🥮 mooncakes.io

    cidr-audit

    Audit IPv4 CIDR allow/deny rules for overlap, shadowing, and risky network ranges in pure MoonBit

    cidr
    ipv4
    network
    audit
    security
    Download zip
    Author
    Version
    0.1.2
    License
    Apache-2.0
    Repository
    Last updated
    21 days ago
    Downloads
    17

    #MoonCIDR Audit

    MoonCIDR Audit is a pure MoonBit library for auditing ordered IPv4/CIDR allow and deny rules. It helps gateway, reverse proxy, cloud security group, and operations configuration authors find rule shadowing, dangerous wide ranges, non-canonical CIDR input, duplicate rules, and risky special address spaces.

    The project is intentionally small in scope: it does not try to be a firewall, packet filter, or network daemon. It focuses on the reusable analysis layer that other MoonBit tools can build on.

    #Features

    • Parse IPv4 addresses and CIDR blocks without external dependencies.
    • Normalize CIDR blocks such as 192.168.1.99/24 to 192.168.1.0/24.
    • Evaluate ordered allow and deny rules.
    • Detect duplicate rules, shadowed rules, conflicting overlaps, redundant overlaps, global deny rules, and very wide allow rules.
    • Classify private, loopback, link-local, multicast, unspecified, and broadcast address ranges.
    • Provide strict, gateway, and quiet audit policies.
    • Produce plain text, Markdown table, and JSON-like reports.
    • Explain why a probe IP matches a rule.
    • Compare two rule sets and summarize risky changes.
    • Produce remediation hints for common findings.
    • Merge overlapping or adjacent address ranges and find coverage holes.
    • Deduplicate contained CIDRs and recursively aggregate sibling networks.
    • Import native rules, Nginx allow/deny directives, and CSV rule lists.
    • Apply configurable CI deployment gates to audit reports.

    #Quick Start

    Run the main demo:

    moon run ./cmd/main

    Run example scenarios:

    moon run ./examples/gateway
moon run ./examples/cloud

    The main demo now walks through auditing, probe decisions, detailed explanations, a release gate, coverage holes, CIDR aggregation, and Nginx configuration import.

    Run checks:

    moon check
moon build --target all
moon test --target all --deny-warn

    #Basic Usage

    let ruleset = @cidr.parse_rules([
      "allow 10.0.0.0/8 internal network",
      "deny 10.1.2.0/24 blocked subnet",
      "allow 192.168.1.99/24 host bits will be normalized",
      "deny 0.0.0.0/0 default deny",
    ])

    let report = ruleset.audit()
    println(report.text_report())

    let ip = @cidr.IPv4::parse("10.1.2.9").unwrap()
    println(ruleset.decide(ip).summary())

    #Example Findings

    MoonCIDR Audit can report findings like:

    [critical] too_wide_allow R1: allow rule covers a very wide network: 10.0.0.0/8
[critical] shadowed_rule R2 related=R1: rule is already covered by earlier allow rule R1
[info] non_canonical_cidr R3: input 192.168.1.99/24 was normalized to 192.168.1.0/24
[critical] global_deny R4: deny rule blocks the entire IPv4 space

    #API Overview

    Important types:

    • IPv4: parsed IPv4 address stored as UInt.
    • CidrBlock: normalized IPv4 CIDR block.
    • RuleAction: Allow or Deny.
    • Rule: ordered rule with id, action, block, source block, and note.
    • RuleSet: parsed rule collection with decision and audit helpers.
    • AuditPolicy: strict, gateway, and quiet policy presets.
    • AuditReport: findings, severity counts, risk score, and report rendering.
    • DiffReport: change report between two rule sets.
    • FixHint: remediation suggestion generated from an audit finding.
    • AddressRange: closed IPv4 interval used by coverage analysis.
    • AggregationReport: CIDR deduplication and sibling merge result.
    • ImportReport: structured native, Nginx, or CSV import result.
    • GatePolicy and GateResult: configurable CI release decision.

