Function validate_resolved_ips_exclude_metadata 

pub fn validate_resolved_ips_exclude_metadata(
    host: &str,
    ips: &[IpAddr],
    nat64_prefixes: &[Nat64Prefix],
) -> Result<()>

Reject a resolution that contains a known metadata address, but permit other private and loopback addresses. For callers that carry an explicit operator opt-in for private destinations; the known metadata endpoints remain blocked regardless.

The private opt-in never extends to metadata addresses, so an IPv6 answer inside one of nat64_prefixes is rejected when the IPv4 address it embeds is a metadata address. Overlapping prefixes decode one answer to several destinations; the answer is rejected when any of them is a metadata address. Metadata is decoded only for evidenced translators — the well-known 64:ff9b::/96 prefix and the operator-declared nat64_prefixes; an undeclared prefix is not synthesized (see validate_resolved_ips_are_public).

DNS pinning

This function validates only the supplied DNS answer. After it succeeds, the caller must connect to one of these exact validated addresses and must not resolve host again; otherwise DNS rebinding can replace the checked destination.

Errors

Returns an error when ips is empty or contains a known cloud metadata address — including one reached through a configured NAT64 prefix.