Struct IpAllowlist 

pub struct IpAllowlist { /* private fields */ }

The addresses a privileged key may be presented from.

There is no “unset” state. An empty allowlist means the key cannot be used at all, which is upstream’s documented behavior for an empty array, and a ServerConfig that never sets the field gets IpAllowlist::default, which is upstream’s default rather than “allow anything”. The type deliberately offers no way to spell “no filter” except by writing the range out.

Implementations

impl IpAllowlist

pub fn parse<I, S>(entries: I) -> Result<Self, InvalidIpEntry>

where I: IntoIterator<Item = S>, S: AsRef<str>,

Read a list of entries, each a bare address, an address/prefix, or one of the five allow-all literals.

pub fn parse_env(value: &str) -> Result<Self, InvalidIpEntry>

The comma-separated spelling an environment variable carries (PARSE_SERVER_MASTER_KEY_IPS).

Neither trimmed nor tolerant of an empty value, because upstream is neither. arrayParser is opt.split(',') and nothing else (Options/parsers.js:42-50), and Config.validateIps then rejects any entry whose address portion is not an IP (Config.js:627-636). So "127.0.0.1, ::1" yields " ::1" and refuses to boot upstream, and so does an empty value, and both refuse to boot here with the offending entry named.

Trimming looked like a harmless courtesy and it is a divergence in what a configuration means: a deployment whose variable boots one server and not the other is worse off than one that is told about the space.

pub fn deny_all() -> Self

The empty array: the key cannot be used from anywhere, including the server itself.

Reachable only from Rust, which is upstream’s situation too: there is no way to pass an empty array through an environment variable, and the option’s help text says so.

pub fn allows(&self, peer: IpAddr) -> bool

Is this peer allowed to present the key?

The family test is isIPv4, which is false for an IPv4-mapped IPv6 address. That is what makes 0.0.0.0/0 refuse a peer of ::ffff:127.0.0.1 upstream, so the mapped form is deliberately not unwrapped here even though the block-list half below treats it as the same address.

pub fn is_deny_all(&self) -> bool

True when no address at all is permitted.

Trait Implementations

impl Clone for IpAllowlist

fn clone(&self) -> IpAllowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IpAllowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for IpAllowlist

fn default() -> Self

['127.0.0.1', '::1']: only the machine the server runs on.

impl Eq for IpAllowlist

impl PartialEq for IpAllowlist

fn eq(&self, other: &IpAllowlist) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for IpAllowlist