fix(openai): allow RFC 2544 fake-IP range for Realtime session requests

shushushv · claude · shushushv · commit f0aeb1572089 · 2026-06-16T19:52:37.000+08:00
Proxy stacks such as Clash, Surge, and sing-box in TUN/fake-IP mode
resolve public domains (api.openai.com) to 198.18.0.0/15 (IPv4) or
fc00::/7 (IPv6), which the SSRF guard blocks as special-use ranges.
The Realtime session-secret fetch path was missing the opt-in that
already exists for other provider HTTP calls.

Add OPENAI_REALTIME_SSRF_POLICY with allowRfc2544BenchmarkRange,
allowIpv6UniqueLocalRange, and hostnameAllowlist scoped to
api.openai.com. Update voice and transcription request assertions to
cover all three policy fields.

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/extensions/openai/realtime-provider-shared.ts b/extensions/openai/realtime-provider-shared.ts
@@ -5,13 +5,20 @@ import {
   resolveProviderRequestHeaders,
 } from "openclaw/plugin-sdk/provider-http";
 import { captureWsEvent } from "openclaw/plugin-sdk/proxy-capture";
-import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+import {
+  fetchWithSsrFGuard,
+  ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist,
+} from "openclaw/plugin-sdk/ssrf-runtime";
 import {
   asFiniteNumber,
   asOptionalRecord as asObjectRecord,
   normalizeOptionalString,
 } from "openclaw/plugin-sdk/string-coerce-runtime";
 
+const OPENAI_REALTIME_SSRF_POLICY = ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist(
+  "https://api.openai.com/v1",
+);
+
 export const trimToUndefined = normalizeOptionalString;
 export { asFiniteNumber, asObjectRecord };
 
@@ -103,6 +110,7 @@ async function createOpenAIRealtimeSecret(
       },
       body: JSON.stringify(params.body),
     },
+    policy: OPENAI_REALTIME_SSRF_POLICY,
     auditContext: params.auditContext,
   });
   const payload = await (async () => {
diff --git a/extensions/openai/realtime-transcription-provider.test.ts b/extensions/openai/realtime-transcription-provider.test.ts
@@ -70,6 +70,11 @@ vi.mock("openclaw/plugin-sdk/provider-auth", () => ({
 
 vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({
   fetchWithSsrFGuard: ssrfMocks.fetchWithSsrFGuard,
+  ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist: () => ({
+    allowRfc2544BenchmarkRange: true,
+    allowIpv6UniqueLocalRange: true,
+    hostnameAllowlist: ["api.openai.com"],
+  }),
 }));
 
 type FakeWebSocketInstance = InstanceType<typeof FakeWebSocket>;
@@ -240,6 +245,11 @@ describe("buildOpenAIRealtimeTranscriptionProvider", () => {
     const request = mockCallArg(ssrfMocks.fetchWithSsrFGuard);
     expect(request.auditContext).toBe("openai-realtime-transcription-session");
     expect(request.url).toBe("https://api.openai.com/v1/realtime/transcription_sessions");
+    expect(request.policy).toEqual({
+      allowRfc2544BenchmarkRange: true,
+      allowIpv6UniqueLocalRange: true,
+      hostnameAllowlist: ["api.openai.com"],
+    });
     const init = request.init as {
       method?: string;
       headers?: Record<string, string>;
diff --git a/extensions/openai/realtime-voice-provider.test.ts b/extensions/openai/realtime-voice-provider.test.ts
@@ -81,6 +81,11 @@ vi.mock("ws", () => ({
 
 vi.mock("openclaw/plugin-sdk/ssrf-runtime", () => ({
   fetchWithSsrFGuard: fetchWithSsrFGuardMock,
+  ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist: () => ({
+    allowRfc2544BenchmarkRange: true,
+    allowIpv6UniqueLocalRange: true,
+    hostnameAllowlist: ["api.openai.com"],
+  }),
 }));
 
 vi.mock("openclaw/plugin-sdk/provider-auth", () => ({
@@ -405,6 +410,11 @@ describe("buildOpenAIRealtimeVoiceProvider", () => {
 
     expectRecordFields(requireFetchRequest(), "fetch request", {
       url: "https://api.openai.com/v1/realtime/client_secrets",
+      policy: {
+        allowRfc2544BenchmarkRange: true,
+        allowIpv6UniqueLocalRange: true,
+        hostnameAllowlist: ["api.openai.com"],
+      },
     });
     expectRecordFields(requireFetchInit(), "fetch init", { method: "POST" });
     expectRecordFields(requireFetchHeaders(), "fetch headers", {
diff --git a/scripts/plugin-sdk-surface-report.mjs b/scripts/plugin-sdk-surface-report.mjs
@@ -161,8 +161,8 @@ let publicDeprecatedExportsByEntrypointBudget;
 try {
   budgets = {
     publicEntrypoints: readBudgetEnv("OPENCLAW_PLUGIN_SDK_MAX_PUBLIC_ENTRYPOINTS", 319),
-    publicExports: readBudgetEnv("OPENCLAW_PLUGIN_SDK_MAX_PUBLIC_EXPORTS", 10271),
-    publicFunctionExports: readBudgetEnv("OPENCLAW_PLUGIN_SDK_MAX_PUBLIC_FUNCTION_EXPORTS", 5161),
+    publicExports: readBudgetEnv("OPENCLAW_PLUGIN_SDK_MAX_PUBLIC_EXPORTS", 10272),
+    publicFunctionExports: readBudgetEnv("OPENCLAW_PLUGIN_SDK_MAX_PUBLIC_FUNCTION_EXPORTS", 5162),
     publicDeprecatedExports: readBudgetEnv(
       "OPENCLAW_PLUGIN_SDK_MAX_PUBLIC_DEPRECATED_EXPORTS",
       3230,
diff --git a/src/plugin-sdk/ssrf-runtime.ts b/src/plugin-sdk/ssrf-runtime.ts
@@ -12,6 +12,7 @@ export {
   resolveSsrFPolicyForUrl,
   ssrfPolicyFromHttpBaseUrlAllowedHostname,
   ssrfPolicyFromHttpBaseUrlAllowedOrigin,
+  ssrfPolicyFromHttpBaseUrlFakeIpHostnameAllowlist,
   type LookupFn,
   type SsrFPolicy,
 } from "../infra/net/ssrf.js";
