This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
include/nilorea/n_ssrf.h
SSRF address guard: is a resolved IP a public, routable unicast address? More...
Functions
| Name | |
|---|---|
| int | n_ssrf_ipv6_allowed(const uint8_t ip[16]) classify an IPv6 address as safe-to-connect or not |
| int | n_ssrf_ipv4_allowed(const uint8_t ip[4]) classify an IPv4 address as safe-to-connect or not |
Detailed Description
SSRF address guard: is a resolved IP a public, routable unicast address?
Author: Castagnier Mickael
Version: 1.0
When a program fetches an attacker-supplied URL (link previews, webhooks, avatar imports, ...) the hostname may resolve – or redirect, or DNS-rebind – to a private, loopback or link-local address to reach the local network or a cloud metadata endpoint. The safe pattern is: resolve first, classify EACH resolved address with these predicates, and connect only to an address they accept – never re-resolving the hostname afterwards.
Pure byte classification, no sockets – portable and fully testable. The caller extracts the 4 / 16 address bytes from whatever sockaddr it holds.
Functions Documentation
function n_ssrf_ipv6_allowed
int n_ssrf_ipv6_allowed(
const uint8_t ip[16]
)
classify an IPv6 address as safe-to-connect or not
Parameters:
- ip 16 bytes, network order
Return: 1 if ip is a public routable address; 0 otherwise. Rejects unspecified (::), loopback (::1), ULA (fc00::/7), link-local (fe80::/10), multicast (ff00::/8), documentation (2001:db8::/32) and discard (100::/64). IPv4-mapped (::ffff:0:0/96), NAT64 (64:ff9b::/96) and 6to4 (2002::/16) are unwrapped and their embedded IPv4 re-checked, so a private v4 cannot be smuggled in. NULL is rejected (0).
function n_ssrf_ipv4_allowed
int n_ssrf_ipv4_allowed(
const uint8_t ip[4]
)
classify an IPv4 address as safe-to-connect or not
Parameters:
- ip 4 bytes, network order
Return: 1 if ip is a public routable unicast address; 0 if it is unspecified / private / loopback / CGNAT / link-local / documentation / benchmark / multicast / reserved (RFC 1918, 6598, 5735, 5737, 3927, 2544, ...). NULL is rejected (0).
Source code
/*
* Nilorea Library
* Copyright (C) 2005-2026 Castagnier Mickael
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
* implied. See the License for the specific language governing
* permissions and limitations under the License.
*
* SPDX-License-Identifier: Apache-2.0
*/
#ifndef N_SSRF_H
#define N_SSRF_H
#include <stdint.h>
int n_ssrf_ipv4_allowed(const uint8_t ip[4]);
int n_ssrf_ipv6_allowed(const uint8_t ip[16]);
#endif /* N_SSRF_H */
Modules
- AABB3D
- ACCEPT_POOL
- ALLEGRO4
- ALLEGRO5
- ANIM_LIB
- ASTAR
- ATLAS_LIB
- AVRO
- CLOCK_SYNC
- COMMONS
- CONFIGFILE
- CYPHER_BASE64
- CYPHER_VIGENERE
- DEAD_RECKONING
- ENUMS
- EXCEPTIONS
- GAME_ENV
- GIT
- GUI
- HASH_TABLE
- ISOMETRIC_ENGINE
- LIST
- LOG
- LOGNODUP
- LZ4
- NETWORKING
- NETWORK_MSG
- N_COOKIES
- N_DIFF
- N_DIGEST
- N_DISK_CACHE
- N_DNS
- N_ECC
- N_ENTROPY
- N_FILES
- N_FLUIDS
- N_GUI_COLOR
- N_GUI_COLORWHEEL
- N_GUI_CURVE
- N_GUI_GRID
- N_GUI_POPUP
- N_HEX
- N_HTTP3
- N_HTTP_COOKIE
- N_HTTP_FORM
- N_HTTP_MIME
- N_HTTP_REQ
- N_HTTP_RESP
- N_HTTP_ROUTER
- N_HTTP_SERVER
- N_ICC
- N_JSON
- N_KAFKA
- N_LINALG
- N_MODULE
- N_OPENSSL_COMPAT
- N_PRETTY
- N_PTH
- N_QUERY
- N_RANDOM
- N_SHA256
- N_STR
- N_TIFF
- N_TIME
- N_USER
- N_X509
- N_ZIP
- PARTICLES
- PCRE
- PHYSICS
- SIGNALS
- STACK
- THREADS
- TRAJECTORY
- TREE
- ZLIB