    Common functions:

    • IPv4::parse
    • CidrBlock::parse
    • Rule::parse
    • parse_rules
    • RuleSet::audit
    • RuleSet::audit_with_policy
    • RuleSet::decide
    • RuleSet::explain_ip
    • RuleSet::diff_from
    • RuleSet::coverage_ranges
    • RuleSet::coverage_report
    • aggregate_cidr_strings
    • import_nginx_access
    • import_csv_rules
    • AuditReport::evaluate_gate
    • AuditReport::text_report
    • AuditReport::json_report
    • AuditReport::hint_report

    #Project Boundary

    MoonCIDR Audit currently focuses on IPv4 and ordered CIDR rules. It does not implement IPv6, kernel integration, packet capture, live network access, or cloud-provider credentials. Its importers are intentionally offline and limited to reviewable text formats. Provider-specific adapters can be added later without changing the core audit model.

    #Hackathon Value

    MoonBit already has examples and packages around networking, URLs, sockets, and general parsing. MoonCIDR Audit targets a different gap: auditing network rule sets before they are deployed. This is useful for configuration review, CI checks, teaching network rule behavior, and building safer MoonBit developer tools.

    #Submission Materials

    • One-page application: docs/submission-application-one-page.md
    • Full application notes: docs/submission-application.md
    • PDF application copy: docs/submission-application.pdf
    • Novelty review: docs/novelty-review.md
    • Submission checklist: docs/submission-checklist.md

    #License

    Apache-2.0.

    AddressRange

    source
    pub struct AddressRange {
      first : IPv4
      last : IPv4
      source_count : Int
    } derive(Eq, 
    Debug    )

    A closed IPv4 address interval.

    source_count records how many original intervals contributed to this range after union operations. It is useful when explaining why a range was produced, but does not change equality or containment semantics.

    AddressRange::address_count_label

    source
    fn AddressRange::address_count_label(self : AddressRange) -> String

    AddressRange::contains_ip

    source
    fn AddressRange::contains_ip(self : AddressRange, ip : IPv4) -> Bool

    AddressRange::contains_range

    source
    fn AddressRange::contains_range(self : AddressRange, other : AddressRange) -> Bool

    AddressRange::first

    source
    fn AddressRange::first(self : AddressRange) -> IPv4

    AddressRange::from_block

    source
    fn AddressRange::from_block(block : CidrBlock) -> AddressRange

    AddressRange::last

    source
    fn AddressRange::last(self : AddressRange) -> IPv4

    AddressRange::merge

    source
    fn AddressRange::merge(self : AddressRange, other : AddressRange) -> Result[AddressRange, String]

    AddressRange::new

    source
    fn AddressRange::new(first : IPv4, last : IPv4, source_count? : Int) -> Result[AddressRange, String]

    AddressRange::overlaps

    source
    fn AddressRange::overlaps(self : AddressRange, other : AddressRange) -> Bool

    AddressRange::source_count

    source
    fn AddressRange::source_count(self : AddressRange) -> Int

    AddressRange::summary

    source
    fn AddressRange::summary(self : AddressRange) -> String

    AddressRange::to_string

    source
    fn AddressRange::to_string(self : AddressRange) -> String

    AddressRange::touches

    source
    fn AddressRange::touches(self : AddressRange, other : AddressRange) -> Bool

    AggregationReport

    source
    pub struct AggregationReport {
      input_count : Int
      valid_count : Int
      duplicate_count : Int
      contained_count : Int
      merged_pair_count : Int
      blocks : Array[CidrBlock]
      errors : Array[String]
    } derive(
    Debug    )

    Result of normalizing, deduplicating, and aggregating CIDR blocks.

    AggregationReport::blocks

    source

    AggregationReport::changed

    source
    fn AggregationReport::changed(self : AggregationReport) -> Bool

    AggregationReport::contained_count

    source
    fn AggregationReport::contained_count(self : AggregationReport) -> Int

    AggregationReport::duplicate_count

    source
    fn AggregationReport::duplicate_count(self : AggregationReport) -> Int

    AggregationReport::errors

    source
    fn AggregationReport::errors(self : AggregationReport) -> Array[String]

    AggregationReport::input_count

    source
    fn AggregationReport::input_count(self : AggregationReport) -> Int

    AggregationReport::merged_pair_count

    source
    fn AggregationReport::merged_pair_count(self : AggregationReport) -> Int

    AggregationReport::output_count

    source
    fn AggregationReport::output_count(self : AggregationReport) -> Int

    AggregationReport::reduction_count

    source
    fn AggregationReport::reduction_count(self : AggregationReport) -> Int

    AggregationReport::summary

    source
    fn AggregationReport::summary(self : AggregationReport) -> String

    AggregationReport::text_report

    source
    fn AggregationReport::text_report(self : AggregationReport) -> String

    AggregationReport::valid_count

    source
    fn AggregationReport::valid_count(self : AggregationReport) -> Int

    AuditPolicy

    source
    pub struct AuditPolicy {
      wide_allow_prefix : Int
      flag_private : Bool
      flag_special_ranges : Bool
      flag_non_canonical : Bool
      flag_redundant_overlap : Bool
    } derive(Eq, 
    Debug    )

    Controls how noisy or strict CIDR audits should be.

    AuditPolicy::flag_non_canonical

    source
    fn AuditPolicy::flag_non_canonical(self : AuditPolicy) -> Bool

    AuditPolicy::flag_private

    source
    fn AuditPolicy::flag_private(self : AuditPolicy) -> Bool

    AuditPolicy::flag_redundant_overlap

    source
    fn AuditPolicy::flag_redundant_overlap(self : AuditPolicy) -> Bool

    AuditPolicy::flag_special_ranges

    source
    fn AuditPolicy::flag_special_ranges(self : AuditPolicy) -> Bool

    AuditPolicy::gateway

    source
    fn AuditPolicy::gateway() -> AuditPolicy

    AuditPolicy::quiet

    source
    fn AuditPolicy::quiet() -> AuditPolicy

    AuditPolicy::strict

    source
    fn AuditPolicy::strict() -> AuditPolicy

    AuditPolicy::wide_allow_prefix

    source
    fn AuditPolicy::wide_allow_prefix(self : AuditPolicy) -> Int

    AuditReport

    source
    pub struct AuditReport {
      rules : Array[Rule]
      findings : Array[Finding]
      parse_errors : Array[String]
    } derive(
    Debug    )

    AuditReport::count_hint_kind

    source
    fn AuditReport::count_hint_kind(self : AuditReport, kind : HintKind) -> Int

    AuditReport::count_kind

    source
    fn AuditReport::count_kind(self : AuditReport, kind : FindingKind) -> Int

    AuditReport::count_severity

    source
    fn AuditReport::count_severity(self : AuditReport, severity : Severity) -> Int

    AuditReport::critical_count

    source
    fn AuditReport::critical_count(self : AuditReport) -> Int

    AuditReport::evaluate_gate

    source
    fn AuditReport::evaluate_gate(self : AuditReport, policy : GatePolicy) -> GateResult

    AuditReport::finding_count

    source
    fn AuditReport::finding_count(self : AuditReport) -> Int

    AuditReport::findings

    source
    fn AuditReport::findings(self : AuditReport) -> Array[Finding]

    AuditReport::fix_hints

    source
    fn AuditReport::fix_hints(self : AuditReport) -> Array[FixHint]

    AuditReport::hint_report

    source
    fn AuditReport::hint_report(self : AuditReport) -> String

    AuditReport::info_count

    source
    fn AuditReport::info_count(self : AuditReport) -> Int

    AuditReport::json_report

    source
    fn AuditReport::json_report(self : AuditReport) -> String

    Builds a stable JSON-like report without external dependencies.

    AuditReport::parse_errors

    source
    fn AuditReport::parse_errors(self : AuditReport) -> Array[String]

    AuditReport::recommended_action

    source
    fn AuditReport::recommended_action(self : AuditReport) -> String

    AuditReport::risk_level

    source
    fn AuditReport::risk_level(self : AuditReport) -> String

    AuditReport::risk_score

    source
    fn AuditReport::risk_score(self : AuditReport) -> Int

    AuditReport::rules

    source
    fn AuditReport::rules(self : AuditReport) -> Array[Rule]

    AuditReport::summary_table

    source
    fn AuditReport::summary_table(self : AuditReport) -> String

    AuditReport::text_report

    source
    fn AuditReport::text_report(self : AuditReport) -> String

    Builds a compact human-readable audit report.

    AuditReport::warning_count

    source
    fn AuditReport::warning_count(self : AuditReport) -> Int

    CidrBlock

    source
    pub struct CidrBlock {
      network : IPv4
      prefix : Int
    } derive(Eq, 
    Debug    )

    A normalized IPv4 CIDR block.

    CidrBlock::broadcast

    source
    fn CidrBlock::broadcast(self : CidrBlock) -> IPv4

    CidrBlock::contains_block

    source
    fn CidrBlock::contains_block(self : CidrBlock, other : CidrBlock) -> Bool

    CidrBlock::contains_ip

    source
    fn CidrBlock::contains_ip(self : CidrBlock, ip : IPv4) -> Bool

    CidrBlock::equal_range

    source
    fn CidrBlock::equal_range(self : CidrBlock, other : CidrBlock) -> Bool

    CidrBlock::has_host_bits

    source
    fn CidrBlock::has_host_bits(input : String) -> Bool

    CidrBlock::network

    source
    fn CidrBlock::network(self : CidrBlock) -> IPv4

    CidrBlock::new

    source
    fn CidrBlock::new(address : IPv4, prefix : Int) -> Result[CidrBlock, String]

    CidrBlock::new_unchecked

    source
    fn CidrBlock::new_unchecked(network : IPv4, prefix : Int) -> CidrBlock

    CidrBlock::overlaps

    source
    fn CidrBlock::overlaps(self : CidrBlock, other : CidrBlock) -> Bool

    CidrBlock::parse

    source
    fn CidrBlock::parse(input : String) -> Result[CidrBlock, String]

    CidrBlock::parse_raw

    source
    fn CidrBlock::parse_raw(input : String) -> Result[(IPv4, Int), String]

    CidrBlock::prefix

    source
    fn CidrBlock::prefix(self : CidrBlock) -> Int

    CidrBlock::size_label

    source
    fn CidrBlock::size_label(self : CidrBlock) -> String

    CidrBlock::to_string

    source
    fn CidrBlock::to_string(self : CidrBlock) -> String

    CoverageStats

    source
    pub struct CoverageStats {
      total_rules : Int
      allow_rules : Int
      deny_rules : Int
      private_rules : Int
      public_rules : Int
      special_rules : Int
      widest_prefix : Int
      narrowest_prefix : Int
    } derive(Eq, 
    Debug    )

    Aggregate facts about a rule set.

    CoverageStats::allow_rules

    source
    fn CoverageStats::allow_rules(self : CoverageStats) -> Int

    CoverageStats::deny_rules

    source
    fn CoverageStats::deny_rules(self : CoverageStats) -> Int

    CoverageStats::narrowest_prefix

    source
    fn CoverageStats::narrowest_prefix(self : CoverageStats) -> Int

    CoverageStats::private_rules

    source
    fn CoverageStats::private_rules(self : CoverageStats) -> Int

    CoverageStats::public_rules

    source
    fn CoverageStats::public_rules(self : CoverageStats) -> Int

    CoverageStats::special_rules

    source
    fn CoverageStats::special_rules(self : CoverageStats) -> Int

    CoverageStats::summary

    source
    fn CoverageStats::summary(self : CoverageStats) -> String

    CoverageStats::total_rules

    source
    fn CoverageStats::total_rules(self : CoverageStats) -> Int

    CoverageStats::widest_prefix

    source
    fn CoverageStats::widest_prefix(self : CoverageStats) -> Int

    Decision

    source
    pub struct Decision {
      matched : Bool
      action : RuleAction
      rule_id : String
      block : String
    } derive(Eq, 
    Debug    )

    Decision::action

    source
    fn Decision::action(self : Decision) -> RuleAction

    Decision::block

    source
    fn Decision::block(self : Decision) -> String

    Decision::matched

    source
    fn Decision::matched(self : Decision) -> Bool

    Decision::rule_id

    source
    fn Decision::rule_id(self : Decision) -> String

    Decision::summary

    source
    fn Decision::summary(self : Decision) -> String

    DiffReport

    source
    pub struct DiffReport {
      changes : Array[RuleChange]
    } derive(
    Debug    )

    DiffReport::change_count

    source
    fn DiffReport::change_count(self : DiffReport) -> Int

    DiffReport::changes

    source
    fn DiffReport::changes(self : DiffReport) -> Array[RuleChange]

    DiffReport::count_kind

    source
    fn DiffReport::count_kind(self : DiffReport, kind : RuleChangeKind) -> Int

    DiffReport::is_empty

    source
    fn DiffReport::is_empty(self : DiffReport) -> Bool

    DiffReport::risk_level

    source
    fn DiffReport::risk_level(self : DiffReport) -> String

    DiffReport::risky_count

    source
    fn DiffReport::risky_count(self : DiffReport) -> Int

    DiffReport::text_report

    source
    fn DiffReport::text_report(self : DiffReport) -> String

    Finding

    source
    pub struct Finding {
      kind : FindingKind
      severity : Severity
      rule_id : String
      related_rule_id : String
      message : String
    } derive(Eq, 
    Debug    )

    Finding::kind

    source
    fn Finding::kind(self : Finding) -> FindingKind

    Finding::message

    source
    fn Finding::message(self : Finding) -> String

    Finding::new

    source
    fn Finding::new(kind : FindingKind, severity : Severity, rule_id : String, message : String, related_rule_id? : String) -> Finding

    Finding::related_rule_id

    source
    fn Finding::related_rule_id(self : Finding) -> String

    Finding::rule_id

    source
    fn Finding::rule_id(self : Finding) -> String

    Finding::severity

    source
    fn Finding::severity(self : Finding) -> Severity

    FindingKind

    source
    pub(all) enum FindingKind {
      DuplicateRule
      ShadowedRule
      ConflictingOverlap
      RedundantOverlap
      TooWideAllow
      GlobalDeny
      PrivateRange
      LoopbackRange
      LinkLocalRange
      MulticastRange
      NonCanonicalCidr
      ParseError
    } derive(Eq, 
    Debug    )

    Classifies why a rule deserves attention.

    FindingKind::label

    source
    fn FindingKind::label(self : FindingKind) -> String

    FixHint

    source
    pub struct FixHint {
      kind : HintKind
      severity : Severity
      rule_id : String
      text : String
    } derive(Eq, 
    Debug    )

    FixHint::kind

    source
    fn FixHint::kind(self : FixHint) -> HintKind

    FixHint::new

    source
    fn FixHint::new(kind : HintKind, severity : Severity, rule_id : String, text : String) -> FixHint

    FixHint::rule_id

    source
    fn FixHint::rule_id(self : FixHint) -> String

    FixHint::severity

    source
    fn FixHint::severity(self : FixHint) -> Severity

    FixHint::summary

    source
    fn FixHint::summary(self : FixHint) -> String

    FixHint::text

    source
    fn FixHint::text(self : FixHint) -> String

    GatePolicy

    source
    pub struct GatePolicy {
      name : String
      max_critical : Int
      max_warning : Int
      max_risk_score : Int
      allow_parse_errors : Bool
    } derive(Eq, 
    Debug    )

    Thresholds used to decide whether a rule set may pass a CI or release gate.

    GatePolicy::allow_parse_errors

    source
    fn GatePolicy::allow_parse_errors(self : GatePolicy) -> Bool

    GatePolicy::development

    source
    fn GatePolicy::development() -> GatePolicy

    Development policy: blocks only very risky reports and parse failures.

    GatePolicy::max_critical

    source
    fn GatePolicy::max_critical(self : GatePolicy) -> Int

    GatePolicy::max_risk_score

    source
    fn GatePolicy::max_risk_score(self : GatePolicy) -> Int

    GatePolicy::max_warning

    source
    fn GatePolicy::max_warning(self : GatePolicy) -> Int

    GatePolicy::name

    source
    fn GatePolicy::name(self : GatePolicy) -> String

    GatePolicy::new

    source
    fn GatePolicy::new(name : String, max_critical : Int, max_warning : Int, max_risk_score : Int, allow_parse_errors? : Bool) -> Result[GatePolicy, String]

    GatePolicy::release

    source
    fn GatePolicy::release() -> GatePolicy

    Strict release policy: no critical findings, warnings, or parse errors.

    GatePolicy::review

    source
    fn GatePolicy::review() -> GatePolicy

    Review policy: allows a small warning budget but no critical findings.

    GatePolicy::summary

    source
    fn GatePolicy::summary(self : GatePolicy) -> String

    GateReason

    source
    pub struct GateReason {
      code : String
      actual : Int
      limit : Int
      message : String
    } derive(Eq, 
    Debug    )

    GateReason::actual

    source
    fn GateReason::actual(self : GateReason) -> Int

    GateReason::code

    source
    fn GateReason::code(self : GateReason) -> String

    GateReason::limit

    source
    fn GateReason::limit(self : GateReason) -> Int

    GateReason::message

    source
    fn GateReason::message(self : GateReason) -> String

    GateReason::new

    source
    fn GateReason::new(code : String, actual : Int, limit : Int, message : String) -> GateReason

    GateReason::summary

    source
    fn GateReason::summary(self : GateReason) -> String

    GateResult

    source
    pub struct GateResult {
      policy : GatePolicy
      passed : Bool
      risk_score : Int
      reasons : Array[GateReason]
    } derive(
    Debug    )

