6 n__ssrf_8h
gullradriel edited this page 2026-10-09 00:55:18 +02:00
This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

include/nilorea/n_ssrf.h

SSRF address guard: is a resolved IP a public, routable unicast address? More...

Functions

Name
int n_ssrf_ipv6_allowed(const uint8_t ip[16])
classify an IPv6 address as safe-to-connect or not
int n_ssrf_ipv4_allowed(const uint8_t ip[4])
classify an IPv4 address as safe-to-connect or not

Detailed Description

SSRF address guard: is a resolved IP a public, routable unicast address?

Author: Castagnier Mickael

Version: 1.0

When a program fetches an attacker-supplied URL (link previews, webhooks, avatar imports, ...) the hostname may resolve – or redirect, or DNS-rebind – to a private, loopback or link-local address to reach the local network or a cloud metadata endpoint. The safe pattern is: resolve first, classify EACH resolved address with these predicates, and connect only to an address they accept – never re-resolving the hostname afterwards.

Pure byte classification, no sockets – portable and fully testable. The caller extracts the 4 / 16 address bytes from whatever sockaddr it holds.

Functions Documentation

function n_ssrf_ipv6_allowed

int n_ssrf_ipv6_allowed(
    const uint8_t ip[16]
)

classify an IPv6 address as safe-to-connect or not

Parameters:

  • ip 16 bytes, network order

Return: 1 if ip is a public routable address; 0 otherwise. Rejects unspecified (::), loopback (::1), ULA (fc00::/7), link-local (fe80::/10), multicast (ff00::/8), documentation (2001:db8::/32) and discard (100::/64). IPv4-mapped (::ffff:0:0/96), NAT64 (64:ff9b::/96) and 6to4 (2002::/16) are unwrapped and their embedded IPv4 re-checked, so a private v4 cannot be smuggled in. NULL is rejected (0).

function n_ssrf_ipv4_allowed

int n_ssrf_ipv4_allowed(
    const uint8_t ip[4]
)

classify an IPv4 address as safe-to-connect or not

Parameters:

  • ip 4 bytes, network order

Return: 1 if ip is a public routable unicast address; 0 if it is unspecified / private / loopback / CGNAT / link-local / documentation / benchmark / multicast / reserved (RFC 1918, 6598, 5735, 5737, 3927, 2544, ...). NULL is rejected (0).

Source code

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */


#ifndef N_SSRF_H
#define N_SSRF_H

#include <stdint.h>

int n_ssrf_ipv4_allowed(const uint8_t ip[4]);

int n_ssrf_ipv6_allowed(const uint8_t ip[16]);

#endif /* N_SSRF_H */