Struct IpAllowlist 

pub struct IpAllowlist(/* private fields */);

A set of CIDR ranges (or bare IPs) a credential may be used from.

Empty (the Default/parse(&[]) result) means “no restriction”: Self::allows always returns true. Once non-empty, an unresolved client IP (None) never satisfies the restriction – “unknown” must never be treated as “allowed”.

Implementations

impl IpAllowlist

pub fn parse(entries: &[String]) -> Result<IpAllowlist, Error>

Parses entries (CIDR notation, e.g. "10.0.0.0/8", or a bare IP, e.g. "203.0.113.7") into an IpAllowlist. An empty slice parses to an empty (unrestricted) allowlist. Fails on the first entry that is neither a valid CIDR nor a valid bare IP address.

IpNet::from_str doesn’t accept a bare IP without a prefix, so this falls back to parsing a bare IpAddr and widening it to a /32//128 via IpNet::from.

Also rejects a CIDR whose address has host bits set (e.g. 10.0.0.5/8): ipnet parses it successfully but silently widens the range to the whole /8, which is the opposite of what an operator narrowing an allowlist intends.

pub fn allows(&self, ip: Option<IpAddr>) -> bool

true when ip is permitted by this allowlist: always true when the allowlist is empty (no restriction); otherwise true only when ip is Some and falls within at least one stored network. An unresolved client IP (None) never satisfies a non-empty allowlist.

Trait Implementations

impl Clone for IpAllowlist

fn clone(&self) -> IpAllowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IpAllowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for IpAllowlist

fn default() -> IpAllowlist

The empty, unrestricted allowlist.

impl Eq for IpAllowlist

impl PartialEq for IpAllowlist

fn eq(&self, other: &IpAllowlist) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for IpAllowlist