cidr-audit
Audit IPv4 CIDR allow/deny rules for overlap, shadowing, and risky network ranges in pure MoonBit
cidr
ipv4
network
audit
security
moon add BeiLaDuo/cidr-audit@0.1.1
Download zipAuthor
Version
0.1.1
License
Apache-2.0
Repository
Last updated
18 days ago
Downloads
4
README#MoonCIDR Audit
MoonCIDR Audit is a pure MoonBit library for auditing ordered IPv4/CIDR allow
and deny rules. It helps gateway, reverse proxy, cloud security group, and
operations configuration authors find rule shadowing, dangerous wide ranges,
non-canonical CIDR input, duplicate rules, and risky special address spaces.
The project is intentionally small in scope: it does not try to be a firewall,
packet filter, or network daemon. It focuses on the reusable analysis layer that
other MoonBit tools can build on.
#Features
- Parse IPv4 addresses and CIDR blocks without external dependencies.
- Normalize CIDR blocks such as 192.168.1.99/24 to 192.168.1.0/24.
- Evaluate ordered allow and deny rules.
- Detect duplicate rules, shadowed rules, conflicting overlaps, redundant overlaps, global deny rules, and very wide allow rules.
- Classify private, loopback, link-local, multicast, unspecified, and broadcast address ranges.
- Provide strict, gateway, and quiet audit policies.
- Produce plain text, Markdown table, and JSON-like reports.
- Explain why a probe IP matches a rule.
- Compare two rule sets and summarize risky changes.
- Produce remediation hints for common findings.
- Merge overlapping or adjacent address ranges and find coverage holes.
- Deduplicate contained CIDRs and recursively aggregate sibling networks.
- Import native rules, Nginx allow/deny directives, and CSV rule lists.
- Apply configurable CI deployment gates to audit reports.
#Quick Start
Run the main demo:
moon run ./cmd/mainRun example scenarios:
moon run ./examples/gateway
moon run ./examples/cloudThe main demo now walks through auditing, probe decisions, detailed
explanations, a release gate, coverage holes, CIDR aggregation, and Nginx
configuration import.
Run checks:
moon check
moon build
moon test#Basic Usage
let ruleset = @cidr.parse_rules([
"allow 10.0.0.0/8 internal network",
"deny 10.1.2.0/24 blocked subnet",
"allow 192.168.1.99/24 host bits will be normalized",
"deny 0.0.0.0/0 default deny",
])
let report = ruleset.audit()
println(report.text_report())
let ip = @cidr.IPv4::parse("10.1.2.9").unwrap()
println(ruleset.decide(ip).summary())#Example Findings
MoonCIDR Audit can report findings like:
[critical] too_wide_allow R1: allow rule covers a very wide network: 10.0.0.0/8
[critical] shadowed_rule R2 related=R1: rule is already covered by earlier allow rule R1
[info] non_canonical_cidr R3: input 192.168.1.99/24 was normalized to 192.168.1.0/24
[critical] global_deny R4: deny rule blocks the entire IPv4 space#API Overview
Important types:
- IPv4: parsed IPv4 address stored as UInt.
- CidrBlock: normalized IPv4 CIDR block.
- RuleAction: Allow or Deny.
- Rule: ordered rule with id, action, block, source block, and note.
- RuleSet: parsed rule collection with decision and audit helpers.
- AuditPolicy: strict, gateway, and quiet policy presets.
- AuditReport: findings, severity counts, risk score, and report rendering.
- DiffReport: change report between two rule sets.
- FixHint: remediation suggestion generated from an audit finding.
- AddressRange: closed IPv4 interval used by coverage analysis.
- AggregationReport: CIDR deduplication and sibling merge result.
- ImportReport: structured native, Nginx, or CSV import result.
- GatePolicy and GateResult: configurable CI release decision.
