Package io.jans.as.server.service.net

Class PrivateAddressUtil

java.lang.Object

io.jans.as.server.service.net.PrivateAddressUtil

public class PrivateAddressUtil
extends Object

Shared SSRF-protection check for client-supplied URLs (sector_identifier_uri, client_id URL). In addition to the standard InetAddress private/loopback/link-local/multicast checks and the IPv6 Unique Local Address range (fc00::/7, not covered by InetAddress.isSiteLocalAddress()), this also unwraps IPv6 transition mechanisms that embed an IPv4 address (NAT64, 6to4, Teredo, IPv4-mapped and IPv4-compatible addresses) and re-checks the embedded address, since those can be used to reach private IPv4 destinations under an address that otherwise looks globally routable.

Author:

Yuriy Z

Method Summary

Modifier and Type	Method	Description
static boolean	isPrivateAddress(InetAddress address)
static String	reasonForPrivateAddress(InetAddress address)	Same check as isPrivateAddress(InetAddress), but returns a human-readable reason identifying exactly which rule matched (and, for IPv6 transition mechanisms, which embedded IPv4 address and rule it resolved to), for use in rejection log messages.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

isPrivateAddress

public static boolean isPrivateAddress(InetAddress address)

reasonForPrivateAddress

public static String reasonForPrivateAddress(InetAddress address)

Same check as isPrivateAddress(InetAddress), but returns a human-readable reason identifying exactly which rule matched (and, for IPv6 transition mechanisms, which embedded IPv4 address and rule it resolved to), for use in rejection log messages. Returns null if the address is public.