Address ranges in address match lists (IPv4 and IPv6)
ACLs, views' match lists, options with address match lists and blocking client groups take ranges such as 10.0.10.101-10.0.10.199 or 2001:db8::100-2001:db8::1ff (negated, or with spaces around the dash, too). Jarl stores the range as written and writes the fewest prefixes that cover exactly that range to named.conf, with the range as a comment. New package internal/iprange; namedconf gets an AMRange element (a range used to parse as an ACL name), ExpandRanges and statement comments. Mistakes are refused when entered, validation sees what ranges cover, and IPv6 ranges in the IPv4-mapped space get a warning. The web UI shows what a range becomes while typing (GET /catalog/ranges). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adamandClaude Opus 5.5 committed
1 parent
49b1c872c9
commit
e2e5007f94
32 files changed
+905
-31
No files matched your search
@@ -0,0 +1,148 @@
|
||||
// Package iprange handles address ranges such as 10.0.10.101-10.0.10.199
|
||||
// or 2001:db8::100-2001:db8::1ff. BIND matches only addresses and
|
||||
// prefixes, so Jarl keeps a range as it was written and turns it into the
|
||||
// exact set of prefixes that covers it when it writes named.conf.
|
||||
package iprange
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"math/big"
|
||||
"net/netip"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// Range is an inclusive range of addresses of one family.
|
||||
type Range struct {
|
||||
Start, End netip.Addr
|
||||
}
|
||||
|
||||
// String returns the range as Jarl writes it: START-END.
|
||||
func (r Range) String() string { return r.Start.String() + "-" + r.End.String() }
|
||||
|
||||
// Parse parses START-END, both full addresses of the same family. ok is
|
||||
// false when s isn't meant as a range (no "-", or text before it that
|
||||
// isn't an address, such as the ACL name "branch-office"); err is set when
|
||||
// it is meant as one but is wrong.
|
||||
func Parse(s string) (r Range, ok bool, err error) {
|
||||
left, right, found := strings.Cut(s, "-")
|
||||
if !found {
|
||||
return Range{}, false, nil
|
||||
}
|
||||
left, right = strings.TrimSpace(left), strings.TrimSpace(right)
|
||||
if !looksLikeAddr(left) {
|
||||
return Range{}, false, nil
|
||||
}
|
||||
start, err := netip.ParseAddr(left)
|
||||
if err != nil {
|
||||
return Range{}, true, fmt.Errorf("range %q: %q is not a full IP address", s, left)
|
||||
}
|
||||
end, err := netip.ParseAddr(right)
|
||||
if err != nil {
|
||||
if right == "" {
|
||||
return Range{}, true, fmt.Errorf("range %q has no end address", s)
|
||||
}
|
||||
return Range{}, true, fmt.Errorf("range %q: %q is not a full IP address (write both ends in full, e.g. 10.0.10.101-10.0.10.199)", s, right)
|
||||
}
|
||||
if start.Zone() != "" || end.Zone() != "" {
|
||||
return Range{}, true, fmt.Errorf("range %q: addresses with a zone (%%interface) can't be matched", s)
|
||||
}
|
||||
if start.Is4() != end.Is4() {
|
||||
return Range{}, true, fmt.Errorf("range %q mixes IPv4 and IPv6", s)
|
||||
}
|
||||
if end.Less(start) {
|
||||
return Range{}, true, fmt.Errorf("range %q: the start is after the end", s)
|
||||
}
|
||||
return Range{Start: start, End: end}, true, nil
|
||||
}
|
||||
|
||||
// looksLikeAddr reports whether s could only be meant as an address: it
|
||||
// has a colon, or it is digits and dots with at least one dot.
|
||||
func looksLikeAddr(s string) bool {
|
||||
if strings.Contains(s, ":") {
|
||||
return true
|
||||
}
|
||||
if !strings.Contains(s, ".") {
|
||||
return false
|
||||
}
|
||||
for i := 0; i < len(s); i++ {
|
||||
if c := s[i]; !(c >= '0' && c <= '9' || c == '.') {
|
||||
return false
|
||||
}
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// Prefixes returns the fewest prefixes that together cover exactly the
|
||||
// range, in address order: 10.0.10.101-10.0.10.199 is 10.0.10.101/32,
|
||||
// 10.0.10.102/31, 10.0.10.104/29, 10.0.10.112/28, 10.0.10.128/26 and
|
||||
// 10.0.10.192/29. That is at most 62 prefixes for IPv4 and 254 for IPv6.
|
||||
func (r Range) Prefixes() []netip.Prefix {
|
||||
var out []netip.Prefix
|
||||
a := r.Start
|
||||
for {
|
||||
// The largest prefix that starts at a and ends at or before End.
