func validateIPAddress()

in workhorse/internal/transport/transport.go [147:225]
61 lines of code
20 McCabe index (conditional complexity)

func validateIPAddress(allowLocalhost bool, allowedEndpoints []string) func(network, address string, c syscall.RawConn) error {
	return func(_, address string, _ syscall.RawConn) error {
		host, _, _ := net.SplitHostPort(address)

		ipAddress := net.ParseIP(host)

		for _, allowedEndpoint := range allowedEndpoints {
			var hostname string

			switch {
			case strings.Contains(allowedEndpoint, "://"):
				// It's already a URL
				uri := helper.URLMustParse(allowedEndpoint)
				hostname = uri.Hostname()
			case strings.Contains(allowedEndpoint, ":"):
				// It's a host:port format
				hostPart, _, err := net.SplitHostPort(allowedEndpoint)
				if err != nil {
					return fmt.Errorf("invalid host:port format: %v", err)
				}

				hostname = hostPart
			default:
				// It's a hostname
				hostname = allowedEndpoint
			}

			// Check if it's an IP address itself
			if ip := net.ParseIP(hostname); ip != nil {
				if ip.Equal(ipAddress) {
					return nil
				}
				continue // Skip DNS lookup for IP addresses
			}

			// Perform DNS lookup
			ips, err := lookupIPFunc(hostname)
			if err != nil {
				return fmt.Errorf("error resolving IP address for %s: %v", hostname, err)
			}

			for _, ip := range ips {
				if ip.Equal(ipAddress) {
					return nil
				}
			}
		}

		if ipAddress.Equal(net.IPv4bcast) {
			return &AllowedIPError{IP: ipAddress, Message: "limited broadcast IPs are not allowed"}
		}

		for _, network := range privateNetworks {
			if network.Contains(ipAddress) {
				return &AllowedIPError{IP: ipAddress, Message: "private IPs are not allowed"}
			}
		}

		if !allowLocalhost {
			for _, network := range loopbackNetworks {
				if network.Contains(ipAddress) {
					return &AllowedIPError{IP: ipAddress, Message: "loopback IPs are not allowed"}
				}
			}

			for _, network := range unspecifiedNetworks {
				if network.Contains(ipAddress) {
					return &AllowedIPError{IP: ipAddress, Message: "unspecified IPs are not allowed"}
				}
			}
		}

		if ipAddress.IsLinkLocalMulticast() || ipAddress.IsLinkLocalUnicast() {
			return &AllowedIPError{IP: ipAddress, Message: "link-local unicast and multicast IPs are not allowed"}
		}

		return nil
	}
}