Server-Side Request Forgery (SSRF) in C/C++ (libcurl)

/* fetch.c: libcurl may only open sockets to public addresses */
#include <curl/curl.h>
#include <netinet/in.h>
#include <stdbool.h>
#include <string.h>
#include <sys/socket.h>

struct body {
    char data[5000];
    size_t len;
};

/* reject loopback, private, link-local, CGNAT, multicast and non-global IPv6 */
static bool is_public(const struct sockaddr *sa)
{
    if (sa->sa_family == AF_INET) {
        const unsigned char *b = (const unsigned char *)&((const struct sockaddr_in *)sa)->sin_addr;
        return !(b[0] == 0 || b[0] == 10 || b[0] == 127 || b[0] >= 224
                 || (b[0] == 100 && (b[1] & 0xc0) == 64)
                 || (b[0] == 169 && b[1] == 254)
                 || (b[0] == 172 && (b[1] & 0xf0) == 16)
                 || (b[0] == 192 && b[1] == 168));
    }
    if (sa->sa_family == AF_INET6) {
        static const unsigned char mapped[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff};
        const unsigned char *b = ((const struct sockaddr_in6 *)sa)->sin6_addr.s6_addr;
        if (memcmp(b, mapped, sizeof mapped) == 0) {
            struct sockaddr_in v4 = {.sin_family = AF_INET};
            memcpy(&v4.sin_addr, b + 12, 4);
            return is_public((const struct sockaddr *)&v4);
        }
        return (b[0] & 0xe0) == 0x20;
    }
    return false;
}

/* called with the real address before every connection */
static curl_socket_t open_public(void *clientp, curlsocktype purpose, struct curl_sockaddr *address)
{
    (void)clientp;
    if (purpose != CURLSOCKTYPE_IPCXN || !is_public(&address->addr))
        return CURL_SOCKET_BAD;
    return socket(address->family, address->socktype, address->protocol);
}

static size_t keep_prefix(char *ptr, size_t size, size_t nmemb, void *userdata)
{
    struct body *b = userdata;
    size_t n = size * nmemb;
    size_t room = sizeof b->data - b->len;
    size_t take = n < room ? n : room;
    memcpy(b->data + b->len, ptr, take);
    b->len += take;
    return take == n ? n : 0;
}

/* http and https only, no redirects, no proxy, timeouts, capped body */
long fetch_public(const char *url, const char *json_body, struct body *out)
{
    CURL *curl = curl_easy_init();
    struct curl_slist *headers = NULL;
    long status = -1;
    if (curl == NULL)
        return -1;
    out->len = 0;
    curl_easy_setopt(curl, CURLOPT_URL, url);
    curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR, "http,https");
    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
    curl_easy_setopt(curl, CURLOPT_NOPROXY, "*");
    curl_easy_setopt(curl, CURLOPT_OPENSOCKETFUNCTION, open_public);
    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 3L);
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, keep_prefix);
    curl_easy_setopt(curl, CURLOPT_WRITEDATA, out);
    if (json_body != NULL) {
        headers = curl_slist_append(headers, "Content-Type: application/json");
        curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
        curl_easy_setopt(curl, CURLOPT_POSTFIELDS, json_body);
    }
    CURLcode rc = curl_easy_perform(curl);
    if (rc == CURLE_OK || (rc == CURLE_WRITE_ERROR && out->len == sizeof out->data))
        curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &status);
    curl_slist_free_all(headers);
    curl_easy_cleanup(curl);
    return status;
}

/* both entry points use fetch_public */
long fetch_preview(const char *url, struct body *out)
{
    return fetch_public(url, NULL, out);
}

long test_webhook(const char *url)
{
    struct body ignored;
    return fetch_public(url, "{\"ping\":true}", &ignored);
}