|
||||
p := netip.PrefixFrom(a, a.BitLen())
|
||||
for bits := a.BitLen() - 1; bits >= 0; bits-- {
|
||||
q := netip.PrefixFrom(a, bits)
|
||||
if q.Masked().Addr() != a || r.End.Less(last(q)) {
|
||||
break
|
||||
}
|
||||
p = q
|
||||
}
|
||||
out = append(out, p)
|
||||
end := last(p)
|
||||
if end == r.End {
|
||||
return out
|
||||
}
|
||||
a = end.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// last returns the last address of a prefix.
|
||||
func last(p netip.Prefix) netip.Addr {
|
||||
b := p.Addr().AsSlice()
|
||||
for i := p.Bits(); i < len(b)*8; i++ {
|
||||
b[i/8] |= 0x80 >> (i % 8)
|
||||
}
|
||||
a, _ := netip.AddrFromSlice(b)
|
||||
return a
|
||||
}
|
||||
|
||||
// Size returns the number of addresses in the range.
|
||||
func (r Range) Size() *big.Int {
|
||||
s := new(big.Int).SetBytes(r.Start.AsSlice())
|
||||
e := new(big.Int).SetBytes(r.End.AsSlice())
|
||||
return e.Sub(e, s).Add(e, big.NewInt(1))
|
||||
}
|
||||
|
||||
// SizeText describes the size for people: "99 addresses", or a power of
|
||||
// two for very large IPv6 ranges ("about 2^80 addresses").
|
||||
func (r Range) SizeText() string {
|
||||
n := r.Size()
|
||||
if n.BitLen() <= 40 {
|
||||
if n.Int64() == 1 {
|
||||
return "1 address"
|
||||
}
|
||||
return n.String() + " addresses"
|
||||
}
|
||||
return fmt.Sprintf("about 2^%d addresses", n.BitLen()-1)
|
||||
}
|
||||
|
||||
// Mapped4 is the IPv4-mapped IPv6 space; BIND can see IPv4 clients as
|
||||
// addresses in it.
|
||||
var Mapped4 = netip.MustParsePrefix("::ffff:0:0/96")
|
||||
|
||||
// TouchesMapped4 reports whether an IPv6 range overlaps ::ffff:0:0/96.
|
||||
func (r Range) TouchesMapped4() bool {
|
||||
if r.Start.Is4() {
|
||||
return false
|
||||
}
|
||||
lo, hi := Mapped4.Addr(), last(Mapped4)
|
||||
return !(r.End.Less(lo) || hi.Less(r.Start))
|
||||
}
|
||||
|
||||
// FromPrefix returns the addresses of a prefix as a range.
|
||||
func FromPrefix(p netip.Prefix) Range {
|
||||
p = p.Masked()
|
||||
return Range{Start: p.Addr(), End: last(p)}
|
||||
}
|
||||
@@ -0,0 +1,123 @@
|
||||
package iprange
|
||||
|
||||
import (
|
||||
"math/rand"
|
||||
"net/netip"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParse(t *testing.T) {
|
||||
for _, tc := range []struct {
|
||||
in, want, err string
|
||||
ok bool
|
||||
}{
|
||||
{in: "10.0.10.101-10.0.10.199", want: "10.0.10.101-10.0.10.199", ok: true},
|
||||
{in: "10.0.10.101 - 10.0.10.199", want: "10.0.10.101-10.0.10.199", ok: true},
|
||||
{in: "2001:DB8::100-2001:db8::1ff", want: "2001:db8::100-2001:db8::1ff", ok: true},
|
||||
{in: "10.0.0.5-10.0.0.5", want: "10.0.0.5-10.0.0.5", ok: true},
|
||||
{in: "branch-office", ok: false},
|
||||
{in: "10-net", ok: false},
|
||||
{in: "10.0.0.0/24", ok: false},
|
||||
{in: "10.0.10.101-199", ok: true, err: "not a full IP address"},
|
||||
{in: "10.0.10.101-", ok: true, err: "no end address"},
|
||||
{in: "2001:db8::100-1ff", ok: true, err: "not a full IP address"},
|
||||
{in: "10.0.0.9-10.0.0.1", ok: true, err: "start is after the end"},
|
||||
{in: "10.0.0.1-2001:db8::1", ok: true, err: "mixes IPv4 and IPv6"},
|
||||
{in: "fe80::1%eth0-fe80::9%eth0", ok: true, err: "zone"},
|
||||
{in: "10.0.300.1-10.0.300.9", ok: true, err: "not a full IP address"},
|
||||
{in: "10.0.0.1-10.0.0.9-10.0.0.20", ok: true, err: "not a full IP address"},
|
||||
} {
|
||||
r, ok, err := Parse(tc.in)
|
||||
