I’m working on a personal project and I’d like to add a feature where you can deny/allow access based on IP.

I’m not sure that the way I’m thinking about it is good enough.

The user would be able to specify multiple deny and allow ranges as IP[/CIDR] and then I would:

  • Go through all the “deny” ranges and if any of them matches reject access.
  • Go through all the “allow” ranges and if any of them matches permit access.
  • If nothing matches the final decision is taken by a default fallback policy that can be set to allow or deny.

Would this be good enough or are there scenarios that can’t be expressed this way?

PS: fwiw I did have a look at how other projects achieve this. Some let you define ranges and combine them with boolean logic in any manner, pseudo-programatically; that’s a bit too complex for mine. Some let you draw up a list where order matters and the first matching range “wins”; I’m not sure if that’s more capable than my way, and having order matter would complicate things for my code.

Appreciate any help. If you can link me to something that talks about this, that’s good too.

  • frongt@lemmy.zipEnglish
    11·
    6 days ago

    What kind of project? A web app, a network access controller, something else?

    There are probably existing libraries to do this exact thing. You could probably incorporate one to save yourself implementing all the logic.

    One question though, what happens in your two-list example when an address is on both lists?

    • lemmyvore@feddit.nlOPEnglish
      1·
      6 days ago

      It’s a Node app. You’re probably right about existing libraries but I’d like to keep the dependencies minimal. It’s also a good exercise for me.

      what happens in your two-list example when an address is on both lists?

      It would encounter the deny rule first and not reach the allow rule. Basically resolve the conflict in the more restrictive way.

      • frongt@lemmy.zipEnglish
        21·
        6 days ago

        Okay so you’re doing the same ordering as a regular firewall list, just split. How do I block all of 10.0.0.0/8 but allow 10.34.99.0/24?

        • lemmyvore@feddit.nlOPEnglish
          3·
          6 days ago

          Yeah it’s not suitable for all scenarios. I’ll have to consider if I either do ordered rules or give up the thing altogether and leave it to other layers (firewalls, proxies etc.)

          • Pomal@sh.itjust.worksEnglish
            2·
            5 days ago

            You are correct in identifying that trying to make fetch happen won’t work. There’s already a multitude of options for establishing network security native to any OS, or an open project that’s deviated in their own way.

            You could write a wrapper for everything, but unless that’s the intent of your app it may be scope creep.