Source: arsenal/crates/arsenal-broker/src/ssrf_guard.rs. SHA-256: e8f8c4e2155fa0b45c5066053b61ad07925c471104f651d43455a908a2ad8ce6.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

ssrf_guard::SsrfGuard

SSRF guard for validating proxy request destinations.

#[derive(Debug, Clone, Default)]
pub struct SsrfGuard {

}

Source line: 26.

ssrf_guard::SsrfGuard::new

Create a new SSRF guard with additional blocked domains.

#[must_use]
pub fn new(blocked_domains: Vec<String>) -> Self;

Source line: 36.

ssrf_guard::SsrfGuard::permissive

Create an SSRF guard that allows ALL destinations.

This completely disables SSRF protection including private IP blocking and HTTPS enforcement. Use ONLY in test environments with mock servers.

#[must_use]
pub fn permissive() -> Self;

Source line: 51.

ssrf_guard::SsrfGuard::validate_ip

Check if an IP address is safe for proxy requests.

Returns Ok(()) if the IP is safe, or an error if it is blocked.

Errors

Returns ArsenalError with SsrfBlocked code if the address is unsafe.

pub fn validate_ip(&self, ip: &IpAddr) -> ArsenalResult<()>;

Source line: 65.

ssrf_guard::SsrfGuard::validate_host

Check if a hostname is safe for proxy requests.

Validates that the hostname is not in the blocklist and does not resolve to a private IP range.

Errors

Returns ArsenalError with SsrfBlocked code if the hostname is blocked.

pub fn validate_host(&self, host: &str) -> ArsenalResult<()>;

Source line: 80.

ssrf_guard::SsrfGuard::validate_url

Full validation: validate a URL's host against SSRF protections.

Errors

Returns ArsenalError with SsrfBlocked if the URL targets a blocked destination.

pub fn validate_url(&self, url: &str) -> ArsenalResult<()>;

Source line: 123.

ssrf_guard::SsrfGuard::validate_url_resolved

Full validation with DNS resolution: validates a URL and resolves its hostname to ensure it does not point to private/internal IP addresses.

Returns the validated resolved socket addresses so that the caller can pin outbound connections to these IPs, preventing DNS rebinding (TOCTOU) attacks where the hostname re-resolves to a different address between validation and the actual HTTP request.

Errors

Returns ArsenalError with SsrfBlocked if:

• The URL is malformed or uses a non-HTTPS scheme
• The hostname is in the blocklist
• DNS resolution fails or returns no results
• Any resolved IP is in a private/reserved range

pub async fn validate_url_resolved(
        &self,
        url: &str,
    ) -> ArsenalResult<Vec<std::net::SocketAddr>>;

Source line: 156.