gullradriel/nilorea-library
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Page: n__ssrf_8c
Pages
Examples Files Home Module AABB3D Module ACCEPT_POOL Module ALLEGRO4 Module ALLEGRO5 Module ANIM_LIB Module ASTAR Module ATLAS_LIB Module AVRO Module CLOCK_SYNC Module COMMONS Module CONFIGFILE Module CYPHER_BASE64 Module CYPHER_VIGENERE Module DEAD_RECKONING Module ENUMS Module EXCEPTIONS Module GAME_ENV Module GIT Module GUI Module HASH_TABLE Module ISOMETRIC_ENGINE Module LIST Module LOG Module LOGNODUP Module LZ4 Module NETWORKING Module NETWORK_MSG Module N_COOKIES Module N_DIFF Module N_DIGEST Module N_DISK_CACHE Module N_DNS Module N_ECC Module N_ENTROPY Module N_FILES Module N_FLUIDS Module N_GUI_COLOR Module N_GUI_COLORWHEEL Module N_GUI_CURVE Module N_GUI_GRID Module N_GUI_POPUP Module N_HEX Module N_HTTP3 Module N_HTTP_COOKIE Module N_HTTP_FORM Module N_HTTP_MIME Module N_HTTP_REQ Module N_HTTP_RESP Module N_HTTP_ROUTER Module N_HTTP_SERVER Module N_ICC Module N_JSON Module N_KAFKA Module N_LINALG Module N_MODULE Module N_OPENSSL_COMPAT Module N_PRETTY Module N_PTH Module N_QUERY Module N_RANDOM Module N_SHA256 Module N_STR Module N_TIFF Module N_TIME Module N_USER Module N_X509 Module N_ZIP Module PARTICLES Module PCRE Module PHYSICS Module SIGNALS Module STACK Module THREADS Module TRAJECTORY Module TREE Module ZLIB Modules Pages Struct A4_BMP Struct A4_TIMER Struct AABB3D Struct ANIM_DATA Struct ANIM_FRAME Struct ANIM_GFX Struct ANIM_LIB Struct ASTAR_BOX Struct ASTAR_CELL Struct ASTAR_GRID Struct ASTAR_HEAP Struct ASTAR_HEAP_NODE Struct ASTAR_NODE Struct ASTAR_PATH Struct AVRO_FIELD Struct AVRO_READER Struct AVRO_SCHEMA Struct BITMAP Struct CALLBACK_DATA Struct CA_CTX Struct CLIENT_JOB Struct CLIENT_STATE Struct CONFIG_FILE Struct CONFIG_FILE_SECTION Struct CYPHER_PARAM Struct DATA Struct DEMO_PANEL Struct DICTIONARY_DEFINITION Struct DICTIONARY_ENTRY Struct DIFF_OUT Struct DIFF_TEXT Struct DRAW_STATE Struct DR_ENTITY Struct DR_STATE Struct DR_VEC3 Struct ExceptionContextList Struct FONT Struct GAME_ENV Struct H2BUF Struct H2_DYN_ENTRY Struct H2_STREAM Struct HASH_NODE Struct HASH_TABLE Struct ISO_DRAW_ENTRY Struct ISO_MAP Struct ISO_PROJECTION Struct ISO_TILE_SEGMENT Struct ISO_TILE_SEGMENTS Struct ISO_VISIBLE_EDGES Struct JS_STATE Struct LEX_ITEM Struct LIST Struct LIST_NODE Struct LOG_LEVELS Struct LexMenu Struct MEMBER Struct MIDI Struct NESTED Struct NETWORK Struct NETWORK_HTTP_INFO Struct NETWORK_POOL Struct NETWORK_SSL_THREAD_PARAMS Struct NETW_ACCEPT_POOL Struct NETW_ACCEPT_POOL_STATS Struct NETW_MSG Struct NETW_SNI_ARG Struct NODE_DATA Struct N_ATLAS Struct N_ATLAS_PAGE Struct N_CLOCK_SYNC Struct N_COOKIE Struct N_COOKIE_JAR Struct N_DIFF_LINE Struct N_DIFF_RESULT Struct N_DISK_CACHE Struct N_ENTROPY_BIT Struct N_ENTROPY_POS Struct N_FILE_INFO Struct N_FLUID Struct N_FLUID_THREAD_PARAMS Struct N_FORM_FIELD Struct N_GIT_COMMIT_INFO Struct N_GIT_REMOTE_AUTH Struct N_GIT_REPO Struct N_GIT_STATUS_ENTRY Struct N_GUI_BUTTON_DATA Struct N_GUI_CHECKBOX_DATA Struct N_GUI_COLOR_PICKER Struct N_GUI_COMBOBOX_DATA Struct N_GUI_CTX Struct N_GUI_CUSTOM_DATA Struct N_GUI_DATAGRID_COL Struct N_GUI_DATAGRID_DATA Struct N_GUI_DROPMENU_DATA Struct