fix: prefer IPv4 for pinned SSRF lookups

scoootscooob · scoootscooob · commit 89b3fac6cecc · 2026-05-10T04:08:51.000-04:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -22,6 +22,7 @@ Docs: https://docs.openclaw.ai
 
 - Gateway: reread config from disk after the first in-process restart loop startup, preventing SIGUSR1 restarts from reusing a stale startup snapshot and dropping config written after boot. Fixes #79947. Thanks @TheLevti.
 - Codex app-server: deliver native image-generation outputs from Codex `savedPath` events as reply media, so blank-text image generation turns still attach the generated file. Thanks @keshavbotagent.
+- Network/SSRF: keep pinned automatic DNS lookups on IPv4 when dual-stack hosts also publish AAAA records, and treat `EADDRNOTAVAIL` as a transient gateway network failure instead of a fatal crash. Fixes #80078. Thanks @takamasa-aiso.
 - Media/host-read: allow buffer-verified gzip, tar, and 7z archives in the shared host-local media validator alongside ZIP and document attachments.
 - Plugins/doctor: invalidate persisted plugin registry snapshots when plugin diagnostics point at deleted source paths, so `openclaw doctor` stops repeating stale warnings after a local extension is replaced by a managed npm plugin. Fixes #80087. (#80134) Thanks @hclsys.
 - Cron: let isolated self-cleanup runs inspect their own job run history while keeping other cron jobs and mutation actions blocked. Fixes #80019. Thanks @hclsys.
diff --git a/src/infra/net/ssrf.pinning.test.ts b/src/infra/net/ssrf.pinning.test.ts
@@ -49,6 +49,52 @@ describe("ssrf pinning", () => {
     );
   });
 
+  it("keeps automatic pinned lookups on IPv4 when both address families are available", async () => {
+    const lookup = createPinnedLookup({
+      hostname: "api.anthropic.com",
+      addresses: ["160.79.104.10", "2607:6bc0::10"],
+    });
+    const lookupDefault = () =>
+      new Promise<{ address: string; family?: number }>((resolve, reject) => {
+        lookup("api.anthropic.com", (err, address, family) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve({ address: address, family });
+          }
+        });
+      });
+    const lookupWithOptions = (options: { family?: number }) =>
+      new Promise<{ address: string; family?: number }>((resolve, reject) => {
+        lookup("api.anthropic.com", options, (err, address, family) => {
+          if (err) {
+            reject(err);
+          } else {
+            resolve({ address: address, family });
+          }
+        });
+      });
+
+    await expect(lookupDefault()).resolves.toEqual({ address: "160.79.104.10", family: 4 });
+    await expect(lookupDefault()).resolves.toEqual({ address: "160.79.104.10", family: 4 });
+
+    const all = await new Promise<unknown>((resolve, reject) => {
+      lookup("api.anthropic.com", { all: true }, (err, addresses) => {
+        if (err) {
+          reject(err);
+        } else {
+          resolve(addresses);
+        }
+      });
+    });
+    expect(all).toEqual([{ address: "160.79.104.10", family: 4 }]);
+
+    await expect(lookupWithOptions({ family: 6 })).resolves.toEqual({
+      address: "2607:6bc0::10",
+      family: 6,
+    });
+  });
+
   it.each([
     { name: "RFC1918 private address", address: "10.0.0.8" },
     { name: "RFC2544 benchmarking range", address: "198.18.0.1" },
diff --git a/src/infra/net/ssrf.ts b/src/infra/net/ssrf.ts
@@ -345,6 +345,8 @@ export function createPinnedLookup(params: {
     address,
     family: address.includes(":") ? 6 : 4,
   }));
+  const ipv4Records = records.filter((entry) => entry.family === 4);
+  const automaticRecords = ipv4Records.length > 0 ? ipv4Records : records;
   let index = 0;
 
