[trafficserver] branch 10-Dev updated: libswoc: update maxmind plugin to IPSpace. (#9208)

[am...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

amc pushed a commit to branch 10-Dev
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/10-Dev by this push:
     new 9ef7ffa28 libswoc: update maxmind plugin to IPSpace. (#9208)
9ef7ffa28 is described below

commit 9ef7ffa28c1fe7e1f536025be12f0967d896e492
Author: Alan M. Carroll <am...@apache.org>
AuthorDate: Mon Nov 21 17:42:56 2022 -0600

    libswoc: update maxmind plugin to IPSpace. (#9208)
---
 include/tscpp/util/ts_ip.h               |  9 +++++++++
 lib/swoc/include/swoc/IPRange.h          |  3 +++
 plugins/experimental/maxmind_acl/mmdb.cc | 21 +++++++++++----------
 plugins/experimental/maxmind_acl/mmdb.h  |  6 +++---
 4 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/include/tscpp/util/ts_ip.h b/include/tscpp/util/ts_ip.h
index 2248b985d..92dbd0585 100644
--- a/include/tscpp/util/ts_ip.h
+++ b/include/tscpp/util/ts_ip.h
@@ -394,6 +394,9 @@ public:
   /// @return Number of ranges in the set.
   size_t count() const;
 
+  /// Remove all addresses in the set.
+  void clear();
+
 protected:
   /// Empty struct to use for payload.
   /// This declares the struct and defines the singleton instance used.
@@ -435,6 +438,12 @@ IPAddrSet::count() const
   return _addrs.count();
 }
 
+inline void
+IPAddrSet::clear()
+{
+  _addrs.clear();
+}
+
 inline bool
 IPAddrSet::Mark::operator==(IPAddrSet::Mark::self_type const &that)
 {
diff --git a/lib/swoc/include/swoc/IPRange.h b/lib/swoc/include/swoc/IPRange.h
index 919cb4807..b36780792 100644
--- a/lib/swoc/include/swoc/IPRange.h
+++ b/lib/swoc/include/swoc/IPRange.h
@@ -373,6 +373,9 @@ public:
   /// @return The IPv6 range.
   IP6Range const & ip6() const { return _range._ip6; }
 
+  /// @return The range family.
+  sa_family_t family() const { return _family; }
+
   /** Compute the mask for @a this as a network.
    *
    * @return If @a this is a network, the mask for that network. Otherwise an invalid mask.
diff --git a/plugins/experimental/maxmind_acl/mmdb.cc b/plugins/experimental/maxmind_acl/mmdb.cc
index 0fd1bb08f..7157e1d8a 100644
--- a/plugins/experimental/maxmind_acl/mmdb.cc
+++ b/plugins/experimental/maxmind_acl/mmdb.cc
@@ -242,10 +242,10 @@ Acl::loaddeny(const YAML::Node &denyNode)
         if (ip.IsSequence()) {
           // Do IP Deny processing
           for (auto &&i : ip) {
-            IpAddr min, max;
-            ats_ip_range_parse(std::string_view{i.as<std::string>()}, min, max);
-            deny_ip_map.fill(min, max, nullptr);
-            TSDebug(PLUGIN_NAME, "loading ip: valid: %d, fam %d ", min.isValid(), min.family());
+            if (swoc::IPRange r; r.load(i.Scalar())) {
+              deny_ip_map.fill(r);
+              TSDebug(PLUGIN_NAME, "Denying ip fam %d ", r.family());
+            }
           }
         } else {
           TSDebug(PLUGIN_NAME, "Invalid IP deny list yaml");
@@ -323,10 +323,10 @@ Acl::loadallow(const YAML::Node &allowNode)
         if (ip.IsSequence()) {
           // Do IP Allow processing
           for (auto &&i : ip) {
-            IpAddr min, max;
-            ats_ip_range_parse(std::string_view{i.as<std::string>()}, min, max);
-            allow_ip_map.fill(min, max, nullptr);
-            TSDebug(PLUGIN_NAME, "loading ip: valid: %d, fam %d ", min.isValid(), min.family());
+            if (swoc::IPRange r; r.load(i.Scalar())) {
+              allow_ip_map.fill(r);
+              TSDebug(PLUGIN_NAME, "loading ip: valid: fam %d ", r.family());
+            }
           }
         } else {
           TSDebug(PLUGIN_NAME, "Invalid IP allow list yaml");
@@ -749,12 +749,13 @@ Acl::eval_ip(const sockaddr *sock) const
   }
 #endif
 
-  if (allow_ip_map.contains(sock, nullptr)) {
+  swoc::IPAddr addr(sock);
+  if (allow_ip_map.contains(addr)) {
     // Allow map has this ip, we know we want to allow it
     return ALLOW_IP;
   }
 
-  if (deny_ip_map.contains(sock, nullptr)) {
+  if (deny_ip_map.contains(addr)) {
     // Deny map has this ip, explicitly deny
     return DENY_IP;
   }
diff --git a/plugins/experimental/maxmind_acl/mmdb.h b/plugins/experimental/maxmind_acl/mmdb.h
index 2bdb9df00..372cfdacd 100644
--- a/plugins/experimental/maxmind_acl/mmdb.h
+++ b/plugins/experimental/maxmind_acl/mmdb.h
@@ -36,7 +36,7 @@
 #include <unistd.h>
 #include <iterator>
 #include <maxminddb.h>
-#include "tscore/IpMap.h"
+#include "tscpp/util/ts_ip.h"
 
 #ifdef HAVE_PCRE_PCRE_H
 #include <pcre/pcre.h>
@@ -91,8 +91,8 @@ protected:
   std::unordered_map<std::string, std::vector<plugin_regex>> allow_regex;
   std::unordered_map<std::string, std::vector<plugin_regex>> deny_regex;
 
-  IpMap allow_ip_map;
-  IpMap deny_ip_map;
+  ts::IPAddrSet allow_ip_map;
+  ts::IPAddrSet deny_ip_map;
 
   // Anonymous blocking default to off
   bool _anonymous_ip      = false;