N_GUI_DROPMENU_ENTRY Struct N_GUI_GRID_CALLBACKS Struct N_GUI_HEXVIEW_DATA Struct N_GUI_IMAGE_DATA Struct N_GUI_KVTABLE Struct N_GUI_KV_CONTENT Struct N_GUI_KV_ROW Struct N_GUI_LABEL_DATA Struct N_GUI_LISTBOX_DATA Struct N_GUI_LISTITEM Struct N_GUI_MARKDOWNVIEW_DATA Struct N_GUI_MD_FONTS Struct N_GUI_MD_STYLE Struct N_GUI_MEAS_ENTRY Struct N_GUI_MOUSE_EVENT Struct N_GUI_PENDING_GEOM Struct N_GUI_PENDING_WIDGET Struct N_GUI_POPUP Struct N_GUI_PROGRESSBAR_DATA Struct N_GUI_RADIOLIST_DATA Struct N_GUI_SB_TRACK Struct N_GUI_SCROLLBAR_DATA Struct N_GUI_SECTION Struct N_GUI_SECTIONLIST Struct N_GUI_SLIDER_DATA Struct N_GUI_SPLITPANE_DATA Struct N_GUI_STYLE Struct N_GUI_SUGGEST_SINK Struct N_GUI_SYNTAXVIEW_DATA Struct N_GUI_TAB_PANEL Struct N_GUI_TB_BUTTONS Struct N_GUI_TEXTAREA_DATA Struct N_GUI_TEXT_DIMS Struct N_GUI_THEME Struct N_GUI_TREE Struct N_GUI_TREE_NODE Struct N_GUI_TREE_STATE Struct N_GUI_WIDGET Struct N_GUI_WINDOW Struct N_H2_FRAME Struct N_H2_HEADER Struct N_H2_HPACK Struct N_H2_REQUEST Struct N_H2_SERVER Struct N_H2_SETTING Struct N_HTML_ATTR_ Struct N_HTML_FORM Struct N_HTML_TAG_ Struct N_HTTP3_RESPONSE Struct N_HTTP_FIELD Struct N_HTTP_FORM Struct N_HTTP_FORM_MULTIPART Struct N_HTTP_FORM_PART Struct N_HTTP_MULTIPART_PART Struct N_HTTP_REQUEST Struct N_HTTP_RESP Struct N_HTTP_RESPONSE Struct N_HTTP_SERVER Struct N_HTTP_SERVER_CONFIG Struct N_HTTP_SERVER_REQUEST Struct N_HTTP_SERVER_STATS Struct N_HTTP_SET_COOKIE Struct N_HTTP_STREAM Struct N_ISO_CAMERA Struct N_ISO_OBJECT Struct N_KAFKA Struct N_KAFKA_EVENT Struct N_MOCK_SERVER Struct N_MODULE Struct N_PARALLEL_SLICE Struct N_PARALLEL_TEAM Struct N_PARALLEL_WORKER Struct N_PCRE Struct N_PROXY_CFG Struct N_PTH Struct N_PTH_TENSOR Struct N_QUERY Struct N_ROUTE Struct N_ROUTER Struct N_ROUTE_MATCH Struct N_SHA256 Struct N_SOCKET Struct N_SPAWN_PIPE Struct N_SSE_CONN Struct N_SSE_EVENT Struct N_STR Struct N_TIFF Struct N_TIFF_ENTRY Struct N_TIME Struct N_URL Struct N_URL_PARAM Struct N_USER Struct N_USERLIST Struct N_WS_CONN Struct N_WS_FRAME Struct N_WS_MESSAGE Struct N_ZIP_MEMBER Struct OCTREE Struct OCTREE_NODE Struct PARSER Struct PARTICLE Struct PARTICLE_EMITTER Struct PARTICLE_SYSTEM Struct PEER Struct PHYSICS Struct PK_OBJ Struct PK_VM Struct POINT2D Struct POINT3D Struct PRETTY_OUT Struct QNODE Struct QUADTREE Struct QUADTREE_NODE Struct REC Struct RGB Struct SAMPLE Struct SEEN Struct SHARER Struct SRV Struct SRV_ARG Struct STACK Struct STACK_ITEM Struct SYNTAX_RUN Struct THREAD_POOL Struct THREAD_POOL_NODE Struct THREAD_WAITING_PROC Struct TRAJECTORY Struct TRAJECTORY_POINT Struct TREE Struct TREE_NODE Struct TS_LOG Struct WAYPOINT3D Struct WORKER_ARG Struct ZIP_SINK Struct _N_DC_ENTRY Struct _N_DC_GROUP_ENTRY Struct _N_GUI_COLORWHEEL Struct _N_GUI_COLORWHEEL_BLOCK Struct _N_GUI_COLORWHEEL_MOUSE Struct _N_GUI_CURVE Struct _N_GUI_CURVE_BLOCK Struct _N_GUI_CURVE_MOUSE Struct _N_GUI_GRID Struct _N_GUI_POPUP_ENTRY Struct _N_GUI_POPUP_LEVEL Struct _N_GUI_SB_SKIN Struct _N_GUI_TA_STEP Struct _N_GUI_THUMB Struct _N_GUI_WRAP_ACC Struct _compiled Struct _conn Struct _ip_slot Struct _mp_param Struct _n_civil Struct _seg Struct client Struct collector Struct date_vector Struct md_atom Struct md_cells Struct md_hit