Golang SSRF Protection & Prevention Using a Whitelist

ssrf.go

package main

import (
    "context"
    "errors"
    "log"
    "net"
    "net/http"
    "strings"
    "time"
)

var (
    ranges []string = []string{
         // CIDR of xyz, 
         // only allow IP addresses in this range
        "84.65.0.0/24",
    }
    whitelist []net.IPNet = createWhitelist()
)

func main() {
    tr := &http.Transport{
        DialContext: func(ctx context.Context, network string, addr string) (conn net.Conn, err error) {
            s := strings.LastIndex(addr, ":")
            IPs, err := net.LookupHost(addr[:s])
            if err != nil {
                return nil, err
            }
            for _, IP := range IPs {
                if !isAllowed(IP) {
                    err = errors.New("IP not allowed")
                    return
                }

                conn, err = net.Dial(network, IP+addr[s:])
                if err == nil {
                    break
                }
            }
            return
        },
    }

    var client = &http.Client{
        Transport: tr,
        Timeout:   time.Duration(5 * time.Second),
    }

    req, err := http.NewRequest("GET", "http://84.65.0.6", nil)
    if err != nil {
        log.Println(err)
        return
    }

    _, err = client.Do(req)
    if err != nil {
        log.Println(err)
        return
    }
}

func createWhitelist() []net.IPNet {
    b := []net.IPNet{}
    for _, sCIDR := range ranges {
        _, c, _ := net.ParseCIDR(sCIDR)
        b = append(b, *c)
    }
    return b
}

func isAllowed(sIP string) bool {
    for _, r := range whitelist {
        if r.Contains(net.ParseIP(sIP)) {
            return true
        }
    }
    return false
}