   return ((host: string, options?: unknown, callback?: unknown) => {
@@ -370,8 +372,8 @@ export function createPinnedLookup(params: {
     const candidates =
       requestedFamily === 4 || requestedFamily === 6
         ? records.filter((entry) => entry.family === requestedFamily)
-        : records;
-    const usable = candidates.length > 0 ? candidates : records;
+        : automaticRecords;
+    const usable = candidates.length > 0 ? candidates : automaticRecords;
     if (opts.all) {
       cb(null, usable as LookupAddress[]);
       return;
diff --git a/src/infra/unhandled-rejections.test.ts b/src/infra/unhandled-rejections.test.ts
@@ -62,6 +62,7 @@ describe("isTransientNetworkError", () => {
       "EPIPE",
       "EHOSTUNREACH",
       "ENETUNREACH",
+      "EADDRNOTAVAIL",
       "EAI_AGAIN",
       "EPROTO",
       "UND_ERR_CONNECT_TIMEOUT",
@@ -368,13 +369,21 @@ describe("isTransientUnhandledRejectionError", () => {
     const rawHostUnreachable = new Error(
       "connect EHOSTUNREACH 149.154.167.220:443 - Local (10.0.10.40:50017)",
     );
+    const addressUnavailable = Object.assign(new Error("connect EADDRNOTAVAIL"), {
+      code: "EADDRNOTAVAIL",
+    });
+    const rawAddressUnavailable = new Error(
+      "connect EADDRNOTAVAIL 2607:6bc0::10:443 - Local (:::0)",
+    );
     const generic = new Error("boom");
 
     expect(isBenignUncaughtExceptionError(epipe)).toBe(true);
     expect(isBenignUncaughtExceptionError(sqlite)).toBe(false);
     expect(isBenignUncaughtExceptionError(network)).toBe(false);
     expect(isBenignUncaughtExceptionError(hostUnreachable)).toBe(true);
     expect(isBenignUncaughtExceptionError(rawHostUnreachable)).toBe(true);
+    expect(isBenignUncaughtExceptionError(addressUnavailable)).toBe(true);
+    expect(isBenignUncaughtExceptionError(rawAddressUnavailable)).toBe(true);
     expect(isBenignUncaughtExceptionError(generic)).toBe(false);
   });
   it("returns true for transient SQLite errors", () => {
diff --git a/src/infra/unhandled-rejections.ts b/src/infra/unhandled-rejections.ts
@@ -59,6 +59,7 @@ const TRANSIENT_NETWORK_CODES = new Set([
   "EPIPE",
   "EHOSTUNREACH",
   "ENETUNREACH",
+  "EADDRNOTAVAIL",
   "EAI_AGAIN",
   "UND_ERR_CONNECT_TIMEOUT",
   "UND_ERR_DNS_RESOLVE_FAILED",
@@ -93,6 +94,7 @@ const BENIGN_UNCAUGHT_EXCEPTION_NETWORK_CODES = new Set([
   "ECONNREFUSED",
   "EHOSTUNREACH",
   "ENETUNREACH",
+  "EADDRNOTAVAIL",
   "EAI_AGAIN",
   "ENOTFOUND",
   "ETIMEDOUT",
@@ -102,9 +104,9 @@ const BENIGN_UNCAUGHT_EXCEPTION_NETWORK_CODES = new Set([
 ]);
 
 const TRANSIENT_NETWORK_MESSAGE_CODE_RE =
-  /\b(ECONNRESET|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ESOCKETTIMEDOUT|ECONNABORTED|EPIPE|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|EPROTO|UND_ERR_CONNECT_TIMEOUT|UND_ERR_DNS_RESOLVE_FAILED|UND_ERR_CONNECT|UND_ERR_SOCKET|UND_ERR_HEADERS_TIMEOUT|UND_ERR_BODY_TIMEOUT)\b/i;
+  /\b(ECONNRESET|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ESOCKETTIMEDOUT|ECONNABORTED|EPIPE|EHOSTUNREACH|ENETUNREACH|EADDRNOTAVAIL|EAI_AGAIN|EPROTO|UND_ERR_CONNECT_TIMEOUT|UND_ERR_DNS_RESOLVE_FAILED|UND_ERR_CONNECT|UND_ERR_SOCKET|UND_ERR_HEADERS_TIMEOUT|UND_ERR_BODY_TIMEOUT)\b/i;
 const BENIGN_UNCAUGHT_EXCEPTION_NETWORK_MESSAGE_CODE_RE =
-  /\b(ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|EAI_AGAIN|ENOTFOUND|ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|UND_ERR_DNS_RESOLVE_FAILED|UND_ERR_CONNECT)\b/i;
+  /\b(ECONNREFUSED|EHOSTUNREACH|ENETUNREACH|EADDRNOTAVAIL|EAI_AGAIN|ENOTFOUND|ETIMEDOUT|UND_ERR_CONNECT_TIMEOUT|UND_ERR_DNS_RESOLVE_FAILED|UND_ERR_CONNECT)\b/i;
 
 const TRANSIENT_SQLITE_MESSAGE_CODE_RE =
   /\b(SQLITE_BUSY|SQLITE_CANTOPEN|SQLITE_IOERR|SQLITE_LOCKED)\b/i;
