From 81246034dd9da3a4520651065b7b91c24ad0ffcf Mon Sep 17 00:00:00 2001
From: Andrew LeFevre <jalefevre@liberty.edu>
Date: Tue, 7 Jul 2026 13:10:37 -0400
Subject: [PATCH] add SafeAddrPort and SafeAddr

---
 ssrf.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/ssrf.go b/ssrf.go
index aadf7f2..3ede95e 100644
--- a/ssrf.go
+++ b/ssrf.go
@@ -226,6 +226,11 @@ func (g *Guardian) Safe(network string, address string, _ syscall.RawConn) error
 		return fmt.Errorf("%w: could not parse %s: %s", ErrInvalidHostPort, address, err)
 	}
 
+	return g.SafeAddrPort(ipport)
+}
+
+// SafeAddrPort operates like Safe except only the port and IP address are checked.
+func (g *Guardian) SafeAddrPort(ipport netip.AddrPort) error {
 	if g.ports != nil {
 		port := ipport.Port()
 		if !slices.Contains(g.ports, port) {
@@ -233,8 +238,11 @@ func (g *Guardian) Safe(network string, address string, _ syscall.RawConn) error
 		}
 	}
 
-	ip := ipport.Addr()
+	return g.SafeAddr(ipport.Addr())
+}
 
+// SafeAddrPort operates like Safe except only the IP address is checked.
+func (g *Guardian) SafeAddr(ip netip.Addr) error {
 	if ip.Is6() {
 		for _, net := range g.allowedv6Prefixes {
 			if net.Contains(ip) {