Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsIPInWhitelistFile ¶ added in v1.119.0
func IsIPInWhitelistFile(ip string, entries map[string]WhitelistEntry) bool
IsIPInWhitelistFile returns true if ip is present as an exact key OR is contained within any CIDR entry in the typed map. 1:1 replacement for the pre-V119 exact-key `entries[ip]` pattern at callsites needing CIDR-aware membership (notably the daemon pre-ban guard).
The ip argument must be a single IP literal (e.g. "1.2.3.45"), not a CIDR. To check whether an exact CIDR string is in the file (e.g. "1.2.3.0/27" as a literal), use direct map lookup `_, ok := entries[cidr]` instead.
V119 A1: closes whitelist half of D-MANUAL-CIDR-LOAD-GAP — protects an IP inside a whitelisted /27 from being banned.
func LoadAllWhitelists ¶
LoadAllWhitelists loads IPs from all whitelist sources and returns two map[string]bool sets for backward compatibility with pre-V119 callers (notably cmd/nftban-core/profile_sync.go which iterates keys for pprof diff profiling and does not perform membership tests).
New consumers needing CIDR semantics should call LoadAllWhitelistsTyped + IsIPInWhitelistFile instead.
V119: thin wrapper around LoadAllWhitelistsTyped (single scanning/parsing path, two return shapes) per the dual-API pattern in V119_MANUAL_CIDR_PREFLIGHT_PROFILE_SYNC_AUDIT.md §5.
func LoadAllWhitelistsTyped ¶ added in v1.119.0
func LoadAllWhitelistsTyped(configDir string) (map[string]WhitelistEntry, map[string]WhitelistEntry, error)
LoadAllWhitelistsTyped loads IPs from all whitelist sources and returns map[string]WhitelistEntry preserving IsCIDR semantics. Use in tandem with IsIPInWhitelistFile for CIDR-aware membership checks.
V119 A1: closes whitelist half of D-MANUAL-CIDR-LOAD-GAP. Callers in V116 §4 allowlist (cmd_check.go, cmd_ban.go, daemon_handlers_ban.go) use this typed loader; profile_sync.go remains on legacy LoadAllWhitelists. v1.228.10 PR-3 (audit finding A3) — OBSERVATION FAILURE IS NOT AN EMPTY WHITELIST.
This loader produces DESIRED STATE. FullSync treats its output as authoritative and deletes every kernel whitelist element absent from it, so a read failure that returns success-with-empty removes the operator's whitelist from the kernel — an admin-lockout enabler, because the input chain drops blacklisted sources BEFORE the established-state accept, so a lost whitelist entry kills a live session and not merely new connections.
Three states are now distinguished, and only the first may yield an empty result:
whitelist.d legitimately absent -> empty desired state, no error (first install) whitelist.d present, unenumerable -> error; caller preserves kernel state any participating file unreadable/ unparseable -> error; NO partial union may become authoritative
The third case is the one that matters most: a partial union is indistinguishable from a deliberate removal, so "file A parsed, file B failed" must not produce "desired = A". On any error the maps are returned nil so a partial result cannot be consumed by accident.
INV-P0-03 / INV-P0-04. Callers already abort correctly on error (internal/runtime/state.go LoadWhitelists -> daemon_handlers_sync.go), which is why this is an authority correction and not a FullSync redesign.
Types ¶
type WhitelistEntry ¶ added in v1.119.0
type WhitelistEntry struct {
Value string // exact normalized form as written: "1.2.3.4" or "1.2.3.0/27"
IsCIDR bool // true if Value contains "/"
// ExpiresAt carries the absolute RFC3339 timestamp from an inline
// `# EXPIRES_AT=<ts>` marker (V120 session-whitelist convention). Zero
// value = non-expiring (durable/trust entry) → permanent in the kernel.
// A future timestamp = the element must carry a kernel timeout anchored
// to this absolute instant, so a daemon FullSync/rebuild REFRESHES the
// remaining TTL instead of clobbering the entry to permanent (CLI-BUG-2,
// v1.168). Past timestamps are skipped at load and never reach here.
ExpiresAt time.Time
}
WhitelistEntry is the typed loader output preserving IsCIDR semantics so the daemon pre-ban guard can detect IP-in-CIDR membership instead of the pre-V119 exact-key map[ip] match. Mirror of blacklist.BlacklistEntry — closes the symmetric whitelist half of D-MANUAL-CIDR-LOAD-GAP per V116_CAND3_MANUAL_CIDR_DESIGN_FIX_SCOPE.md §3.
Source Files