IP Ranges

DefaultRanges = []string{"aws", "gcloud", "azurepubliccloud", "openai", "deepseek", "githubcopilot"}

func (c *IPChecker) ReqAllowed(ctx context.Context, clientIP net.IP) bool {
    ipAddr, err := ipToAddr(clientIP)
    if err != nil {
        c.log.Warn("Invalid IP address format",
            zap.String("ip", clientIP.String()),
            zap.Error(err))
        return false
    }

    // Check if the IP is whitelisted
    if ok, _ := c.whitelist.Matches(ipAddr); ok {
        c.log.Debug("IP is whitelisted", zap.String("ip", clientIP.String()))
        return true
    }
    // Check if the IP is in the blocked ranges
    return !c.IPInRanges(ctx, ipAddr)
}

for _, ipRange := range m.Ranges {
    // Check if the range is a predefined key (e.g., "openai")
    if _, ok := data.IPRanges[ipRange]; ok {
        // If it's a predefined key, skip CIDR validation
        continue
    }

    // Otherwise, treat it as a custom CIDR and validate it
    _, _, err := net.ParseCIDR(ipRange)
    if err != nil {
        return fmt.Errorf("invalid IP range %q: %v", ipRange, err)
    }
}

func (f ASNFetcher) FetchIPRanges() ([]string, error) {
    if len(f.ASNs) == 0 {
        return nil, fmt.Errorf("no ASNs provided to fetch")
    }

    ipRanges := make([]string, 0)

    for _, asn := range f.ASNs {
        url := fmt.Sprintf("https://api.hackertarget.com/aslookup/?q=%s", asn)
        // ... fetches IP ranges for the ASN
    }
    return ipRanges, nil
}

// Available in ranges/fetchers/aws/
type AWSRegionFetcher struct {
    Region  string // e.g., "us-east-1"
    Service string // e.g., "EC2", "S3" (optional)
}

var IPRanges = map[string][]string{
    "aliyun": {
        "5.181.224.0/23",
        "8.208.0.0/16",
        // ... thousands of ranges
    },
    "aws": { /* ... */ },
    "openai": { /* ... */ },
    // ...
}

func buildTable(cidrRanges []string, log *zap.Logger) *bart.Table[struct{}] {
    table := &bart.Table[struct{}]{}
    for _, cidr := range cidrRanges {
        if ranges, ok := data.IPRanges[cidr]; ok {
            for _, predefinedCIDR := range ranges {
                if err := insertCIDR(table, predefinedCIDR); err != nil {
                    log.Warn("Invalid predefined CIDR",
                        zap.String("group", cidr),
                        zap.String("cidr", predefinedCIDR),
                        zap.Error(err))
                }
            }
            continue
        }
        // Handle custom CIDR
        if err := insertCIDR(table, cidr); err != nil {
            log.Warn("Invalid CIDR specification",
                zap.String("cidr", cidr),
                zap.Error(err))
        }
    }
    return table
}

func insertCIDR(table *bart.Table[struct{}], cidr string) error {
    prefix, err := netip.ParsePrefix(cidr)
    if err != nil {
        return fmt.Errorf("invalid CIDR: %w", err)
    }

    table.Insert(prefix.Masked(), struct{}{})

    // If IPv4 CIDR, also insert as IPv4-mapped IPv6
    if prefix.Addr().Is4() {
        ipv4 := prefix.Addr().As4()
        ipv6Bytes := [16]byte{
            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff,
            ipv4[0], ipv4[1], ipv4[2], ipv4[3],
        }
        ipv6Prefix := netip.PrefixFrom(
            netip.AddrFrom16(ipv6Bytes),
            96+prefix.Bits(),
        )
        table.Insert(ipv6Prefix.Masked(), struct{}{})
    }
    return nil
}