Documentation
¶
Overview ¶
Package netutil provides network utility functions for NFTBan Centralizes IP address handling, whitelist checking, and CIDR operations
Index ¶
- func EnforcementClassReject(ipStr string) (bool, string)
- func GetClientIP(r *http.Request) string
- func GetIPFamily(ipStr string) string
- func IPContainedInCIDR(ipStr, cidr string) bool
- func IsAbsolutelyNonBannable(ipStr string) bool
- func IsCIDR(s string) bool
- func IsIPWhitelisted(clientIP string, whitelistFile string) (bool, error)
- func IsIPv4(ipStr string) bool
- func IsIPv6(ipStr string) bool
- func IsPrivateIP(ipStr string) bool
- func IsPublicIP(ipStr string) bool
- func IsValidIP(ipStr string) bool
- func NormalizeIP(ipStr string) string
- func ParseCIDR(cidr string) (net.IP, *net.IPNet, error)
- func ParseIP(ipStr string) net.IP
- func ValidateAndNormalizeIP(ipStr string) (string, bool, error)
- type CoverageResult
- type IPRange
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnforcementClassReject ¶ added in v1.220.2
EnforcementClassReject reports whether ip should be rejected from a hostile enforcement action by ADDRESS CLASS. Absolute classes (loopback/unspecified/multicast) are always rejected — non-overridable. Non-public classes (RFC1918, ULA, link-local, CGNAT, documentation, reserved/benchmark) are rejected by DEFAULT, pending an explicit private-network enforcement feature that does not exist today (and must never be inferred from a raw ban). Public routable addresses return (false, ""). A non-bare-IP token (CIDR/range/blank) returns (false, "") so legitimate public feed CIDRs pass.
func GetClientIP ¶
GetClientIP extracts the real client IP address from an HTTP request. SECURITY: Only trusts X-Forwarded-For and X-Real-IP headers when the direct connection comes from a trusted proxy (loopback or private network). This prevents IP spoofing via forged headers from external clients.
func GetIPFamily ¶
GetIPFamily returns "ipv4" or "ipv6" based on the IP address
func IPContainedInCIDR ¶
IPContainedInCIDR checks if an IP is contained within a CIDR range
func IsAbsolutelyNonBannable ¶ added in v1.220.2
IsAbsolutelyNonBannable reports whether ip must NEVER enter a hostile enforcement/drop set under any circumstance (non-overridable): loopback, unspecified, or multicast. These address classes have no hostile-source meaning. A non-bare-IP token returns false (callers validate CIDR/range separately).
func IsIPWhitelisted ¶
IsIPWhitelisted checks if an IP is in a whitelist file Returns (true, nil) if IP is whitelisted Returns (false, nil) if IP is not whitelisted or file doesn't exist Returns (false, error) on file read errors
func IsPrivateIP ¶
IsPrivateIP checks if an IP is a private/local address
func IsPublicIP ¶
IsPublicIP checks if an IP is a public/routable address
func NormalizeIP ¶
NormalizeIP returns a normalized string representation of an IP Useful for consistent map keys and comparisons
Types ¶
type CoverageResult ¶ added in v1.202.0
type CoverageResult struct {
MissingFromKernel []string // baseline tokens whose coverage is NOT in the kernel union
ExtraInKernel []string // kernel tokens whose coverage is NOT in baseline∪sessions union
BadBaseline []string // unparseable baseline tokens (surfaced, not silently dropped)
BadKernel []string // unparseable kernel tokens
}
CoverageResult holds the real (range-aware) drift between baseline and kernel.
func CoverageDiff ¶ added in v1.202.0
func CoverageDiff(baseline, kernel, sessions []string) CoverageResult
CoverageDiff compares the durable baseline against the live kernel set using range coverage. A kernel element is "extra" only if it is covered by neither the durable baseline NOR the (allowed) session/runtime entries. CIDR<->interval representation differences are NOT reported (coverage-equivalent == match).
type IPRange ¶ added in v1.202.0
IPRange is an inclusive [Start,End] address range within one family (V6 flag).
func ParseRangeToken ¶ added in v1.202.0
ParseRangeToken parses a single IP, a CIDR, or an nft interval ("a-b") into an inclusive IPRange. Trailing nft decorations (comment/timeout) must be stripped by the caller. Returns an error on anything unparseable.
Source Files