| 506 | } |
| 507 | |
| 508 | func checkCidrBlacklist(blacklist, endpoint string, log log.Logger) errors.Error { |
| 509 | // only if blacklist is given and the host of the endpoint is an IP address |
| 510 | parsedEp, err := url.Parse(endpoint) |
| 511 | if err != nil { |
| 512 | return ErrInvalidURL |
| 513 | } |
| 514 | endpointHost := parsedEp.Hostname() |
| 515 | if endpointHost == "" { |
| 516 | return ErrInvalidURL |
| 517 | } |
| 518 | endpointIp := net.ParseIP(endpointHost) |
| 519 | if endpointIp != nil { |
| 520 | // check if the IP is in the blacklist |
| 521 | cidrs := strings.Split(blacklist, ",") |
| 522 | for _, cidr := range cidrs { |
| 523 | // CIDR format : 10.0.0.1/24 |
| 524 | // check the net.ParseCIDR for details |
| 525 | cidr = strings.TrimSpace(cidr) |
| 526 | _, ipnet, err := net.ParseCIDR(cidr) |
| 527 | if err != nil { |
| 528 | // the CIDR is invalid |
| 529 | log.Error(err, "Invalid CIDR", "cidr", cidr) |
| 530 | return ErrInvalidCIDR |
| 531 | } |
| 532 | if ipnet.Contains(endpointIp) { |
| 533 | return ErrHostNotAllowed |
| 534 | } |
| 535 | } |
| 536 | } |
| 537 | return nil |
| 538 | } |