feat: ssrf allow CGNAT ip range for ipv4

[ognyvrac]

Add CGNAT IP Range Support to SSRF Protection

Summary

This PR adds support for the CGNAT (Carrier-Grade NAT) IP address range 100.64.0.0/10 to the SSRF protection mechanisms in the HTTP client transports. This enables Oathkeeper to work correctly in environments using Carrier-Grade NAT infrastructure.

Background

CGNAT (Carrier-Grade NAT) uses the shared address space 100.64.0.0/10 as defined in RFC 6598. This address space is used by ISPs and organizations for internal network infrastructure when traditional private address space (RFC 1918) is insufficient or already allocated.

The CGNAT range was missing from the allowed internal IP prefixes, causing issues when Oathkeeper needs to communicate with services in CGNAT environments.

In our case, access to one of our mutators, that resides on the same Kubernetes cluster as our Oathkeeper Pod, was declined as the 100.64.0.0/10 is used by the Calico CNI. This IP range should NOT be publicly exposed as per the RFC.

Changes

Added 100.64.0.0/10 to the allowed IPv4 prefixes in both HTTP transport configurations:
allowInternalAllowIPv6 transport (supports both IPv4 and IPv6)
IPv4-only transport configuration

Impact

This is a non-breaking enhancement that is user transparent; thus, I do not see a need for the design document

Related issue(s)

Checklist

• I have read the contributing guidelines.
• [n/a] I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  security@ory.com) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

Change is minimal, I did not see a reason to create the design document.

Furthermore, no tests exist for this part of the code - that is why I did not add any (correct me if I am wrong).

IMO comments are telling enough. As this is not a customer-facing change I do not see where to document it better.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

I582987 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[alnr]

Duplicate of ory/x#806, please check the discussion there.