working commit

2026-06-05 18:25:03 +02:00
commit 7d8abba003
82 changed files with 21863 additions and 0 deletions
@@ -0,0 +1,190 @@
+package netacl
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/netip"
+
+	"sigs.k8s.io/yaml"
+)
+
+type NetACL struct {
+	enabledAddresses  []netip.Addr
+	enabledNetworks   []netip.Prefix
+	disabledAddresses []netip.Addr
+	disabledNetworks  []netip.Prefix
+}
+
+func NewNetACL() *NetACL {
+	return &NetACL{
+		enabledAddresses:  make([]netip.Addr, 0),
+		enabledNetworks:   make([]netip.Prefix, 0),
+		disabledAddresses: make([]netip.Addr, 0),
+		disabledNetworks:  make([]netip.Prefix, 0),
+	}
+}
+
+type netACL struct {
+	EnabledAddresses  []string `json:"enabledAddresses"   yaml:"enabledAddresses"`
+	EnabledNetworks   []string `json:"enabledNetworks"    yaml:"enabledNetworks"`
+	DisabledAddresses []string `json:"disabledAddresses"  yaml:"disabledAddresses"`
+	DisabledNetworks  []string `json:"disabledNetworks"   yaml:"disabledNetworks"`
+}
+
+func newNetACL() *netACL {
+	return &netACL{
+		EnabledAddresses:  make([]string, 0),
+		EnabledNetworks:   make([]string, 0),
+		DisabledAddresses: make([]string, 0),
+		DisabledNetworks:  make([]string, 0),
+	}
+}
+
+func (al *NetACL) MarshalJSON() ([]byte, error) {
+	alDescr := newNetACL()
+	for _, disabledAddress := range al.disabledAddresses {
+		alDescr.DisabledAddresses = append(alDescr.DisabledAddresses, disabledAddress.String())
+	}
+	for _, disabledNetwork := range al.disabledNetworks {
+		alDescr.DisabledNetworks = append(alDescr.DisabledNetworks, disabledNetwork.String())
+	}
+	for _, enabledAddress := range al.enabledAddresses {
+		alDescr.EnabledAddresses = append(alDescr.EnabledAddresses, enabledAddress.String())
+	}
+	for _, enabledNetwork := range al.enabledNetworks {
+		alDescr.EnabledNetworks = append(alDescr.EnabledNetworks, enabledNetwork.String())
+	}
+	return json.Marshal(alDescr)
+}
+
+func (al *NetACL) UnmarshalJSON(data []byte) error {
+	var err error
+	return err
+}
+
+func (al *NetACL) MarshalYAML() ([]byte, error) {
+	alDescr := newNetACL()
+	for _, disabledAddress := range al.disabledAddresses {
+		alDescr.DisabledAddresses = append(alDescr.DisabledAddresses, disabledAddress.String())
+	}
+	for _, disabledNetwork := range al.disabledNetworks {
+		alDescr.DisabledNetworks = append(alDescr.DisabledNetworks, disabledNetwork.String())
+	}
+	for _, enabledAddress := range al.enabledAddresses {
+		alDescr.EnabledAddresses = append(alDescr.EnabledAddresses, enabledAddress.String())
+	}
+	for _, enabledNetwork := range al.enabledNetworks {
+		alDescr.EnabledNetworks = append(alDescr.EnabledNetworks, enabledNetwork.String())
+	}
+	return yaml.Marshal(alDescr)
+}
+
+func (al *NetACL) UnmarshalYAML(data []byte) error {
+	var err error
+	return err
+}
+
+func (al *NetACL) AddressIsEnabled(address string) (bool, error) {
+	var err error
+	var res bool
+	addr, err := netip.ParseAddr(address)
+	if err != nil {
+		return res, err
+	}
+	for _, disabledAddr := range al.disabledAddresses {
+		if disabledAddr.Compare(addr) == 0 {
+			res = false
+			return res, err
+		}
+	}
+	for _, disabledNetwork := range al.disabledNetworks {
+		if disabledNetwork.Contains(addr) {
+			res = false
+			return res, err
+		}
+	}
+	for _, enabledAddr := range al.enabledAddresses {
+		if enabledAddr.Compare(addr) == 0 {
+			res = true
+			return res, err
+		}
+	}
+	for _, enabledNetwork := range al.enabledNetworks {
+		if enabledNetwork.Contains(addr) {
+			res = true
+			return res, err
+		}
+	}
+	return res, err
+}
+
+func (al *NetACL) AddrIsEnabled(addr netip.Addr) (bool, error) {
