ipguard

package

v0.3.0 Latest Latest Go to latest Published: Jul 15, 2026 License: Apache-2.0 Imports: 1 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cjohnstoniv/wardyn

Links

Open Source Insights

Documentation ¶

Overview ¶

Package ipguard holds the SSRF-blocklist CIDR table shared by the egress proxy's policy guard (internal/egress/proxy) and the composer transport guard (internal/composer/backends/transport). TABLE ONLY, by design: each consumer keeps its own predicate because their semantics deliberately differ — the proxy unconditionally denies loopback/link-local (carried in-table there) and re-checks NAT64-embedded IPv4, while the transport handles loopback/link-local via net.IP predicates so they stay blocked even under its operator-only allowPrivate escape hatch.

Index ¶

Variables
func MustCIDRs(cidrs ...string) []*net.IPNet

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// PrivateReservedV4 are the private/reserved IPv4 ranges every guard
	// denies regardless of mode: RFC1918, CGNAT (RFC6598), "this network",
	// IETF protocol assignments, benchmarking, and limited broadcast.
	PrivateReservedV4 = MustCIDRs(
		"10.0.0.0/8",
		"172.16.0.0/12",
		"192.168.0.0/16",
		"100.64.0.0/10",
		"0.0.0.0/8",
		"192.0.0.0/24",
		"198.18.0.0/15",
		"255.255.255.255/32",
	)

	// UniqueLocalV6 is the IPv6 unique-local (ULA) range every guard denies.
	UniqueLocalV6 = MustCIDRs(
		"fc00::/7",
	)
)

Functions ¶

func MustCIDRs ¶

func MustCIDRs(cidrs ...string) []*net.IPNet

MustCIDRs parses CIDR literals, panicking on a bad entry — for package-level tables of programmer-authored constants only (init-time failure, never on a request path).

Types ¶

This section is empty.

Source Files ¶

View all Source files

ipguard.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL