#[cfg(test)]
use crate::ambient_authority;
use crate::net::pool::net::ToSocketAddrs;
use crate::AmbientAuthority;
use ipnet::IpNet;
#[cfg(test)]
use std::str::FromStr;
use std::{io, net};
#[derive(Clone)]
enum AddrSet {
Net(IpNet),
}
impl AddrSet {
fn contains(&self, addr: net::IpAddr) -> bool {
match self {
Self::Net(ip_net) => ip_net.contains(&addr),
}
}
}
#[derive(Clone)]
struct IpGrant {
set: AddrSet,
ports_start: u16,
ports_end: Option<u16>,
}
impl IpGrant {
fn contains(&self, addr: &net::SocketAddr) -> bool {
if !self.set.contains(addr.ip()) {
return false;
}
let port = addr.port();
if port < self.ports_start {
return false;
}
if let Some(ports_end) = self.ports_end {
if port >= ports_end {
return false;
}
}
true
}
}
#[derive(Clone, Default)]
pub struct Pool {
grants: Vec<IpGrant>,
}
impl Pool {
pub fn new() -> Self {
Self { grants: Vec::new() }
}
pub fn insert<A: ToSocketAddrs>(
&mut self,
addrs: A,
ambient_authority: AmbientAuthority,
) -> io::Result<()> {
for addr in addrs.to_socket_addrs()? {
self.insert_socket_addr(addr, ambient_authority);
}
Ok(())
}
pub fn insert_socket_addr(
&mut self,
addr: net::SocketAddr,
ambient_authority: AmbientAuthority,
) {
self.insert_ip_net(addr.ip().into(), addr.port(), ambient_authority)
}
pub fn insert_ip_net_port_any(
&mut self,
ip_net: ipnet::IpNet,
ambient_authority: AmbientAuthority,
) {
self.insert_ip_net_port_range(ip_net, 0, None, ambient_authority)
}
pub fn insert_ip_net_port_range(
&mut self,
ip_net: ipnet::IpNet,
ports_start: u16,
ports_end: Option<u16>,
ambient_authority: AmbientAuthority,
) {
let _ = ambient_authority;
self.grants.push(IpGrant {
set: AddrSet::Net(ip_net),
ports_start,
ports_end,
})
}
pub fn insert_ip_net(
&mut self,
ip_net: ipnet::IpNet,
port: u16,
ambient_authority: AmbientAuthority,
) {
self.insert_ip_net_port_range(ip_net, port, port.checked_add(1), ambient_authority)
}
pub fn check_addr(&self, addr: &net::SocketAddr) -> io::Result<()> {
if self.grants.iter().any(|grant| grant.contains(addr)) {
Ok(())
} else {
Err(io::Error::new(
io::ErrorKind::PermissionDenied,
"An address was outside the pool",
))
}
}
}
pub const NO_SOCKET_ADDRS: &[net::SocketAddr] = &[];
#[cold]
pub fn no_socket_addrs() -> io::Error {
std::net::TcpListener::bind(NO_SOCKET_ADDRS).unwrap_err()
}
#[test]
fn test_empty() {
let p = Pool::new();
p.check_addr(&net::SocketAddr::from_str("[::1]:0").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1023").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1024").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:8080").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:65535").unwrap())
.unwrap_err();
}
#[test]
fn test_port_any() {
let mut p = Pool::new();
p.insert_ip_net_port_any(
IpNet::new(net::IpAddr::V6(net::Ipv6Addr::LOCALHOST), 48).unwrap(),
ambient_authority(),
);
p.check_addr(&net::SocketAddr::from_str("[::1]:0").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:1023").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:1024").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:8080").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:65535").unwrap())
.unwrap();
}
#[test]
fn test_port_range() {
let mut p = Pool::new();
p.insert_ip_net_port_range(
IpNet::new(net::IpAddr::V6(net::Ipv6Addr::LOCALHOST), 48).unwrap(),
1024,
Some(9000),
ambient_authority(),
);
p.check_addr(&net::SocketAddr::from_str("[::1]:0").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1023").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1024").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:8080").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:65535").unwrap())
.unwrap_err();
}
#[test]
fn test_port_one() {
let mut p = Pool::new();
p.insert_ip_net(
IpNet::new(net::IpAddr::V6(net::Ipv6Addr::LOCALHOST), 48).unwrap(),
8080,
ambient_authority(),
);
p.check_addr(&net::SocketAddr::from_str("[::1]:0").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1023").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1024").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:8080").unwrap())
.unwrap();
p.check_addr(&net::SocketAddr::from_str("[::1]:65535").unwrap())
.unwrap_err();
}
#[test]
fn test_addrs() {
let mut p = Pool::new();
match p.insert("example.com:80", ambient_authority()) {
Ok(()) => (),
Err(_) => return, }
p.check_addr(&net::SocketAddr::from_str("[::1]:0").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1023").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:1024").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:8080").unwrap())
.unwrap_err();
p.check_addr(&net::SocketAddr::from_str("[::1]:65535").unwrap())
.unwrap_err();
for addr in "example.com:80".to_socket_addrs().unwrap() {
p.check_addr(&addr).unwrap();
}
}