Struct md_line_ctx Struct mline Struct n_http_req_header Struct n_http_req_limits Struct n_http_request Struct n_markdown_block Struct n_markdown_doc Struct n_markdown_inline Struct n_markdown_span Struct n_reactor_stats Struct n_url_safe Struct n_url_safe_head Struct n_wrap_item Struct producer_state Struct rects Struct reply Struct runner Struct sink Struct tbuf Struct wrap_hit Struct wrap_span Structures Union COORD_VALUE Union HASH_DATA Union NODE_DATA_TYPES Union STACK_DATA dir_310dcdd4703e877a6b99d5dc3fc54d27 dir_68267d1309a1af8e8297ef4c3efbcdba dir_d28a4824dc47e487b107a5db32ef43c4 dir_d44c64559bbebec7f509842c48db8b23 ex__accept__pool__client_8c ex__accept__pool__server_8c ex__allegro__4_8c ex__atlas_8c ex__avro_8c ex__base64_8c ex__bind__exclusive_8c ex__clipboard_8c ex__clock__sync_8c ex__common_8c ex__configfile_8c ex__cookies_8c ex__crypto_8c ex__diff_8c ex__digest_8c ex__disk__cache_8c ex__dns_8c ex__ecc_8c ex__entropy_8c ex__exceptions_8c ex__file_8c ex__file__copy_8c ex__fluid_8c ex__fluid__config_8c ex__fluid__config_8h ex__git_8c ex__gui_8c ex__gui__bench_8c ex__gui__button__keys_8c ex__gui__checkbox__label_8c ex__gui__checkbox__release_8c ex__gui__color__picker_8c ex__gui__colorwheel_8c ex__gui__combobox__items_8c ex__gui__combobox__wheel_8c ex__gui__cursor_8c ex__gui__curve_8c ex__gui__custom_8c ex__gui__custom__mouse_8c ex__gui__datagrid_8c ex__gui__datagrid__keys_8c ex__gui__datagrid__sort_8c ex__gui__detach_8c ex__gui__dictionary_8c ex__gui__display__fallback_8c ex__gui__double__click_8c ex__gui__dropmenu_8c ex__gui__frameless__drag_8c ex__gui__global__scroll_8c ex__gui__glyph_8c ex__gui__grid_8c ex__gui__hexview_8c ex__gui__hover_8c ex__gui__isometric_8c ex__gui__kvtable_8c ex__gui__label__fits_8c ex__gui__label__lines_8c ex__gui__layout__persist_8c ex__gui__listbox_8c ex__gui__md_8c ex__gui__multiwin_8c ex__gui__network_8c ex__gui__particles_8c ex__gui__placeholder_8c ex__gui__popup_8c ex__gui__progressbar_8c ex__gui__reentrant_8c ex__gui__round_8c ex__gui__sectionlist_8c ex__gui__slider__default_8c ex__gui__slider__handle_8c ex__gui__slider__step_8c ex__gui__splitpane_8c ex__gui__suggest_8c ex__gui__syntaxview_8c ex__gui__text__shorten_8c ex__gui__textarea__selection_8c ex__gui__tooltip_8c ex__gui__tree__lazy_8c ex__gui__tree__order_8c ex__gui__tree__state_8c ex__gui__window__rect_8c ex__gui__zorder_8c ex__hash_8c ex__hex_8c ex__html_8c ex__http2_8c ex__http2__server_8c ex__http3_8c ex__http__cookie_8c ex__http__form_8c ex__http__mime_8c ex__http__req_8c ex__http__response_8c ex__http__router_8c ex__http__server_8c ex__icc_8c ex__iso__astar_8c ex__json_8c ex__kafka_8c ex__linalg_8c ex__list_8c ex__log_8c ex__markdown_8c ex__module_8c ex__monolith_8c ex__network_8c ex__network_8h ex__network__accept_8c ex__network__alpn_8c ex__network__connect__abort_8c ex__network__mock_8c ex__network__proxy_8c ex__network__reactor_8c ex__network__sni_8c ex__network__sse_8c ex__network__ssl_8c ex__network__ssl__hardened_8c ex__network__ssl__hostname_8c ex__network__ssl__nonblock_8c ex__network__tls__defaults_8c ex__network__ws_8c ex__network__ws__limits_8c ex__nstr_8c ex__parallel__for_8c ex__parallel__team_8c ex__pcre_8c ex__pretty_8c ex__pth_8c ex__query_8c