n_ssrf.c File Reference

SSRF address guard (see n_ssrf.h). More...

#include "nilorea/n_ssrf.h"

Include dependency graph for n_ssrf.c:

Go to the source code of this file.

Functions
int	n_ssrf_ipv4_allowed (const uint8_t ip[4])
	classify an IPv4 address as safe-to-connect or not
int	n_ssrf_ipv6_allowed (const uint8_t ip[16])
	classify an IPv6 address as safe-to-connect or not
static int	v4_blocked (const uint8_t ip[4])
static int	v6_blocked (const uint8_t ip[16])
static int	zero_run (const uint8_t *ip, int lo, int hi)

Detailed Description

SSRF address guard (see n_ssrf.h).

Pure byte classification.

Author

Castagnier Mickael

Version

1.0

Definition in file n_ssrf.c.

Function Documentation

n_ssrf_ipv4_allowed()

int n_ssrf_ipv4_allowed

(

const uint8_t

ip[4]

)

classify an IPv4 address as safe-to-connect or not

Parameters

ip	4 bytes, network order

Returns

1 if ip is a public routable unicast address; 0 if it is unspecified / private / loopback / CGNAT / link-local / documentation / benchmark / multicast / reserved (RFC 1918, 6598, 5735, 5737, 3927, 2544, ...). NULL is rejected (0).

Examples

ex_ssrf.c.

Definition at line 60 of file n_ssrf.c.

References v4_blocked().

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

n_ssrf_ipv6_allowed()

int n_ssrf_ipv6_allowed

(

const uint8_t

ip[16]

)

classify an IPv6 address as safe-to-connect or not

Parameters

ip	16 bytes, network order

Returns

1 if ip is a public routable address; 0 otherwise. Rejects unspecified (::), loopback (::1), ULA (fc00::/7), link-local (fe80::/10), multicast (ff00::/8), documentation (2001:db8::/32) and discard (100::/64). IPv4-mapped (::ffff:0:0/96), NAT64 (64:ff9b::/96) and 6to4 (2002::/16) are unwrapped and their embedded IPv4 re-checked, so a private v4 cannot be smuggled in. NULL is rejected (0).

Examples

ex_ssrf.c.

Definition at line 101 of file n_ssrf.c.

References v6_blocked().

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

v4_blocked()

int v4_blocked ( const uint8_t ip[4] )

static

Definition at line 29 of file n_ssrf.c.

Referenced by n_ssrf_ipv4_allowed(), and v6_blocked().

Here is the caller graph for this function:

v6_blocked()

int v6_blocked ( const uint8_t ip[16] )

static

Definition at line 73 of file n_ssrf.c.

References v4_blocked(), and zero_run().

Referenced by n_ssrf_ipv6_allowed().

Here is the call graph for this function:

Here is the caller graph for this function:

zero_run()

int zero_run ( const uint8_t * ip, int lo, int hi )

static

Definition at line 65 of file n_ssrf.c.

Referenced by v6_blocked().

Here is the caller graph for this function: