Module net 

Minimal IP/CIDR support for trusted-proxy and IP-ACL matching (DW-009/DW-020).

The trusted-proxy matcher is part of the CONFIG CONTRACT — validation (snapshot::validate) and every runtime consumer (the dataplane’s forwarded-header rule, authorization’s IP ACLs) must agree on what a well-formed ip/ip/prefix entry is, so the parser and the matcher live here with the schema instead of in any one consumer. No new dependency: std::net parsing plus a shift-compare.

Functions

ip_in_net

Whether ip falls inside net/prefix (same-family only). Public so authorization (DW-020) matches IP ACL entries with the exact DW-009 trusted-proxy semantics.

parse_ip_or_cidr

Parse ip, ip/prefix into (network address, prefix length). Returns None for anything that is not a well-formed IPv4/IPv6 address or CIDR (including prefixes wider than the address family allows).

peer_is_trusted

Whether peer falls inside any configured trusted-proxy entry. Unparseable entries cannot occur in a validated config; they are conservatively treated as non-matching here (validation rejects the whole config before the dataplane ever sees it).