ex__random_8c ex__sha256_8c ex__signals_8c ex__spawn_8c ex__ssrf_8c ex__stack_8c ex__thread__pool__discard_8c ex__thread__pool__wait_8c ex__threads_8c ex__tiff_8c ex__time__formats_8c ex__trajectory_8c ex__trees_8c ex__url_8c ex__url__safe_8c ex__wrap_8c ex__x509_8c ex__zip_8c ex__zlib_8c ex_accept_pool_client_8c example ex_accept_pool_server_8c example ex_allegro_4_8c example ex_atlas_8c example ex_base64_8c example ex_clock_sync_8c example ex_common_8c example ex_configfile_8c example ex_cookies_8c example ex_crypto_8c example ex_diff_8c example ex_digest_8c example ex_disk_cache_8c example ex_dns_8c example ex_ecc_8c example ex_entropy_8c example ex_exceptions_8c example ex_file_8c example ex_file_copy_8c example ex_fluid_8c example ex_fluid_config_8c example ex_fluid_config_8h example ex_git_8c example ex_gui_8c example ex_gui_bench_8c example ex_gui_button_keys_8c example ex_gui_checkbox_label_8c example ex_gui_checkbox_release_8c example ex_gui_color_picker_8c example ex_gui_colorwheel_8c example ex_gui_combobox_items_8c example ex_gui_combobox_wheel_8c example ex_gui_cursor_8c example ex_gui_curve_8c example ex_gui_custom_8c example ex_gui_custom_mouse_8c example ex_gui_datagrid_8c example ex_gui_datagrid_keys_8c example ex_gui_datagrid_sort_8c example ex_gui_detach_8c example ex_gui_dictionary_8c example ex_gui_display_fallback_8c example ex_gui_double_click_8c example ex_gui_dropmenu_8c example ex_gui_frameless_drag_8c example ex_gui_global_scroll_8c example ex_gui_glyph_8c example ex_gui_grid_8c example ex_gui_hexview_8c example ex_gui_hover_8c example ex_gui_isometric_8c example ex_gui_kvtable_8c example ex_gui_label_fits_8c example ex_gui_label_lines_8c example ex_gui_layout_persist_8c example ex_gui_listbox_8c example ex_gui_md_8c example ex_gui_multiwin_8c example ex_gui_network_8c example ex_gui_particles_8c example ex_gui_placeholder_8c example ex_gui_popup_8c example ex_gui_progressbar_8c example ex_gui_reentrant_8c example ex_gui_round_8c example ex_gui_sectionlist_8c example ex_gui_slider_default_8c example ex_gui_slider_handle_8c example ex_gui_slider_step_8c example ex_gui_splitpane_8c example ex_gui_suggest_8c example ex_gui_syntaxview_8c example ex_gui_text_shorten_8c example ex_gui_textarea_selection_8c example ex_gui_tooltip_8c example ex_gui_tree_lazy_8c example ex_gui_tree_order_8c example ex_gui_tree_state_8c example ex_gui_window_rect_8c example ex_gui_zorder_8c example ex_hash_8c example ex_hex_8c example ex_html_8c example ex_http2_8c example ex_http2_server_8c example ex_http_cookie_8c example ex_http_form_8c example ex_http_mime_8c example ex_http_req_8c example ex_http_response_8c example ex_http_router_8c example ex_http_server_8c example ex_icc_8c example ex_iso_astar_8c example ex_json_8c example ex_kafka_8c example ex_linalg_8c example ex_list_8c example ex_log_8c example ex_markdown_8c example ex_module_8c example ex_monolith_8c example ex_network_8c example ex_network_8h example ex_network_accept_8c example ex_network_alpn_8c example ex_network_connect_abort_8c example ex_network_mock_8c example ex_network_proxy_8c example ex_network_reactor_8c example ex_network_sni_8c example ex_network_sse_8c example ex_network_ssl_8c