/ 
YATT-Lite-0.200
/ YATT::Lite::WebMVC0::Partial::StrictIPMatch

NAME

YATT::Lite::WebMVC0::Partial::StrictIPMatch -- CIDR / IPv6 aware matching for allow_debug_from and trusted_proxies

SYNOPSIS

In app.psgi:

use YATT::Lite::WebMVC0::SiteApp -as_base;
use YATT::Lite::WebMVC0::Partial::StrictIPMatch -as_base;

my MY $site = MY->load_factory_for_psgi(
  $0,
  allow_debug_from => ['10.0.0.0/8', '2001:db8::/32', '::1'],
  trusted_proxies  => ['172.16.0.0/12'],
  ...
);

DESCRIPTION

SiteApp compares the client address with allow_debug_from and trusted_proxies as literal strings, exactly. That is deliberately cheap (no parsing, no extra module at startup, which matters under CGI) but it cannot express a range, and it does not know that ::1, 0:0:0:0:0:0:0:1 and ::ffff:127.0.0.1 are the same host.

This Partial overrides the single hook SiteApp uses to build both matchers, compile_addr_matcher, with real address parsing via Socket's inet_pton (core perl):

  • Entries may be single addresses (10.1.2.3, 2001:db8::1) or CIDR ranges (10.0.0.0/8, 2001:db8::/32, 0.0.0.0/0).

  • IPv6 addresses are compared after normalization, so spelling does not matter.

  • IPv4-mapped IPv6 addresses (::ffff:10.1.2.3, as seen on an IPv6 listening socket) are matched as the IPv4 address.

  • An entry that is not an address or CIDR croaks when the site is configured (Invalid address or CIDR in allow_debug_from: ...), instead of silently never matching.

  • A client address that cannot be parsed never matches.

Nothing else changes: the defaults (127.0.0.1, ::1), the header handling of trusted_proxies and the entity &yatt:is_debug_allowed_ip(); are those of SiteApp.

METHODS

compile_addr_matcher($name, $list)

Returns a predicate sub { $_[0] matches } for the list. $name is the config name, used in error messages.

parse_ip_address($string)

Returns ($packed, $family) for an address string, or an empty list when it is not one. IPv4-mapped IPv6 addresses come back as AF_INET.

SEE ALSO

YATT::Lite::WebMVC0::SiteApp

AUTHOR

"KOBAYASI, Hiroaki" <hkoba@cpan.org>