Add NetFromRange and NetFromInterval helpers

When retrieving set elements it can be desired to format the result in
the same way `nft` would, which is merging intervals to CIDR
representations. To make this easier, introduce helper functions which
allow for conversion of IP address ranges to CIDR networks.

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>

Author: tacerus

util.go

@@ -16,12 +16,19 @@ package nftables
 
 import (
 	"encoding/binary"
+	"errors"
 	"net"
+	"net/netip"
 
 	"github.com/google/nftables/binaryutil"
 	"golang.org/x/sys/unix"
 )
 
+var (
+	MaxIPv4 = net.IP{255, 255, 255, 255}
+	MaxIPv6 = net.IP{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}
+)
+
 func extraHeader(family uint8, resID uint16) []byte {
 	return append([]byte{
 		family,
@@ -126,3 +133,63 @@ func NetInterval(cidr string) (net.IP, net.IP, error) {
 
 	return first, nextIP(last), nil
 }
+
+// NetFromRange returns a CIDR IP network given a start and end address.
+// If the network is an exact match, ok will be true.
+func NetFromRange(first net.IP, last net.IP) (*net.IPNet, bool, error) {
+	ip1 := net.IP(first)
+	ip2 := net.IP(last)
+
+	maxLen := 32
+	isIpv6 := ip1.To4() == nil
+
+	if isIpv6 && ip2.To4() != nil || !isIpv6 && ip2.To4() == nil {
+		return nil, false, errors.New("Cannot mix IPv4 and IPv6.")
+	}
+
+	if isIpv6 {
+		maxLen = 128
+	}
+
+	var match *net.IPNet
+	for l := maxLen; l >= -1; l-- {
+		cidrmask := net.CIDRMask(l, maxLen)
+		ipmask := ip2.Mask(cidrmask)
+		ipnet := net.IPNet{
+			IP:   ipmask,
+			Mask: cidrmask,
+		}
+
+		if ipnet.Contains(ip1) {
+			match = &ipnet
+			break
+		}
+
+	}
+
+	return match, match.IP.Equal(ip1), nil
+}
+
+// NetFromInterval returns a CIDR IP network given a start and end address as found in intervals.
+// This is similar to NetFromRange, but subtracts one address from the end of the range.
+// If the resulting network is an exact match, ok will be true.
+func NetFromInterval(first net.IP, last net.IP) (out *net.IPNet, ok bool, err error) {
+	var previous net.IP
+
+	if len(last) == 0 {
+		if last.To4() == nil {
+			previous = MaxIPv6
+		} else {
+			previous = MaxIPv4
+		}
+	} else {
+		ip2, ok := netip.AddrFromSlice(last)
+		if !ok {
+			return nil, false, errors.New("Failed to construct slice from network.")
+		}
+
+		previous = ip2.Prev().AsSlice()
+	}
+
+	return NetFromRange(first, previous)
+}

util_test.go

@@ -201,3 +201,184 @@ func TestNetInterval(t *testing.T) {
 		})
 	}
 }
+
+func TestNetFromRange(t *testing.T) {
+	tests := []struct {
+		name    string
+		first   string
+		last    string
+		wantNet string
+		wantOk  bool
+		wantErr bool
+	}{
+		{
+			first:   "0.0.0.0",
+			last:    "255.255.255.255",
+			wantNet: "0.0.0.0/0",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first:   "0.0.0.1",
+			last:    "255.255.255.254",
+			wantNet: "0.0.0.0/0",
+			wantOk:  false,
+			wantErr: false,
+		},
+		{
+			first:   "192.168.4.0",
+			last:    "192.168.4.255",
+			wantNet: "192.168.4.0/24",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first:   "192.0.2.16",
+			last:    "192.0.2.30",
+			wantNet: "192.0.2.16/28",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:100::",
+			last:    "2001:db8:100:ffff:ffff:ffff:ffff:ffff",
+			wantNet: "2001:db8:100::/48",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:100::100",
+			last:    "2001:db8:100:0:ffff:ffff:ffff:ffff",
+			wantNet: "2001:db8:100::/64",
+			wantOk:  false,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:100::",
+			last:    "192.0.2.30",
+			wantNet: "",
+			wantOk:  true,
+			wantErr: true,
+		},
+		{
+			first:   "192.0.2.30",
+			last:    "2001:db8:100::",
+			wantNet: "",
+			wantOk:  true,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.first+"-"+tt.last, func(t *testing.T) {
+			gotNet, gotOk, err := NetFromRange(net.ParseIP(tt.first), net.ParseIP(tt.last))
+			if (err != nil) != tt.wantErr {
+				t.Errorf("NetFromRange() error = %v, wantErr = %v", err, tt.wantErr)
+			}
+
+			if tt.wantNet == "" {
+				return
+			}
+
+			_, wantNetParsed, err := net.ParseCIDR(tt.wantNet)
+			if err != nil {
+				t.Fatalf("NetFromRange() error parsing test network = %v", err)
+			}
+
+			if tt.wantOk != gotOk {
+				t.Errorf("NetFromRange() gotOk = %t, wantOk = %t", gotOk, tt.wantOk)
+			}
+
+			if !reflect.DeepEqual(gotNet, wantNetParsed) {
+				t.Errorf("NetFromRange() gotNet = %+v, wantNet = %+v", gotNet, wantNetParsed)
+			}
+		})
+	}
+}
+
+func TestNetFromInterval(t *testing.T) {
+	tests := []struct {
+		name    string
+		first   string
+		last    string
+		wantNet string
+		wantOk  bool
+		wantErr bool
+	}{
+		{
+			first:   "192.0.2.16",
+			last:    "192.0.2.32",
+			wantNet: "192.0.2.16/28",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first: "128.0.0.0",
+			last: "255.255.255.255",
+			wantNet: "128.0.0.0/1",
+			wantOk: true,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:100::",
+			last:    "2001:db8:101::",
+			wantNet: "2001:db8:100::/48",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:a1:11::",
+			last:    "2001:db8:a1:12::",
+			wantNet: "2001:db8:a1:11::/64",
+			wantOk:  true,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:100::100",
+			last:    "2001:db8:100:0:ffff:ffff:ffff:ffff",
+			wantNet: "2001:db8:100::/64",
+			wantOk:  false,
+			wantErr: false,
+		},
+		{
+			first:   "2001:db8:100::",
+			last:    "192.0.2.30",
+			wantNet: "",
+			wantOk:  true,
+			wantErr: true,
+		},
+		{
+			first:   "192.0.2.30",
+			last:    "2001:db8:100::",
+			wantNet: "",
+			wantOk:  true,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.first+"-"+tt.last, func(t *testing.T) {
+			gotNet, gotOk, err := NetFromInterval(net.ParseIP(tt.first), net.ParseIP(tt.last))
+			if (err != nil) != tt.wantErr {
+				t.Errorf("NetFromInterval() error = %v, wantErr = %v", err, tt.wantErr)
+			}
+
+			if tt.wantNet == "" {
+				return
+			}
+
+			_, wantNetParsed, err := net.ParseCIDR(tt.wantNet)
+			if err != nil {
+				t.Fatalf("NetFromInterval() error parsing test network = %v", err)
+			}
+
+			if tt.wantOk != gotOk {
+				t.Errorf("NetFromInterval() gotOk = %t, wantOk = %t", gotOk, tt.wantOk)
+			}
+
+			if !reflect.DeepEqual(gotNet, wantNetParsed) {
+				t.Errorf("NetFromInterval() gotNet = %+v, wantNet = %+v", gotNet, wantNetParsed)
+			}
+		})
+	}
+}