Common functions:
- IPv4::parse
- CidrBlock::parse
- Rule::parse
- parse_rules
- RuleSet::audit
- RuleSet::audit_with_policy
- RuleSet::decide
- RuleSet::explain_ip
- RuleSet::diff_from
- RuleSet::coverage_ranges
- RuleSet::coverage_report
- aggregate_cidr_strings
- import_nginx_access
- import_csv_rules
- AuditReport::evaluate_gate
- AuditReport::text_report
- AuditReport::json_report
- AuditReport::hint_report
#Project Boundary
MoonCIDR Audit currently focuses on IPv4 and ordered CIDR rules. It does not
implement IPv6, kernel integration, packet capture, live network access, or
cloud-provider credentials. Its importers are intentionally offline and
limited to reviewable text formats. Provider-specific adapters can be added
later without changing the core audit model.
#Hackathon Value
MoonBit already has examples and packages around networking, URLs, sockets, and
general parsing. MoonCIDR Audit targets a different gap: auditing network rule
sets before they are deployed. This is useful for configuration review, CI
checks, teaching network rule behavior, and building safer MoonBit developer
tools.
#Submission Materials
- One-page application: docs/submission-application-one-page.md
- Full application notes: docs/submission-application.md
- PDF application copy: docs/submission-application.pdf
- Novelty review: docs/novelty-review.md
- Submission checklist: docs/submission-checklist.md
#License
Apache-2.0.
#AddressRange
A closed IPv4 address interval.
source_count records how many original intervals contributed to this
range after union operations. It is useful when explaining why a range was
produced, but does not change equality or containment semantics.
#AddressRange::address_count_label
#AddressRange::contains_ip
#AddressRange::contains_range
#AddressRange::merge
#AddressRange::new
fn AddressRange::new(first : IPv4, last : IPv4, source_count? : Int) -> Result[AddressRange, String]#AddressRange::overlaps
#AddressRange::touches
#AggregationReport
Result of normalizing, deduplicating, and aggregating CIDR blocks.
#AggregationReport::blocks
#AggregationReport::contained_count
#AggregationReport::duplicate_count
#AggregationReport::errors
#AggregationReport::input_count
#AggregationReport::merged_pair_count
#AggregationReport::output_count
#AggregationReport::reduction_count
#AggregationReport::text_report
#AggregationReport::valid_count
#AuditPolicy
Controls how noisy or strict CIDR audits should be.
#AuditPolicy::flag_non_canonical
#AuditPolicy::flag_redundant_overlap
#AuditPolicy::flag_special_ranges
#AuditReport
#AuditReport::count_hint_kind
#AuditReport::count_kind
#AuditReport::count_severity
#AuditReport::evaluate_gate
#AuditReport::json_report
Builds a stable JSON-like report without external dependencies.
#AuditReport::recommended_action
#AuditReport::text_report
Builds a compact human-readable audit report.
#CidrBlock
A normalized IPv4 CIDR block.
#CidrBlock::contains_block
#CidrBlock::new_unchecked
#CoverageStats
Aggregate facts about a rule set.
#CoverageStats::narrowest_prefix
#Decision
pub struct Decision {
matched : Bool
action : RuleAction
rule_id : String
block : String
} derive(Eq, Debug)#DiffReport
#DiffReport::count_kind
#Finding
pub struct Finding {
kind : FindingKind
severity : Severity
rule_id : String
related_rule_id : String
message : String
} derive(Eq, Debug)#Finding::new
fn Finding::new(kind : FindingKind, severity : Severity, rule_id : String, message : String, related_rule_id? : String) -> Finding#FindingKind
Classifies why a rule deserves attention.
#FixHint
#FixHint::new
#GatePolicy
Thresholds used to decide whether a rule set may pass a CI or release gate.
#GatePolicy::development
Development policy: blocks only very risky reports and parse failures.