example ex_network_ssl_hardened_8c example ex_network_ssl_hostname_8c example ex_network_ssl_nonblock_8c example ex_network_tls_defaults_8c example ex_network_ws_8c example ex_network_ws_limits_8c example ex_nstr_8c example ex_parallel_for_8c example ex_parallel_team_8c example ex_pcre_8c example ex_pretty_8c example ex_pth_8c example ex_query_8c example ex_random_8c example ex_sha256_8c example ex_signals_8c example ex_spawn_8c example ex_ssrf_8c example ex_stack_8c example ex_threads_8c example ex_tiff_8c example ex_time_formats_8c example ex_trajectory_8c example ex_trees_8c example ex_url_8c example ex_url_safe_8c example ex_wrap_8c example ex_x509_8c example ex_zip_8c example ex_zlib_8c example mainpage_8dox n__3d_8c n__3d_8h n__aabb_8c n__aabb_8h n__allegro5_8c n__allegro5_8h n__allegro__4_8c n__allegro__4_8h n__anim_8c n__anim_8h n__astar_8c n__astar_8h n__atlas_8c n__atlas_8h n__avro_8c n__avro_8h n__base64_8c n__base64_8h n__clipboard_8c n__clipboard_8h n__clock__sync_8c n__clock__sync_8h n__common_8c n__common_8h n__config__file_8c n__config__file_8h n__cookies_8c n__cookies_8h n__crypto_8c n__crypto_8h n__dead__reckoning_8c n__dead__reckoning_8h n__diff_8c n__diff_8h n__digest_8c n__digest_8h n__disk__cache_8c n__disk__cache_8h n__dns_8c n__dns_8h n__ecc_8c n__ecc_8h n__entropy_8c n__entropy_8h n__enum_8h n__exceptions_8c n__exceptions_8h n__files_8c n__files_8h n__fluids_8c n__fluids_8h n__games_8c n__games_8h n__git_8c n__git_8h n__gui_8c n__gui_8h n__gui__color_8c n__gui__color_8h n__gui__colorwheel_8c n__gui__colorwheel_8h n__gui__curve_8c n__gui__curve_8h n__gui__grid_8c n__gui__grid_8h n__gui__md_8c n__gui__md_8h n__gui__popup_8c n__gui__popup_8h n__hash_8c n__hash_8h n__hex_8c n__hex_8h n__html_8c n__html_8h n__http2_8c n__http2_8h n__http2__server_8c n__http2__server_8h n__http3_8c n__http3_8h n__http__cookie_8c n__http__cookie_8h n__http__form_8c n__http__form_8h n__http__mime_8c n__http__mime_8h n__http__req_8c n__http__req_8h n__http__response_8c n__http__response_8h n__http__router_8c n__http__router_8h n__http__server_8c n__http__server_8h n__icc_8c n__icc_8h n__iso__engine_8c n__iso__engine_8h n__json_8c n__json_8h n__kafka_8c n__kafka_8h n__linalg_8c n__linalg_8h n__list_8c n__list_8h n__log_8c n__log_8h n__lz4_8c n__lz4_8h n__markdown_8c n__markdown_8h n__module_8c n__module_8h n__network_8c n__network_8h n__network__accept__pool_8c n__network__accept__pool_8h n__network__msg_8c n__network__msg_8h n__nodup__log_8c n__nodup__log_8h n__openssl__compat_8h n__particles_8c n__particles_8h n__pcre_8c n__pcre_8h n__pretty_8c n__pretty_8h n__pth_8c n__pth_8h n__query_8c n__query_8h n__random_8c n__random_8h n__reactor_8c n__reactor_8h n__sha256_8c n__sha256_8h n__signals_8c n__signals_8h n__ssrf_8c n__ssrf_8h n__stack_8c n__stack_8h n__str_8c n__str_8h n__thread__pool_8c n__thread__pool_8h n__tiff_8c n__tiff_8h n__time_8c n__time_8h n__trajectory_8c n__trajectory_8h n__trees_8c n__trees_8h n__url__safe_8c n__url__safe_8h n__user_8c n__user_8h n__windows_8h n__wrap_8c n__wrap_8h n__x509_8c n__x509_8h n__zip_8c n__zip_8h n__zlib_8c n__zlib_8h nilorea_8h
7 n__ssrf_8c
gullradriel edited this page 2026-10-29 20:54:40 +01:00
Table of Contents

