apic

Author: mmetc

pkg/apiserver/apic.go

@@ -7,7 +7,7 @@ import (
 	"errors"
 	"fmt"
 	"math/rand"
-	"net"
+	"net/netip"
 	"net/http"
 	"net/url"
 	"slices"
@@ -844,26 +844,30 @@ func (a *apic) UpdateAllowlists(ctx context.Context, allowlistsLinks []*modelsca
 
 // if decisions is whitelisted: return representation of the whitelist ip or cidr
 // if not whitelisted: empty string
-func (a *apic) whitelistedBy(decision *models.Decision, additionalIPs []net.IP, additionalRanges []*net.IPNet) string {
+func (a *apic) whitelistedBy(decision *models.Decision, additionalIPs []netip.Addr, additionalRanges []netip.Prefix) string {
 	if decision.Value == nil {
 		return ""
 	}
 
-	ipval := net.ParseIP(*decision.Value)
+	ipval, err := netip.ParseAddr(*decision.Value)
+	if err != nil {
+		// XXX: handle error
+	}
+
 	for _, cidr := range a.whitelists.Cidrs {
 		if cidr.Contains(ipval) {
 			return cidr.String()
 		}
 	}
 
 	for _, ip := range a.whitelists.Ips {
-		if ip != nil && ip.Equal(ipval) {
+		if ip == ipval {
 			return ip.String()
 		}
 	}
 
 	for _, ip := range additionalIPs {
-		if ip.Equal(ipval) {
+		if ip == ipval {
 			return ip.String()
 		}
 	}

pkg/apiserver/apic_test.go

@@ -5,7 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"net"
+	"net/netip"
 	"net/http"
 	"net/url"
 	"os"
@@ -528,14 +528,14 @@ func TestAPICWhitelists(t *testing.T) {
 	api := getAPIC(t, ctx)
 	// one whitelist on IP, one on CIDR
 	api.whitelists = &csconfig.CapiWhitelist{}
-	api.whitelists.Ips = append(api.whitelists.Ips, net.ParseIP("9.2.3.4"), net.ParseIP("7.2.3.4"))
+	api.whitelists.Ips = append(api.whitelists.Ips, netip.MustParseAddr("9.2.3.4"), netip.MustParseAddr("7.2.3.4"))
 
-	_, tnet, err := net.ParseCIDR("13.2.3.0/24")
+	tnet, err := netip.ParsePrefix("13.2.3.0/24")
 	require.NoError(t, err)
 
 	api.whitelists.Cidrs = append(api.whitelists.Cidrs, tnet)
 
-	_, tnet, err = net.ParseCIDR("11.2.3.0/24")
+	tnet, err = netip.ParsePrefix("11.2.3.0/24")
 	require.NoError(t, err)
 
 	api.whitelists.Cidrs = append(api.whitelists.Cidrs, tnet)

pkg/csconfig/api.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"net/netip"
 	"os"
 	"strings"
 	"time"
@@ -276,8 +277,8 @@ func toValidCIDR(ip string) string {
 }
 
 type CapiWhitelist struct {
-	Ips   []net.IP     `yaml:"ips,omitempty"`
-	Cidrs []*net.IPNet `yaml:"cidrs,omitempty"`
+	Ips   []netip.Addr   `yaml:"ips,omitempty"`
+	Cidrs []netip.Prefix `yaml:"cidrs,omitempty"`
 }
 
 type LocalAPIAutoRegisterCfg struct {
@@ -450,21 +451,21 @@ func parseCapiWhitelists(fd io.Reader) (*CapiWhitelist, error) {
 	}
 
 	ret := &CapiWhitelist{
-		Ips:   make([]net.IP, len(fromCfg.Ips)),
-		Cidrs: make([]*net.IPNet, len(fromCfg.Cidrs)),
+		Ips:   make([]netip.Addr, len(fromCfg.Ips)),
+		Cidrs: make([]netip.Prefix, len(fromCfg.Cidrs)),
 	}
 
 	for idx, v := range fromCfg.Ips {
-		ip := net.ParseIP(v)
-		if ip == nil {
-			return nil, fmt.Errorf("invalid IP address: %s", v)
+		ip, err := netip.ParseAddr(v)
+		if err != nil {
+			return nil, err
 		}
 
 		ret.Ips[idx] = ip
 	}
 
 	for idx, v := range fromCfg.Cidrs {
-		_, tnet, err := net.ParseCIDR(v)
+		tnet, err := netip.ParsePrefix(v)
 		if err != nil {
 			return nil, err
 		}

pkg/database/allowlists.go

@@ -3,7 +3,7 @@ package database
 import (
 	"context"
 	"fmt"
-	"net"
+	"net/netip"
 	"strings"
 	"time"
 
@@ -354,31 +354,31 @@ func (c *Client) IsAllowlisted(ctx context.Context, value string) (bool, string,
 	return true, reason, nil
 }
 
-func (c *Client) GetAllowlistsContentForAPIC(ctx context.Context) ([]net.IP, []*net.IPNet, error) {
+func (c *Client) GetAllowlistsContentForAPIC(ctx context.Context) ([]netip.Addr, []netip.Prefix, error) {
 	allowlists, err := c.ListAllowLists(ctx, true)
 	if err != nil {
 		return nil, nil, fmt.Errorf("unable to get allowlists: %w", err)
 	}
 
 	var (
-		ips  []net.IP
-		nets []*net.IPNet
+		ips  []netip.Addr
+		nets []netip.Prefix
 	)
 
 	for _, allowlist := range allowlists {
 		for _, item := range allowlist.Edges.AllowlistItems {
 			if item.ExpiresAt.IsZero() || item.ExpiresAt.After(time.Now().UTC()) {
 				if strings.Contains(item.Value, "/") {
-					_, ipNet, err := net.ParseCIDR(item.Value)
+					ipNet, err := netip.ParsePrefix(item.Value)
 					if err != nil {
 						c.Log.Errorf("unable to parse CIDR %s: %s", item.Value, err)
 						continue
 					}
 
 					nets = append(nets, ipNet)
 				} else {
-					ip := net.ParseIP(item.Value)
-					if ip == nil {
+					ip, err := netip.ParseAddr(item.Value)
+					if err != nil {
 						c.Log.Errorf("unable to parse IP %s", item.Value)
 						continue
 					}