opensource/sim
3
0
Fork 0
mirror of https://github.com/simstudioai/sim.git synced 2026-09-24 15:45:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs (#5798)

Browse Source 
* fix(mcp): pin outbound connections to IPv4 to avoid unreachable-IPv6 hangs

Root cause of the MCP 'connecting forever' / tool-discovery timeouts in
production: SSRF pinning forces each outbound connection to a single resolved
IP, which strips Happy Eyeballs' IPv4 fallback. dns.lookup(verbatim) returns the
IPv6 address first for Cloudflare-fronted dual-stack hosts (Gauge, api.exa.ai),
so the connection was pinned to IPv6 — but the production app subnets have no
IPv6 egress (AWS NAT gateways are IPv4-only), so the pinned IPv6 connection
connects into a void and hangs until the 30s timeout. Intermittent because the
resolver rotates A/AAAA order; works on retry when it happens to pick IPv4.

This is why h1.1 (#5797) did not fix it (protocol-independent) and why it never
reproduced locally (dev machines have IPv6 egress). Empirically verified: pinning
only the IPv6 address times out; preferring the IPv4 address connects in ~600ms.

Fix: at both pinned-resolution sites (validateMcpServerSsrf and validateUrlWithDNS)
resolve all addresses and prefer an IPv4 one; IPv6-only hosts still pin their sole
address. No signature/threading changes; SSRF validation of the pinned IP is
unchanged.

* chore(mcp): trim inline comments on the IPv4-preference fix
This commit is contained in:
Waleed
2026-07-20 22:29:29 -07:00
committed by GitHub
parent 48103e952a
commit d381eef93d
3 changed files with 36 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/sim/lib/core/security/input-validation.server.ts
+4 -1
View File
@@ -105,7 +105,10 @@ export async function validateUrlWithDNS(
}
try {
const { address } = await dns.lookup(cleanHostname, { verbatim: true })
// Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address hangs
// on IPv4-only egress (e.g. AWS NAT gateways). See validateMcpServerSsrf.
const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true })
const { address } = resolved.find((entry) => entry.family === 4) ?? resolved[0]
const resolvedIsLoopback =
ipaddr.isValid(address) &&
apps/sim/lib/mcp/domain-check.test.ts
+28 -9
View File
@@ -364,12 +364,31 @@ describe('validateMcpServerSsrf', () => {
})
it('returns resolved IP for URLs that resolve to public IPs', async () => {
mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' })
mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
await expect(validateMcpServerSsrf('https://example.com/mcp')).resolves.toBe('93.184.216.34')
})
it('prefers IPv4 over IPv6 for a dual-stack host (verbatim returns IPv6 first)', async () => {
// Cloudflare-fronted hosts resolve IPv6-first; pinning that IPv6 hangs on an IPv4-only
// egress. The guard must pin the reachable IPv4 instead.
mockDnsLookup.mockResolvedValue([
{ address: '2606:4700:3037::ac43:cc5f', family: 6 },
{ address: '104.21.22.105', family: 4 },
])
await expect(validateMcpServerSsrf('https://app.withgauge.com/mcp')).resolves.toBe(
'104.21.22.105'
)
})
it('pins the sole IPv6 address for an IPv6-only host', async () => {
mockDnsLookup.mockResolvedValue([{ address: '2606:4700:3037::ac43:cc5f', family: 6 }])
await expect(validateMcpServerSsrf('https://ipv6-only.example/mcp')).resolves.toBe(
'2606:4700:3037::ac43:cc5f'
)
})
it('returns resolved IP for HTTP URLs on non-localhost hosts', async () => {
mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' })
mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
await expect(validateMcpServerSsrf('http://example.com:3000/mcp')).resolves.toBe(
'93.184.216.34'
)
@@ -405,12 +424,12 @@ describe('validateMcpServerSsrf', () => {
})
it('throws McpSsrfError for URLs resolving to private IPs', async () => {
mockDnsLookup.mockResolvedValue({ address: '10.0.0.5' })
mockDnsLookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }])
await expect(validateMcpServerSsrf('https://internal.corp/mcp')).rejects.toThrow(McpSsrfError)
})
it('throws McpSsrfError for URLs resolving to link-local IPs', async () => {
mockDnsLookup.mockResolvedValue({ address: '169.254.169.254' })
mockDnsLookup.mockResolvedValue([{ address: '169.254.169.254', family: 4 }])
await expect(validateMcpServerSsrf('https://metadata.internal/latest')).rejects.toThrow(
McpSsrfError
)
@@ -424,7 +443,7 @@ describe('validateMcpServerSsrf', () => {
})
it('returns resolved IP for URLs resolving to loopback on self-hosted (localhost alias)', async () => {
mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' })
mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }])
await expect(validateMcpServerSsrf('http://my-local-alias:3000/mcp')).resolves.toBe('127.0.0.1')
})
@@ -450,14 +469,14 @@ describe('validateMcpServerSsrf', () => {
})
it('rejects URLs resolving to loopback on hosted', async () => {
mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' })
mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }])
await expect(validateMcpServerSsrf('http://my-local-alias:3000/mcp')).rejects.toThrow(
McpSsrfError
)
})
it('returns resolved IP for public IP resolutions on hosted', async () => {
mockDnsLookup.mockResolvedValue({ address: '93.184.216.34' })
mockDnsLookup.mockResolvedValue([{ address: '93.184.216.34', family: 4 }])
await expect(validateMcpServerSsrf('https://example.com/mcp')).resolves.toBe('93.184.216.34')
})
@@ -483,7 +502,7 @@ describe('validateMcpServerSsrf', () => {
})
it('still blocks DNS resolutions to private IPs on hosted (regression)', async () => {
mockDnsLookup.mockResolvedValue({ address: '10.0.0.5' })
mockDnsLookup.mockResolvedValue([{ address: '10.0.0.5', family: 4 }])
await expect(validateMcpServerSsrf('https://internal.corp/mcp')).rejects.toThrow(McpSsrfError)
})
@@ -508,7 +527,7 @@ describe('validateMcpServerSsrf', () => {
})
it('returns resolved loopback IP for DNS aliases (caller pins)', async () => {
mockDnsLookup.mockResolvedValue({ address: '127.0.0.1' })
mockDnsLookup.mockResolvedValue([{ address: '127.0.0.1', family: 4 }])
await expect(validateMcpServerSsrf('http://my-local-alias/mcp')).resolves.toBe('127.0.0.1')
})
})
apps/sim/lib/mcp/domain-check.ts
+4 -2
View File
@@ -185,8 +185,10 @@ export async function validateMcpServerSsrf(url: string | undefined): Promise<st
let address: string
try {
const lookup = await dns.lookup(cleanHostname, { verbatim: true })
address = lookup.address
// Prefer IPv4: pinning strips Happy Eyeballs' fallback, and a pinned IPv6 address
// (which `verbatim` returns first for dual-stack hosts) hangs on IPv4-only egress.
const resolved = await dns.lookup(cleanHostname, { all: true, verbatim: true })
address = (resolved.find((entry) => entry.family === 4) ?? resolved[0]).address
} catch (error) {
logger.warn('DNS lookup failed for MCP server URL', {
hostname,