snapshot of https://github.com/ory/keto.git (master, 2026-09-16; blobs > 131072B omitted)

oryx/ipx/cidr.go

@@ -0,0 +1,23 @@
+// Copyright © 2025 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package ipx
+
+import (
+	"iter"
+	"net/netip"
+)
+
+func Hosts(prefix netip.Prefix) iter.Seq[netip.Addr] {
+	prefix = prefix.Masked()
+	return func(yield func(netip.Addr) bool) {
+		if !prefix.IsValid() {
+			return
+		}
+		for addr := prefix.Addr().Next(); prefix.Contains(addr); addr = addr.Next() {
+			if !yield(addr) {
+				return
+			}
+		}
+	}
+}

oryx/ipx/ip_validator.go

@@ -0,0 +1,128 @@
+// Copyright © 2023 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package ipx
+
+import (
+	"context"
+	stderrors "errors"
+	"net"
+	"net/netip"
+	"net/url"
+	"time"
+
+	"code.dny.dev/ssrf"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/pkg/errors"
+)
+
+// IsAssociatedIPAllowedWhenSet is a wrapper for IsAssociatedIPAllowed which returns valid
+// when ipOrHostnameOrURL is empty.
+func IsAssociatedIPAllowedWhenSet(ctx context.Context, ipOrHostnameOrURL string) error {
+	if ipOrHostnameOrURL == "" {
+		return nil
+	}
+	return IsAssociatedIPAllowed(ctx, ipOrHostnameOrURL)
+}
+
+// AreAllAssociatedIPsAllowed fails if one of the pairs is failing.
+func AreAllAssociatedIPsAllowed(ctx context.Context, pairs map[string]string) error {
+	g, ctx := errgroup.WithContext(ctx)
+	for key, ipOrHostnameOrURL := range pairs {
+		g.Go(func() error {
+			return errors.Wrapf(IsAssociatedIPAllowed(ctx, ipOrHostnameOrURL), "key %s validation is failing", key)
+		})
+	}
+	return g.Wait()
+}
+
+// IsAssociatedIPAllowed returns nil for a domain (with NS lookup), IP, or IPv6 address if it
+// does not resolve to a private IP subnet. This is a first level of defense against
+// SSRF attacks by disallowing any domain or IP to resolve to a private network range.
+//
+// Please keep in mind that validations for domains is valid only when looking up.
+// A malicious actor could easily update the DSN record post validation to point
+// to an internal IP
+func IsAssociatedIPAllowed(ctx context.Context, ipOrHostnameOrURL string) error {
+	ipOrHostname := ipOrHostnameOrURL
+	if parsed, err := url.ParseRequestURI(ipOrHostnameOrURL); err == nil {
+		ipOrHostname = parsed.Hostname()
+	}
+
+	if ip, err := netip.ParseAddr(ipOrHostname); err == nil {
+		if !allowed(ip) {
+			return errors.Errorf("ip %s is not a permitted destination", ip)
+		}
+		return nil
+	}
+
+	if addr, err := netip.ParseAddrPort(ipOrHostnameOrURL); err == nil {
+		if !allowed(addr.Addr()) {
+			return errors.Errorf("ip %s is not a permitted destination", addr.Addr())
+		}
+		return nil
+	}
+
+	ctx, cancel := context.WithTimeoutCause(ctx, 2*time.Second, errors.New("DNS lookup timed out"))
+	defer cancel()
+	ips, err := resolver.LookupNetIP(ctx, "ip", ipOrHostname)
+	if err != nil {
+		if dnsErr, ok := stderrors.AsType[*net.DNSError](err); ok {
+			// Copy the `*net.DNSError` before masking `Server` to avoid a data
+			// race: the DNS resolver uses `singleflight` to deduplicate
+			// concurrent lookups, so multiple goroutines may receive the same
+			// `*net.DNSError` pointer. Mutating it in place races with concurrent
+			// readers (e.g. the `otelhttp` `dnsDone` trace hook).
+			maskedDNS := *dnsErr
+			maskedDNS.Server = "" // Mask our DNS server's IP address.
+			return errors.Wrapf(&maskedDNS, "failed to resolve %s", ipOrHostnameOrURL)
+		}
+	}
+
+	for _, ip := range ips {
+		if !allowed(ip) {
+			return errors.Wrapf(&net.DNSError{
+				Err:         "no such host",
+				Name:        ipOrHostname,
+				Server:      "",
+				IsTimeout:   false,
+				IsTemporary: false,
+				IsNotFound:  true,
+			}, "failed to resolve %s", ipOrHostnameOrURL)
+		}
+	}
+
+	return nil
+}
+
+var resolver = &net.Resolver{PreferGo: true}
+
+func allowed(ip netip.Addr) bool {
+	if !ip.IsGlobalUnicast() {
+		return false
+	}
+
+	if ip.Is4() {
+		for _, net := range ssrf.IPv4DeniedPrefixes {
+			if net.Contains(ip) {
+				return false
+			}
+		}
+	} else { // IPv6
+		// ip.IsGlobalUnicast returns true for IPv6 addresses which fall outside
+		// of the current IANA-allocated 2000::/3 global unicast space. Hence,
+		// we need to check for ourselves if the IPv6 address is within the
+		// currently allocated block.
+		if !ssrf.IPv6GlobalUnicast.Contains(ip) {
+			return false
+		}
+		for _, net := range ssrf.IPv6DeniedPrefixes {
+			if net.Contains(ip) {
+				return false
+			}
+		}
+	}
+
+	return true
+}