#GatePolicy::new
fn GatePolicy::new(name : String, max_critical : Int, max_warning : Int, max_risk_score : Int, allow_parse_errors? : Bool) -> Result[GatePolicy, String]#GatePolicy::release
Strict release policy: no critical findings, warnings, or parse errors.
#GatePolicy::review
Review policy: allows a small warning budget but no critical findings.
#GateReason
#GateReason::new
#GateResult
pub struct GateResult {
policy : GatePolicy
passed : Bool
risk_score : Int
reasons : Array[GateReason]
} derive(Debug)#HintKind
#IPv4
A parsed IPv4 address stored as an unsigned 32-bit integer.
#IPv4::is_public
Returns true when the address is not one of the private or special scopes
currently recognized by this package.
#ImportFormat
Input syntax understood by the configuration import layer.
#ImportIssue
pub struct ImportIssue {
line : Int
level : ImportIssueLevel
code : String
message : String
input : String
} derive(Eq, Debug)#ImportIssue::new
fn ImportIssue::new(line : Int, level : ImportIssueLevel, code : String, message : String, input : String) -> ImportIssue#ImportIssueLevel
#ImportReport
pub struct ImportReport {
format : ImportFormat
source_count : Int
rules : Array[Rule]
issues : Array[ImportIssue]
} derive(Debug)#Rule
pub struct Rule {
id : String
action : RuleAction
block : CidrBlock
source_block : String
note : String
} derive(Eq, Debug)A single ordered firewall, proxy, or gateway rule.
#Rule::new
fn Rule::new(id : String, action : RuleAction, block : CidrBlock, source_block? : String, note? : String) -> Rule#RuleAction
Action taken when a CIDR rule matches.
#RuleChange
pub struct RuleChange {
kind : RuleChangeKind
before_id : String
after_id : String
block : String
message : String
} derive(Eq, Debug)A change item matched by CIDR range.
#RuleChange::new
fn RuleChange::new(kind : RuleChangeKind, before_id : String, after_id : String, block : String, message : String) -> RuleChange#RuleChangeKind
Type of change between two rule sets.
#RuleSet
#RuleSet::audit_with_policy
#RuleSet::coverage_ranges
Returns the union of all rule blocks with the requested action.
This is a structural view. Ordered first-match behavior is intentionally
handled separately by RuleSet::decide.
#RuleSet::coverage_report
#RuleSet::evaluate_gate
fn RuleSet::evaluate_gate(self : RuleSet, audit_policy : AuditPolicy, gate_policy : GatePolicy) -> GateResult#RuleSet::explain_many
#RuleSet::first_rule_for_block
#Severity
#aggregate_blocks
Aggregates already parsed CIDR blocks.
#aggregate_cidr_strings
Parses and aggregates a list of CIDR strings.
Invalid entries are preserved in errors rather than aborting the whole
operation, making the API suitable for configuration linting.
#audit_rules_with_policy
#clip_ranges_to_block
Clips address ranges to a target CIDR and returns a merged union.
#import_csv_rules
Imports rows in action,cidr,note form.
A header row is optional. Quoted fields, embedded commas, and doubled quote
escapes are supported. Extra columns are folded into the note and reported
as a warning so information is not silently discarded.
#import_nginx_access
Imports Nginx access directives such as allow 10.0.0.0/8;.
deny all; and allow all; are converted to 0.0.0.0/0. Other Nginx
directives are rejected so accidental input from an unrelated section is
visible to the caller.
#import_plain_rules
Imports the native compact syntax: allow 10.0.0.0/8 note.
#merge_address_ranges
Sorts and merges overlapping or adjacent address ranges.
#ranges_from_blocks
Converts CIDR blocks into a sorted, non-overlapping union of address ranges.
#uncovered_ranges
Finds holes inside target that are not covered by any supplied range.
Audit IPv4 CIDR allow/deny rules for overlap, shadowing, and risky network ranges in pure MoonBit
cidripv4networkauditsecurity
0.1.1
Apache-2.0
Updated 18 days ago
4 downloads