Struct SsrfPolicy 

pub struct SsrfPolicy { /* private fields */ }

SSRF policy (aggregate root).

Immutable after construction. To change the effective policy, build a new one and swap it atomically in the enclosing service state.

Implementations

impl SsrfPolicy

pub fn new() -> Self

Construct a maximally restrictive default policy: all non-public classes blocked, no allowlist, no denylist, no metrics sink. Prefer SsrfPolicy::from_env for production; use SsrfPolicy::new only for tests and examples where the caller fully controls the policy shape.

pub fn from_env() -> Self

Load policy from the process environment. All toggles default to false; lists default to empty.

• SSRF_ALLOW_PRIVATE=1 — permit RFC 1918 / RFC 4193
• SSRF_ALLOW_LOOPBACK=1 — permit 127/8, ::1
• SSRF_ALLOW_LINK_LOCAL=1 — permit 169.254/16, fe80::/10
• SSRF_ALLOWLIST=host1,host2 — hostname-keyed allowlist
• SSRF_DENYLIST=host3,host4 — hostname-keyed denylist

pub fn with_metrics(self, metrics: SecurityMetrics) -> Self

Attach a metrics sink; counters are incremented on every block/deny event, labelled by IpClass.

pub fn with_allowlist(self, hosts: Vec<String>) -> Self

Replace the allowlist. Hostnames are stored verbatim and compared case-insensitively at check time.

pub fn with_denylist(self, hosts: Vec<String>) -> Self

Replace the denylist.

pub fn with_allow_private(self, allow: bool) -> Self

Override the private-space toggle.

pub fn with_allow_loopback(self, allow: bool) -> Self

Override the loopback toggle.

pub fn with_allow_link_local(self, allow: bool) -> Self

Override the link-local toggle.

pub fn classify(ip: IpAddr) -> IpClass

Classify an IP. Pure, total function over IpAddr.

pub async fn resolve_and_check(&self, url: &Url) -> Result<IpAddr, SsrfError>

Resolve url’s host to an IP and enforce the policy.

Returns the resolved IpAddr so callers can bind the subsequent socket connect to the same address, defeating DNS rebinding. On policy violation returns SsrfError::BlockedClass or SsrfError::Denylisted and increments the metrics counter labelled by the violating class.

The allowlist short-circuits classification; a host on the allowlist is permitted regardless of IP class. The denylist overrides all permissive checks (including the allowlist) — a host on both lists is denied.

Trait Implementations

impl Clone for SsrfPolicy

fn clone(&self) -> SsrfPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SsrfPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SsrfPolicy

fn default() -> Self

Returns the “default value” for a type.