feat: ip filter

charts/k8s-gateway/templates/configmap.yaml

@@ -29,6 +29,9 @@ data:
           {{- if .Values.watchedResources }}
           resources {{ join " " .Values.watchedResources }}
           {{- end }}
+          {{- if .Values.prefixes }}
+          prefixes {{ join " " .Values.prefixes }}
+          {{- end }}
           {{- if .Values.fallthrough.enabled }}
           fallthrough {{- range .Values.fallthrough.zones }} {{ . }} {{- end }}
           {{- end }}

charts/k8s-gateway/values.yaml

@@ -22,6 +22,9 @@ watchedResources: []
 # Service name of a secondary DNS server (should be `serviceName.namespace`)
 secondary: ""
 
+# List of IP CIDRs to filter
+prefixes: []
+
 # Enabled fallthrough for k8s_gateway
 fallthrough:
   enabled: false

gateway.go

@@ -70,6 +70,7 @@ type Gateway struct {
 	secondNS         string
 	configFile       string
 	configContext    string
+	prefixes         []netip.Prefix
 	ExternalAddrFunc func(request.Request) []dns.RR
 
 	Fall fall.F
@@ -176,6 +177,9 @@ func (gw *Gateway) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Ms
 	var ipv6Addrs []netip.Addr
 
 	for _, addr := range addrs {
+		if len(gw.prefixes) > 0 && !matchIpNetPrefix(addr, gw.prefixes) {
+			continue
+		}
 		if addr.Is4() {
 			ipv4Addrs = append(ipv4Addrs, addr)
 		}
@@ -318,3 +322,13 @@ func stripClosingDot(s string) string {
 	}
 	return s
 }
+
+// Returns true if the IP matches at least one of the IP network prefixes
+func matchIpNetPrefix(ip netip.Addr, prefixes []netip.Prefix) bool {
+	for _, prefix := range prefixes {
+		if prefix.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}

setup.go

@@ -2,6 +2,7 @@ package gateway
 
 import (
 	"context"
+	"net/netip"
 
 	"strconv"
 
@@ -104,6 +105,18 @@ func parse(c *caddy.Controller) (*Gateway, error) {
 				if len(args) == 2 {
 					gw.configContext = args[1]
 				}
+			case "prefixes":
+				args := c.RemainingArgs()
+				if len(args) == 0 {
+					return nil, c.ArgErr()
+				}
+				for _, arg := range args {
+					prefix, err := netip.ParsePrefix(arg)
+					if err != nil {
+						return nil, c.Errf("Invalid if prefix: %s", arg)
+					}
+					gw.prefixes = append(gw.prefixes, prefix)
+				}
 			default:
 				return nil, c.Errf("Unknown property '%s'", c.Val())
 			}