Documentation
¶
Overview ¶
Package ipset answers one question: is this address inside any of these CIDRs?
It replaces a prefix-trie library that converted the address into a freshly allocated slice on every lookup. That allocation sat on the hottest path a resolver has — the access list runs before the cache, so every query paid it.
A prefix is a contiguous range of addresses, so a set of prefixes is a set of ranges, and "is this address in one of them" is the classic stabbing query: sort the ranges by where they start, remember the furthest end seen so far, and one binary search answers it. Overlaps and nesting need no special handling, lookups touch a flat slice, and nothing allocates.
A Set is built once at startup and read concurrently afterwards.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type BadEntry ¶
BadEntry is a CIDR that would not parse, reported rather than fatal: a typo in one entry should not knock out the rest of a config.
type Set ¶
type Set struct {
// contains filtered or unexported fields
}
Set is a compiled list of prefixes. The zero value is an empty set, which contains nothing.
func (*Set) Contains ¶
Contains reports whether addr falls inside any prefix in the set.
An IPv4-mapped IPv6 address is answered as the IPv4 address it carries: that is what a client behind a dual-stack socket looks like, and an operator who wrote an IPv4 CIDR means it to match them.
func (*Set) ContainsIP ¶
ContainsIP is Contains for callers holding a net.IP. The conversion is a value copy — nothing escapes, nothing allocates.
Source Files