+	var err error
+	var res bool
+	for _, disabledAddr := range al.disabledAddresses {
+		if disabledAddr.Compare(addr) == 0 {
+			res = false
+			return res, err
+		}
+	}
+	for _, disabledNetwork := range al.disabledNetworks {
+		if disabledNetwork.Contains(addr) {
+			res = false
+			return res, err
+		}
+	}
+	for _, enabledAddr := range al.enabledAddresses {
+		if enabledAddr.Compare(addr) == 0 {
+			res = true
+			return res, err
+		}
+	}
+	for _, enabledNetwork := range al.enabledNetworks {
+		if enabledNetwork.Contains(addr) {
+			res = true
+			return res, err
+		}
+	}
+	return res, err
+}
+
+func (al *NetACL) AddEnabledAddresses(addresses ...string) error {
+	var err error
+	for _, address := range addresses {
+		addr, addrParseErr := netip.ParseAddr(address)
+		if addrParseErr == nil {
+			al.enabledAddresses = append(al.enabledAddresses, addr)
+			continue
+		}
+		prefix, prefixParseErr := netip.ParsePrefix(address)
+		if prefixParseErr == nil {
+			al.enabledNetworks = append(al.enabledNetworks, prefix)
+			continue
+		}
+		err = errors.Join(addrParseErr, prefixParseErr)
+		err = fmt.Errorf("Address %s is not correct, error: %v", address, err)
+		break
+	}
+	return err
+}
+
+func (al *NetACL) AddDisabledAddresses(addresses ...string) error {
+	var err error
+	for _, address := range addresses {
+		addr, addrParseErr := netip.ParseAddr(address)
+		if addrParseErr == nil {
+			al.disabledAddresses = append(al.disabledAddresses, addr)
+			continue
+		}
+		prefix, prefixParseErr := netip.ParsePrefix(address)
+		if prefixParseErr == nil {
+			al.disabledNetworks = append(al.disabledNetworks, prefix)
+			continue
+		}
+		err = errors.Join(addrParseErr, prefixParseErr)
+		err = fmt.Errorf("Address %s is not correct, error: %v", address, err)
+		break
+	}
+	return err
+}
@@ -0,0 +1,77 @@
+package netacl
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/yaml"
+)
+
+func TestNetACLComplex(t *testing.T) {
+	var err error
+	var enabled bool
+	al := NewNetACL()
+	require.NotNil(t, al)
+	err = al.AddDisabledAddresses("10.0.0.1")
+	require.NoError(t, err)
+
+	err = al.AddDisabledAddresses("192.168.10.0/24")
+	require.NoError(t, err)
+
+	err = al.AddEnabledAddresses("192.168.100.0/16")
+	require.NoError(t, err)
+
+	yamlData, err := yaml.Marshal(al)
+	require.NoError(t, err)
+	fmt.Printf("\n%s\n", string(yamlData))
+
+	enabled, err = al.AddressIsEnabled("8.7.7.7")
+	require.NoError(t, err)
+	require.Equal(t, false, enabled)
+
+	enabled, err = al.AddressIsEnabled("192.168.10.0")
+	require.NoError(t, err)
+	require.Equal(t, false, enabled)
+
+	enabled, err = al.AddressIsEnabled("192.168.100.7")
+	require.NoError(t, err)
+	require.Equal(t, true, enabled)
+}
+
+func TestNetACLAllEnabled(t *testing.T) {
+	var err error
+	var enabled bool
+	al := NewNetACL()
+	require.NotNil(t, al)
+	err = al.AddEnabledAddresses("0.0.0.1/0")
+	require.NoError(t, err)
+
+	err = al.AddEnabledAddresses("10.0.1.1/17")
+	require.NoError(t, err)
+
+	yamlData, err := yaml.Marshal(al)
+	require.NoError(t, err)
+	fmt.Printf("\n%s\n", string(yamlData))
+
+	enabled, err = al.AddressIsEnabled("192.168.100.7")
+	require.NoError(t, err)
+	require.Equal(t, true, enabled)
+}
+
+func TestNetACLLoopEnabled(t *testing.T) {
+	var err error
+	var enabled bool
+	al := NewNetACL()
+	require.NotNil(t, al)
+	err = al.AddEnabledAddresses("::1/0")
+	require.NoError(t, err)
+
+	yamlData, err := yaml.Marshal(al)
+	require.NoError(t, err)
+	fmt.Printf("\n%s\n", string(yamlData))
+
+	enabled, err = al.AddressIsEnabled("::1")
+	require.NoError(t, err)
+	require.Equal(t, true, enabled)
+}