if ok != tc.ok || (err == nil) != (tc.err == "") || err != nil && !strings.Contains(err.Error(), tc.err) {
|
||||
t.Errorf("%s: ok=%v err=%v, want ok=%v err~%q", tc.in, ok, err, tc.ok, tc.err)
|
||||
continue
|
||||
}
|
||||
if err == nil && ok && r.String() != tc.want {
|
||||
t.Errorf("%s = %s, want %s", tc.in, r, tc.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestPrefixes(t *testing.T) {
|
||||
for in, want := range map[string]string{
|
||||
"10.0.10.101-10.0.10.199": "10.0.10.101/32 10.0.10.102/31 10.0.10.104/29 10.0.10.112/28 10.0.10.128/26 10.0.10.192/29",
|
||||
"10.0.0.0-10.0.0.255": "10.0.0.0/24",
|
||||
"10.0.0.5-10.0.0.5": "10.0.0.5/32",
|
||||
"0.0.0.0-255.255.255.255": "0.0.0.0/0",
|
||||
"255.255.255.254-255.255.255.255": "255.255.255.254/31",
|
||||
"2001:db8::100-2001:db8::1ff": "2001:db8::100/120",
|
||||
"::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff": "::/0",
|
||||
} {
|
||||
r, _, err := Parse(in)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var got []string
|
||||
for _, p := range r.Prefixes() {
|
||||
got = append(got, p.String())
|
||||
}
|
||||
if strings.Join(got, " ") != want {
|
||||
t.Errorf("%s = %s, want %s", in, strings.Join(got, " "), want)
|
||||
}
|
||||
}
|
||||
// The worst cases stay small.
|
||||
if n := len(must(t, "0.0.0.1-255.255.255.254").Prefixes()); n != 62 {
|
||||
t.Errorf("worst IPv4 case = %d prefixes, want 62", n)
|
||||
}
|
||||
if n := len(must(t, "::1-ffff:ffff:ffff:ffff:ffff:ffff:ffff:fffe").Prefixes()); n != 254 {
|
||||
t.Errorf("worst IPv6 case = %d prefixes, want 254", n)
|
||||
}
|
||||
}
|
||||
|
||||
// Every address of a random range is covered once, and nothing outside it.
|
||||
func TestPrefixesExact(t *testing.T) {
|
||||
rnd := rand.New(rand.NewSource(1))
|
||||
for i := 0; i < 300; i++ {
|
||||
lo, hi := rnd.Intn(4096), rnd.Intn(4096)
|
||||
if hi < lo {
|
||||
lo, hi = hi, lo
|
||||
}
|
||||
base := []byte{10, 20, 0, 0}
|
||||
addr := func(n int) netip.Addr {
|
||||
return netip.AddrFrom4([4]byte{base[0], base[1], byte(n >> 8), byte(n)})
|
||||
}
|
||||
r := Range{Start: addr(lo), End: addr(hi)}
|
||||
ps := r.Prefixes()
|
||||
for n := max(lo-3, 0); n <= min(hi+3, 4095); n++ {
|
||||
c := 0
|
||||
for _, p := range ps {
|
||||
if p.Contains(addr(n)) {
|
||||
c++
|
||||
}
|
||||
}
|
||||
if in := n >= lo && n <= hi; in && c != 1 || !in && c != 0 {
|
||||
t.Fatalf("%s: %s covered %d times (%v)", r, addr(n), c, ps)
|
||||
}
|
||||
}
|
||||
if got := r.Size().Int64(); got != int64(hi-lo+1) {
|
||||
t.Fatalf("%s: size %d", r, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestSizeAndMapped(t *testing.T) {
|
||||
if s := must(t, "10.0.10.101-10.0.10.199").SizeText(); s != "99 addresses" {
|
||||
t.Errorf("size = %s", s)
|
||||
}
|
||||
if s := must(t, "2001:db8::-2001:db8:0:ffff:ffff:ffff:ffff:ffff").SizeText(); s != "about 2^80 addresses" {
|
||||
t.Errorf("size = %s", s)
|
||||
}
|
||||
if !must(t, "::ffff:10.0.0.1-::ffff:10.0.0.9").TouchesMapped4() || must(t, "2001:db8::1-2001:db8::9").TouchesMapped4() || must(t, "10.0.0.1-10.0.0.9").TouchesMapped4() {
|
||||
t.Error("TouchesMapped4")
|
||||
}
|
||||
}
|
||||
|
||||
func must(t *testing.T, s string) Range {
|
||||
t.Helper()
|
||||
r, ok, err := Parse(s)
|
||||
if !ok || err != nil {
|
||||
t.Fatalf("%s: %v %v", s, ok, err)
|
||||
}
|
||||
return r
|
||||
}
|
||||
Reference in new issue
Block a user