IP ranges

use ipnet.qweruse ip_in, ip_private from ipnet      // Quillo 0.6: only these

ipnet = "2"

// An admin page open only from the office and the VPN.////   quillo run ipnet.qwe      then open http://localhost:8080/adminuse "ipnet.qwer"let OFFICE = ["127.0.0.1", "::1", "10.20.0.0/16", "2001:db8:42::/48"]fn office_only(req) {    if !ip_in(req.ip, OFFICE)? { reply 403 "From the office only" }    req}route GET /admin = request | office_only | ((r) => { welcome: "admin", from: r.ip })route GET /samples = { vpn: ip_in("10.20.3.4", OFFICE)?, outside: ip_in("8.8.8.8", OFFICE)?, private: ip_private("192.168.1.9")?, v6: ip_version("2001:db8::1")? }

//! IP addresses and ranges (CIDR): allowlists, office-only admin pages, private addresses, IPv4 and IPv6 alike.//! version: 1.0.0//!//! [dependencies]//! ipnet = "2"use ipnet::IpNet;use std::net::IpAddr;fn ip(s: &str) -> Result<IpAddr, String> {    s.trim().parse::<IpAddr>().map_err(|_| format!("`{}` is not an IP address", s))}/// Whether `address` is in any of `ranges` ("10.0.0.0/8", "2001:db8::/32", or a single address).pub fn ip_in(address: &str, ranges: Vec<String>) -> Result<bool, String> {    let a = ip(address)?;    for r in &ranges {        let r = r.trim();        let hit = if r.contains('/') { r.parse::<IpNet>().map_err(|e| format!("`{}`: {}", r, e))?.contains(&a) } else { ip(r)? == a };        if hit {            return Ok(true);        }    }    Ok(false)}/// Whether `address` is private, loopback or link-local: not one from the internet.pub fn ip_private(address: &str) -> Result<bool, String> {    Ok(match ip(address)? {        IpAddr::V4(v) => v.is_private() || v.is_loopback() || v.is_link_local(),        IpAddr::V6(v) => v.is_loopback() || (v.segments()[0] & 0xfe00) == 0xfc00 || (v.segments()[0] & 0xffc0) == 0xfe80            || v.to_ipv4_mapped().is_some_and(|m| m.is_private() || m.is_loopback()),    })}/// 4 or 6.pub fn ip_version(address: &str) -> Result<i64, String> {    Ok(if ip(address)?.is_ipv4() { 4 } else { 6 })}