oryx/ipx/ssrf.go

@@ -0,0 +1,100 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package ipx
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"time"
+
+	"code.dny.dev/ssrf"
+)
+
+var (
+	ProhibitInternalDialFunc = ssrfDialFunc(
+		ssrf.WithAnyPort(),
+		ssrf.WithNetworks("tcp4", "tcp6"),
+	)
+
+	AllowInternalDialFunc = ssrfDialFunc(
+		ssrf.WithAnyPort(),
+		ssrf.WithNetworks("tcp4", "tcp6"),
+		ssrf.WithAllowedV4Prefixes(
+			netip.MustParsePrefix("10.0.0.0/8"),     // Private-Use (RFC 1918)
+			netip.MustParsePrefix("127.0.0.0/8"),    // Loopback (RFC 1122, Section 3.2.1.3))
+			netip.MustParsePrefix("169.254.0.0/16"), // Link Local (RFC 3927)
+			netip.MustParsePrefix("172.16.0.0/12"),  // Private-Use (RFC 1918)
+			netip.MustParsePrefix("192.168.0.0/16"), // Private-Use (RFC 1918)
+		),
+		ssrf.WithAllowedV6Prefixes(
+			netip.MustParsePrefix("::1/128"),  // Loopback (RFC 4193)
+			netip.MustParsePrefix("fc00::/7"), // Unique Local (RFC 4193)
+		),
+	)
+)
+
+func ssrfDialFunc(opt ...ssrf.Option) func(ctx context.Context, network, address string) (net.Conn, error) {
+	dialer := net.Dialer{
+		Timeout:   30 * time.Second,
+		KeepAlive: 30 * time.Second,
+	}
+	dialer.Control = ssrf.New(opt...).Safe
+	return func(ctx context.Context, network, address string) (net.Conn, error) {
+		c, err := dialer.DialContext(ctx, network, address)
+		if err == nil {
+			return c, nil
+		}
+
+		if dnsErr, ok := errors.AsType[*net.DNSError](err); ok {
+			// Copy the `*net.DNSError` before masking `Server` to avoid a data
+			// race: the DNS resolver uses `singleflight` to deduplicate
+			// concurrent lookups, so multiple goroutines may receive the same
+			// `*net.DNSError` pointer. Mutating it in place races with concurrent
+			// readers (e.g. the `otelhttp` `dnsDone` trace hook).
+			maskedDNS := *dnsErr
+			maskedDNS.Server = "" // Mask our DNS server's IP address.
+			// Also copy the outer `*net.OpError` (if present) to preserve the
+			// full error chain that callers depend on, replacing its `Err` field
+			// with the masked copy.
+			// Surprisingly Go does not have a good way of manipulating error chains.
+			if opErr, ok := errors.AsType[*net.OpError](err); ok {
+				maskedOp := *opErr
+				maskedOp.Err = &maskedDNS
+				return nil, &maskedOp
+			}
+			return nil, &maskedDNS
+		}
+
+		if !errors.Is(err, ssrf.ErrProhibitedIP) {
+			return nil, err
+		}
+
+		host, _, _ := net.SplitHostPort(address)
+		_, addrErr := netip.ParseAddrPort(address)
+		if addrErr != nil {
+			// We were given a DNS name: the error we return must look like a DNS error.
+			return nil, &net.OpError{
+				Op:   "dial",
+				Net:  network,
+				Addr: nil,
+				Err: &net.DNSError{
+					Err:         "no such host",
+					Name:        host,
+					Server:      "",
+					IsTimeout:   false,
+					IsTemporary: false,
+					IsNotFound:  true,
+				},
+			}
+		}
+		return nil, &net.OpError{
+			Op:   "dial",
+			Net:  network,
+			Addr: nil,
+			Err:  errors.New("no route to host"),
+		}
+	}
+}