Skip recording DNS noise for private IP literals with no pending port

Private IP literal hostnames with no pending port (resolver bootstrap
noise, network capability probing, etc.) flood the outbound-connections
dashboard. Outbound domain blocking and SSRF detection stay fully
unconditional either way - only the dashboard hit is skipped.

Author: dmitrii

agent_api/src/main/java/dev/aikido/agent_api/collectors/DNSRecordCollector.java

@@ -12,6 +12,7 @@
 import dev.aikido.agent_api.vulnerabilities.ssrf.SSRFException;
 import dev.aikido.agent_api.helpers.logging.LogManager;
 import dev.aikido.agent_api.helpers.logging.Logger;
+import dev.aikido.agent_api.vulnerabilities.ssrf.IsPrivateIP;
 import dev.aikido.agent_api.vulnerabilities.ssrf.StoredSSRFDetector;
 import dev.aikido.agent_api.vulnerabilities.ssrf.StoredSSRFException;
 
@@ -41,7 +42,8 @@ public static void report(String hostname, InetAddress[] inetAddresses) {
                 for (int port : ports) {
                     HostnamesStore.incrementHits(hostname, port);
                 }
-            } else {
+            }
+            if (ports.isEmpty() && !IsPrivateIP.isPrivateIp(hostname)) {
                 // We still need to report a hit to the hostname for outbound domain blocking
                 HostnamesStore.incrementHits(hostname, 0);
             }

agent_api/src/test/java/collectors/DNSRecordCollectorTest.java

@@ -203,6 +203,62 @@ public void testSSRFStillRunsWhenPendingPortIsZero() {
         assertEquals("Aikido Zen has blocked a server-side request forgery", exception.getMessage());
     }
 
+    @Test
+    public void testPrivateIpLiteralWithNoPendingPortNotRecorded() {
+        Context.set(null);
+        DNSRecordCollector.report("10.20.11.143", new InetAddress[]{inetAddress2});
+        assertEquals(0, HostnamesStore.getHostnamesAsList().length);
+    }
+
+    @Test
+    public void testPrivateIpLiteralWithNoPendingPortNotRecordedButBlockedInLockdown() {
+        ServiceConfigStore.updateFromAPIResponse(new APIResponse(
+            true, null, 0L, null, null, null, true, List.of(), true, true, List.of()
+        ));
+        Context.set(null);
+        assertThrows(BlockedOutboundException.class, () ->
+            DNSRecordCollector.report("10.20.11.143", new InetAddress[]{inetAddress2})
+        );
+        assertEquals(0, HostnamesStore.getHostnamesAsList().length);
+    }
+
+    @Test
+    public void testPrivateIpLiteralWithPendingPortStillRecordedAndBlockedInLockdown() {
+        ServiceConfigStore.updateFromAPIResponse(new APIResponse(
+            true, null, 0L, null, null, null, true, List.of(), true, true, List.of()
+        ));
+        PendingHostnamesStore.add("10.20.11.143", 443);
+        Context.set(mock(ContextObject.class));
+
+        assertThrows(BlockedOutboundException.class, () ->
+            DNSRecordCollector.report("10.20.11.143", new InetAddress[]{inetAddress2})
+        );
+        Hostnames.HostnameEntry[] entries = HostnamesStore.getHostnamesAsList();
+        assertEquals(1, entries.length);
+        assertEquals(443, entries[0].getPort());
+    }
+
+    @Test
+    public void testSsrfStillDetectedForPrivateIpLiteralWithPendingPort() {
+        ServiceConfigStore.updateBlocking(true);
+        PendingHostnamesStore.add("169.254.169.254", 80);
+        Context.set(new EmptySampleContextObject("http://169.254.169.254:80/latest/meta-data/"));
+
+        Exception exception = assertThrows(SSRFException.class, () ->
+            DNSRecordCollector.report("169.254.169.254", new InetAddress[]{imdsAddress1})
+        );
+        assertEquals("Aikido Zen has blocked a server-side request forgery", exception.getMessage());
+    }
+
+    @Test
+    public void testNamedHostnameResolvingToPrivateIpWithNoPendingPortStillRecorded() {
+        Context.set(null);
+        DNSRecordCollector.report("internal-service.local", new InetAddress[]{inetAddress2});
+        Hostnames.HostnameEntry[] entries = HostnamesStore.getHostnamesAsList();
+        assertEquals(1, entries.length);
+        assertEquals("internal-service.local", entries[0].getHostname());
+    }
+
     @Test
     public void testStoredSSRFWithNoContext() throws InterruptedException {
         ServiceConfigStore.updateBlocking(true);