src/n_ssrf.c

SSRF address guard (see n_ssrf.h). More...

Functions

Name
int zero_run(const uint8_t * ip, int lo, int hi)
int v6_blocked(const uint8_t ip[16])
int v4_blocked(const uint8_t ip[4])
int n_ssrf_ipv6_allowed(const uint8_t ip[16])
classify an IPv6 address as safe-to-connect or not
int n_ssrf_ipv4_allowed(const uint8_t ip[4])
classify an IPv4 address as safe-to-connect or not

Detailed Description

SSRF address guard (see n_ssrf.h).

Author: Castagnier Mickael

Version: 1.0

Pure byte classification.

Functions Documentation

function zero_run

static int zero_run(
    const uint8_t * ip,
    int lo,
    int hi
)

function v6_blocked

static int v6_blocked(
    const uint8_t ip[16]
)

function v4_blocked

static int v4_blocked(
    const uint8_t ip[4]
)

function n_ssrf_ipv6_allowed

int n_ssrf_ipv6_allowed(
    const uint8_t ip[16]
)

classify an IPv6 address as safe-to-connect or not

Parameters:

  • ip 16 bytes, network order

Return: 1 if ip is a public routable address; 0 otherwise. Rejects unspecified (::), loopback (::1), ULA (fc00::/7), link-local (fe80::/10), multicast (ff00::/8), documentation (2001:db8::/32) and discard (100::/64). IPv4-mapped (::ffff:0:0/96), NAT64 (64:ff9b::/96) and 6to4 (2002::/16) are unwrapped and their embedded IPv4 re-checked, so a private v4 cannot be smuggled in. NULL is rejected (0).

function n_ssrf_ipv4_allowed

int n_ssrf_ipv4_allowed(
    const uint8_t ip[4]
)

classify an IPv4 address as safe-to-connect or not

Parameters:

  • ip 4 bytes, network order

Return: 1 if ip is a public routable unicast address; 0 if it is unspecified / private / loopback / CGNAT / link-local / documentation / benchmark / multicast / reserved (RFC 1918, 6598, 5735, 5737, 3927, 2544, ...). NULL is rejected (0).

