@@ -85,6 +85,7 @@ enum req_type {
8585struct target_conn {
8686 struct upstream up ;
8787 int fd ;
88+ int require_public_target ;
8889 WOLFSSL * ssl ;
8990 nghttp2_session * session ;
9091 struct forward_ctx * active_fx ;
@@ -489,7 +490,7 @@ static int parse_target_from_path(const uint8_t *value, size_t len,
489490 return 0 ;
490491}
491492
492- static int tcp_connect (const char * host , const char * port )
493+ static int tcp_connect (const char * host , const char * port , int require_public_target )
493494{
494495 struct addrinfo hints , * res = NULL , * rp ;
495496 int fd = -1 ;
@@ -508,7 +509,7 @@ static int tcp_connect(const char *host, const char *port)
508509 tv .tv_usec = 0 ;
509510
510511 for (rp = res ; rp ; rp = rp -> ai_next ) {
511- if (!sockaddr_is_public (rp -> ai_addr ))
512+ if (require_public_target && !sockaddr_is_public (rp -> ai_addr ))
512513 continue ;
513514 fd = socket (rp -> ai_family , rp -> ai_socktype , rp -> ai_protocol );
514515 if (fd < 0 )
@@ -676,7 +677,7 @@ static int connect_target_connection(struct target_conn *tc)
676677 return 0 ;
677678
678679 close_target_connection (tc );
679- tc -> fd = tcp_connect (tc -> up .host , tc -> up .port );
680+ tc -> fd = tcp_connect (tc -> up .host , tc -> up .port , tc -> require_public_target );
680681 if (tc -> fd < 0 )
681682 return -1 ;
682683
@@ -829,6 +830,7 @@ static int forward_to_dynamic_target(struct req *req, uint8_t *out, uint32_t *ou
829830 if (!target_is_allowed (tc .up .host , tc .up .port , tc .up .path ))
830831 return -1 ;
831832 tc .fd = -1 ;
833+ tc .require_public_target = 1 ;
832834
833835 if (forward_to_upstream (& tc , req , "application/oblivious-dns-message" , out , out_len ) != 0 ) {
834836 close_target_connection (& tc );
0 commit comments