From ea054fcf0d53fc9a17dce27cf29567bd42557c03 Mon Sep 17 00:00:00 2001
From: Hans Ott <hansott@hotmail.be>
Date: Thu, 22 Oct 2026 13:28:26 +0200
Subject: [PATCH] Don't block literal IPs for outbound domain blocking

As we don't report them
---
 .../agent_api/collectors/DNSRecordCollector.java     |  4 ++--
 .../test/java/collectors/DNSRecordCollectorTest.java | 12 ++++++------
 docs/outbound-domain-caveat.md                       |  9 +++++++++
 3 files changed, 17 insertions(+), 8 deletions(-)
 create mode 100644 docs/outbound-domain-caveat.md

diff --git a/agent_api/src/main/java/dev/aikido/agent_api/collectors/DNSRecordCollector.java b/agent_api/src/main/java/dev/aikido/agent_api/collectors/DNSRecordCollector.java
index 1e282eb4d..e4e2dc778 100644
--- a/agent_api/src/main/java/dev/aikido/agent_api/collectors/DNSRecordCollector.java
+++ b/agent_api/src/main/java/dev/aikido/agent_api/collectors/DNSRecordCollector.java
@@ -44,12 +44,12 @@ public static void report(String hostname, InetAddress[] inetAddresses) {
                 }
             } else if (!IPValidator.isIP(hostname)) {
                 // Skip literal IPs with no pending port: usually inbound IP parsing rather than an outbound request,
-                // and we can't tell them apart here. A real outbound one still hits the blocking/SSRF checks below.
+                // and we can't tell them apart here. A real outbound one still hits the SSRF checks below.
                 HostnamesStore.incrementHits(hostname, 0);
             }
 
             // Checked here, not at the HTTP client, since not all clients are instrumented and port/context isn't always available.
-            if (ServiceConfigStore.shouldBlockOutgoingRequest(hostname)) {
+            if (!IPValidator.isIP(hostname) && ServiceConfigStore.shouldBlockOutgoingRequest(hostname)) {
                 logger.debug("Blocking DNS lookup for domain: %s", hostname);
                 throw BlockedOutboundException.get();
             }
diff --git a/agent_api/src/test/java/collectors/DNSRecordCollectorTest.java b/agent_api/src/test/java/collectors/DNSRecordCollectorTest.java
index c2858c5db..20f018e52 100644
--- a/agent_api/src/test/java/collectors/DNSRecordCollectorTest.java
+++ b/agent_api/src/test/java/collectors/DNSRecordCollectorTest.java
@@ -211,26 +211,26 @@ public void testPrivateIpLiteralWithNoPendingPortNotRecorded() {
     }
 
     @Test
-    public void testPrivateIpLiteralWithNoPendingPortNotRecordedButBlockedInLockdown() {
+    public void testPrivateIpLiteralWithNoPendingPortNotRecordedOrBlockedInLockdown() {
         ServiceConfigStore.updateFromAPIResponse(new APIResponse(
             true, null, 0L, null, null, null, true, List.of(), true, true, List.of(), 0
         ));
         Context.set(null);
-        assertThrows(BlockedOutboundException.class, () ->
+        assertDoesNotThrow(() ->
             DNSRecordCollector.report("10.20.11.143", new InetAddress[]{inetAddress2})
         );
         assertEquals(0, HostnamesStore.getHostnamesAsList().length);
     }
 
     @Test
-    public void testPrivateIpLiteralWithPendingPortStillRecordedAndBlockedInLockdown() {
+    public void testPrivateIpLiteralWithPendingPortStillRecordedButNotBlockedInLockdown() {
         ServiceConfigStore.updateFromAPIResponse(new APIResponse(
             true, null, 0L, null, null, null, true, List.of(), true, true, List.of(), 0
         ));
         PendingHostnamesStore.add("10.20.11.143", 443);
         Context.set(mock(ContextObject.class));
 
-        assertThrows(BlockedOutboundException.class, () ->
+        assertDoesNotThrow(() ->
             DNSRecordCollector.report("10.20.11.143", new InetAddress[]{inetAddress2})
         );
         Hostnames.HostnameEntry[] entries = HostnamesStore.getHostnamesAsList();
@@ -284,12 +284,12 @@ public void testPublicIpLiteralWithPendingPortStillRecorded() {
     }
 
     @Test
-    public void testPublicIpLiteralWithNoPendingPortNotRecordedButBlockedInLockdown() {
+    public void testPublicIpLiteralWithNoPendingPortNotRecordedOrBlockedInLockdown() {
         ServiceConfigStore.updateFromAPIResponse(new APIResponse(
             true, null, 0L, null, null, null, true, List.of(), true, true, List.of(), 0
         ));
         Context.set(null);
-        assertThrows(BlockedOutboundException.class, () ->
+        assertDoesNotThrow(() ->
             DNSRecordCollector.report("8.8.8.8", new InetAddress[]{inetAddress1})
         );
         assertEquals(0, HostnamesStore.getHostnamesAsList().length);
diff --git a/docs/outbound-domain-caveat.md b/docs/outbound-domain-caveat.md
new file mode 100644
index 000000000..b9a18e4da
--- /dev/null
+++ b/docs/outbound-domain-caveat.md
@@ -0,0 +1,9 @@
+# Outbound domain blocking caveat
+
+Java's `InetAddress.getByName()` handles both DNS lookups and parsing IP addresses. For example, Tomcat calls it to check whether an incoming request came through a trusted load balancer or proxy, without opening an outbound connection.
+
+To avoid blocking these checks, Zen for Java skips literal IPv4 and IPv6 addresses when enforcing outbound domain rules. It also omits them from outbound reporting unless it can link them to an HTTP request.
+
+Requests made directly to an IP bypass "block new outbound connections" and explicit IP block entries. Named domains still follow your allow/block rules, and SSRF checks still run.
+
+Other Zen agents report outbound HTTP(S) traffic to literal IPs and block unapproved IP destinations when "block new outbound connections" is enabled. We're working on closing this gap in Java without disrupting inbound IP parsing.