Source code

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */

#include "nilorea/n_ssrf.h"

/* 1 if the IPv4 address is NOT safe to connect to (private/reserved/etc.). */
static int v4_blocked(const uint8_t ip[4]) {
    uint8_t a = ip[0], b = ip[1], c = ip[2];
    if (a == 0)
        return 1; /* 0.0.0.0/8  "this host"                */
    if (a == 10)
        return 1; /* 10.0.0.0/8  private (RFC1918)         */
    if (a == 127)
        return 1; /* 127.0.0.0/8  loopback                 */
    if (a == 100 && (b & 0xC0) == 0x40)
        return 1; /* 100.64.0.0/10  CGNAT (RFC6598)        */
    if (a == 169 && b == 254)
        return 1; /* 169.254.0.0/16  link-local            */
    if (a == 172 && (b & 0xF0) == 0x10)
        return 1; /* 172.16.0.0/12  private                */
    if (a == 192 && b == 168)
        return 1; /* 192.168.0.0/16  private               */
    if (a == 192 && b == 0 && c == 0)
        return 1; /* 192.0.0.0/24  IETF protocol           */
    if (a == 192 && b == 0 && c == 2)
        return 1; /* 192.0.2.0/24  TEST-NET-1              */
    if (a == 198 && (b & 0xFE) == 18)
        return 1; /* 198.18.0.0/15  benchmarking           */
    if (a == 198 && b == 51 && c == 100)
        return 1; /* 198.51.100.0/24  TEST-NET-2          */
    if (a == 203 && b == 0 && c == 113)
        return 1; /* 203.0.113.0/24  TEST-NET-3          */
    if (a >= 224)
        return 1; /* 224/4 multicast + 240/4 reserved + 255.. */
    return 0;
}

int n_ssrf_ipv4_allowed(const uint8_t ip[4]) {
    return ip && !v4_blocked(ip);
}

/* Are bytes [lo, hi) of \p ip all zero? */
static int zero_run(const uint8_t* ip, int lo, int hi) {
    int i;
    for (i = lo; i < hi; i++)
        if (ip[i])
            return 0;
    return 1;
}

static int v6_blocked(const uint8_t ip[16]) {
    if (zero_run(ip, 0, 16)) /* ::  unspecified                          */
        return 1;
    if (zero_run(ip, 0, 15) && ip[15] == 1) /* ::1  loopback             */
        return 1;
    /* ::ffff:0:0/96  IPv4-mapped -> classify the embedded IPv4 */
    if (zero_run(ip, 0, 10) && ip[10] == 0xff && ip[11] == 0xff)
        return v4_blocked(ip + 12);
    /* 64:ff9b::/96  NAT64 -> classify the embedded IPv4 */
    if (ip[0] == 0x00 && ip[1] == 0x64 && ip[2] == 0xff && ip[3] == 0x9b &&
        zero_run(ip, 4, 12))
        return v4_blocked(ip + 12);
    /* 2002::/16  6to4 -> classify the embedded IPv4 (bytes 2..5) */
    if (ip[0] == 0x20 && ip[1] == 0x02)
        return v4_blocked(ip + 2);
    if ((ip[0] & 0xFE) == 0xFC) /* fc00::/7  unique-local (ULA)          */
        return 1;
    if (ip[0] == 0xFE && (ip[1] & 0xC0) == 0x80) /* fe80::/10 link-local */
        return 1;
    if (ip[0] == 0xFF) /* ff00::/8  multicast                            */
        return 1;
    if (ip[0] == 0x20 && ip[1] == 0x01 && ip[2] == 0x0D && ip[3] == 0xB8)
        return 1; /* 2001:db8::/32  documentation                       */
    if (ip[0] == 0x01 && ip[1] == 0x00 && zero_run(ip, 2, 8))
        return 1; /* 100::/64  discard-only                             */
    return 0;
}

int n_ssrf_ipv6_allowed(const uint8_t ip[16]) {
    return ip && !v6_blocked(ip);
}

Home

Modules