (fd < 0) return refused[0] ? sb_error_json(refused, 0) : sb_error_json("could not connect to ", host);
 
   br_ssl_client_context* sc = (br_ssl_client_context*)malloc(sizeof(br_ssl_client_context));
   br_x509_minimal_context* xc = (br_x509_minimal_context*)malloc(sizeof(br_x509_minimal_context));
@@ -1698,7 +1808,7 @@ function __sbD1BackupRaw(src, dest) {
 }
 
 // Outbound HTTP. String params so C can read each directly; the JS side has
-// already split the URL and enforced the allowlist. `tlsFlag` is "1" or "0" —
+// already split the URL; the connect refuses private addresses. `tlsFlag` is "1" or "0" —
 // a string like the rest, so the marshalling stays uniform.
 // oxlint-disable-next-line no-unused-vars -- read inside the RawC block below, not by JS.
 function __sbHttpRaw(host, portStr, path, method, headersText, body, tlsFlag) {
@@ -1805,12 +1915,6 @@ function __sbSqlRaw(path, sql, paramsJson) {
 // Deliberately the same SQL and the same partition keys as broker.ts. When one
 // changes the other has to, and the conformance suite is what says so.
 
-// The allowlist is baked into the module by wrap.ts; read it lazily so the
-// dispatch has no import-order dependency on __sbInstallBindings.
-function bindingsOutbound() {
-  return globalThis.__sbOutbound || [];
-}
-
 var __sbDataDir = "";
 function __sbDir() {
   // SB_DATA_DIR, then SPROUTBOAT_DATA, then <name>.data relative to the working
@@ -2048,9 +2152,6 @@ function __sbEmbeddedDispatch(msg) {
     const url = new URL(String(msg.url));
     const tls = url.protocol === "https:";
     if (!tls && url.protocol !== "http:") throw new Error("unsupported protocol: " + url.protocol);
-    const allow = bindingsOutbound();
-    if (allow.indexOf(url.host) === -1)
-      throw new Error("host not in outbound allowlist: " + url.host);
     let headerText = "";
     const pairs = msg.headers || [];
     for (let i = 0; i < pairs.length; i++) {

package/src/url-host.test.js

@@ -0,0 +1,25 @@
+// #174 — the prelude's URL shim splits `host` into hostname and port. An IPv6
+// literal holds colons of its own, so only the colon after `]` is the port's.
+// Lifted out of the text-only prelude, as client-ip.test.js does.
+import { expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const src = readFileSync(fileURLToPath(new URL("./native-fetch-prelude.js", import.meta.url)), "utf8");
+const start = src.indexOf("function __sbPortColon(");
+const end = src.indexOf("__sbDefineURLAccessor(", start);
+if (start === -1 || end === -1) throw new Error("__sbPortColon not found in prelude");
+// oxlint-disable-next-line no-function-constructor -- lifting a pure block out of the text-only prelude for test
+const portColon = new Function(`${src.slice(start, end)}\nreturn __sbPortColon;`)();
+const split = (host) => {
+  const c = portColon(host);
+  return c === -1 ? [host, ""] : [host.slice(0, c), host.slice(c + 1)];
+};
+
+test("hostname and port split at the port colon, never inside an IPv6 literal", () => {
+  expect(split("example.com")).toEqual(["example.com", ""]);
+  expect(split("example.com:8080")).toEqual(["example.com", "8080"]);
+  expect(split("[::1]")).toEqual(["[::1]", ""]);
+  expect(split("[::1]:9")).toEqual(["[::1]", "9"]);
+  expect(split("[64:ff9b::7f00:2]:443")).toEqual(["[64:ff9b::7f00:2]", "443"]);
+});

package/src/wrap.ts

@@ -58,7 +58,6 @@ export const BASELINE_COMPATIBILITY_DATE = "2026-08-26";
 export type Bindings = {
   kv: string[];
   secrets: string[];
-  outbound: string[];
   d1: string[];
   r2: string[];
   queues: string[];
@@ -78,7 +77,6 @@ export type Bindings = {
 export const EMPTY_BINDINGS: Bindings = {
   kv: [],
   secrets: [],
-  outbound: [],
   d1: [],
   r2: [],
   queues: [],
@@ -94,7 +92,6 @@ function hasBindings(b: Bindings): boolean {
   return (
     b.kv.length > 0 ||
     b.secrets.length > 0 ||
-    b.outbound.length > 0 ||
     b.d1.length > 0 ||
     b.r2.length > 0 ||
     b.queues.length > 0 ||
@@ -204,8 +201,6 @@ export function wrapNativeFetchHandler(
     `globalThis.__sbCompat = ${JSON.stringify(compatibilityDate)};\n` +
     // #15 — the embedded transport derives its default data directory from this.
     `globalThis.__sbAppName = ${JSON.stringify(appName)};\n` +
-    // #15 — and enforces the outbound allowlist itself, with no broker to do it.
-    `globalThis.__sbOutbound = ${JSON.stringify(bindings.outbound)};\n` +
     (assets ? `globalThis.__sbAssets = ${JSON.stringify(assets)};\n` : "");
   // The native transfer hook runs before JavaScript receives its Request. It
   // has a real file-backed implementation only in embedded builds. The broker
@@ -215,9 +210,10 @@ export function wrapNativeFetchHandler(
     transport === "embedded"
       ? `Porffor.c\`const char* sb_standalone_app_name(void) { return ${JSON.stringify(appName)}; }\`;\n`
       : "Porffor.c`typedef struct sb_r2_transfer_ctx { int unused; } sb_r2_transfer_ctx; int sb_r2_transfer_open(const char* a, const char* b, size_t c, sb_r2_transfer_ctx** d) { if (d) *d = 0; return 404; } int sb_r2_transfer_write(sb_r2_transfer_ctx* a, const char* b, size_t c) { return 404; } int sb_r2_transfer_finish(sb_r2_transfer_ctx* a) { return 404; } void sb_r2_transfer_abort(sb_r2_transfer_ctx* a) {} int sb_r2_transfer_download_open(const char* a, const char* b, sb_r2_transfer_ctx** c) { if (c) *c = 0; return 404; } size_t sb_r2_transfer_download_size(sb_r2_transfer_ctx* a) { return 0; } const char* sb_r2_transfer_download_etag(sb_r2_transfer_ctx* a) { return \"\"; } size_t sb_r2_transfer_download_read(sb_r2_transfer_ctx* a, size_t b, char* c, size_t d) { return 0; } void sb_r2_transfer_download_close(sb_r2_transfer_ctx* a) {}`;\n";
-  const wire = hasBindings(bindings)
-    ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n`
-    : "";
+  // #174 — fetch() needs no binding: every sprout gets it.
+  const wire =
+    "__sbInstallFetch();\n" +
+    (hasBindings(bindings) ? `__sbInstallBindings(env, ${JSON.stringify(bindings)});\n` : "");
   const registerDO = bindings.do.length
     ? `__sbRegisterDO({ ${bindings.do.map((d) => `${d.className}: ${d.className}`).join(", ")} });\n`
     : "";
@@ -320,7 +316,6 @@ export function readBindingsFromEnv(): Bindings {
   return {
     kv: strings(parsed.kv),
     secrets: strings(parsed.secrets),
-    outbound: strings(parsed.outbound),
     d1: strings(parsed.d1),
     r2: strings(parsed.r2),
     queues: strings(parsed.queues),