Function validate_resolved_ips_are_public 

pub fn validate_resolved_ips_are_public(
    host: &str,
    ips: &[IpAddr],
    nat64_prefixes: &[Nat64Prefix],
) -> Result<()>

Reject a resolution that contains any metadata or non-globally-routable address. This is the default post-resolution SSRF check.

An IPv6 answer inside one of nat64_prefixes is classified as the literal address, and again as the IPv4 address the local translator would deliver it to. All of those must be globally routable and none may be a metadata address. When configured prefixes overlap, an answer can sit inside several of them and decode to a different IPv4 destination under each; every such destination is reachable, so the answer is rejected when any one of them is denied rather than accepted on the first that happens to be acceptable.

Metadata is decoded only for evidenced translators: the well-known 64:ff9b::/96 prefix (which the address-class predicates decode unconditionally) and any prefix the operator declared in nat64_prefixes. An undeclared prefix is not synthesized, because nothing in the address proves the deployment routes it and doing so would deny legitimate global IPv6 whose bytes coincidentally embed a metadata address under some layout.

DNS pinning

This function validates only the supplied DNS answer. After it succeeds, the caller must connect to one of these exact validated addresses and must not resolve host again; otherwise DNS rebinding can replace the checked destination.

Errors

Returns an error when ips is empty, contains a known cloud metadata address, or contains any non-globally-routable address — including one reached through a configured NAT64 prefix.