    GateResult::decision

    source
    fn GateResult::decision(self : GateResult) -> String

    GateResult::has_reason

    source
    fn GateResult::has_reason(self : GateResult, code : String) -> Bool

    GateResult::passed

    source
    fn GateResult::passed(self : GateResult) -> Bool

    GateResult::policy

    source
    fn GateResult::policy(self : GateResult) -> GatePolicy

    GateResult::reason_count

    source
    fn GateResult::reason_count(self : GateResult) -> Int

    GateResult::reasons

    source
    fn GateResult::reasons(self : GateResult) -> Array[GateReason]

    GateResult::risk_score

    source
    fn GateResult::risk_score(self : GateResult) -> Int

    GateResult::text_report

    source
    fn GateResult::text_report(self : GateResult) -> String

    HintKind

    source
    pub(all) enum HintKind {
      MoveSpecificRule
      TightenCidr
      ConfirmDefaultPolicy
      CanonicalizeInput
      RemoveDuplicate
      ReviewSpecialScope
      FixSyntax
      ReviewOverlap
    } derive(Eq, 
    Debug    )

    Category of remediation hint produced from audit findings.

    HintKind::label

    source
    fn HintKind::label(self : HintKind) -> String

    IPv4

    source
    pub struct IPv4 {
      value : UInt
    } derive(Eq, 
    Debug    )

    A parsed IPv4 address stored as an unsigned 32-bit integer.

    IPv4::is_limited_broadcast

    source
    fn IPv4::is_limited_broadcast(self : IPv4) -> Bool

    fn IPv4::is_link_local(self : IPv4) -> Bool

    IPv4::is_loopback

    source
    fn IPv4::is_loopback(self : IPv4) -> Bool

    IPv4::is_multicast

    source
    fn IPv4::is_multicast(self : IPv4) -> Bool

    IPv4::is_private

    source
    fn IPv4::is_private(self : IPv4) -> Bool

    IPv4::is_public

    source
    fn IPv4::is_public(self : IPv4) -> Bool

    Returns true when the address is not one of the private or special scopes currently recognized by this package.

    IPv4::is_unspecified

    source
    fn IPv4::is_unspecified(self : IPv4) -> Bool

    IPv4::new

    source
    fn IPv4::new(value : UInt) -> IPv4

    IPv4::parse

    source
    fn IPv4::parse(input : String) -> Result[IPv4, String]

    IPv4::scope_label

    source
    fn IPv4::scope_label(self : IPv4) -> String

    IPv4::to_dotted

    source
    fn IPv4::to_dotted(self : IPv4) -> String

    IPv4::value

    source
    fn IPv4::value(self : IPv4) -> UInt

    ImportFormat

    source
    pub(all) enum ImportFormat {
      PlainRules
      NginxAccess
      CsvRules
    } derive(Eq, 
    Debug    )

    Input syntax understood by the configuration import layer.

    ImportFormat::label

    source
    fn ImportFormat::label(self : ImportFormat) -> String

    ImportIssue

    source
    pub struct ImportIssue {
      line : Int
      level : ImportIssueLevel
      code : String
      message : String
      input : String
    } derive(Eq, 
    Debug    )

    ImportIssue::code

    source
    fn ImportIssue::code(self : ImportIssue) -> String

    ImportIssue::input

    source
    fn ImportIssue::input(self : ImportIssue) -> String

    ImportIssue::level

    source

    ImportIssue::line

    source
    fn ImportIssue::line(self : ImportIssue) -> Int

    ImportIssue::message

    source
    fn ImportIssue::message(self : ImportIssue) -> String

    ImportIssue::new

    source
    fn ImportIssue::new(line : Int, level : ImportIssueLevel, code : String, message : String, input : String) -> ImportIssue

    ImportIssue::summary

    source
    fn ImportIssue::summary(self : ImportIssue) -> String

    ImportIssueLevel

    source
    pub(all) enum ImportIssueLevel {
      ImportWarning
      ImportError
    } derive(Eq, 
    Debug    )

    ImportIssueLevel::label

    source
    fn ImportIssueLevel::label(self : ImportIssueLevel) -> String

    ImportReport

    source
    pub struct ImportReport {
      format : ImportFormat
      source_count : Int
      rules : Array[Rule]
      issues : Array[ImportIssue]
    } derive(
    Debug    )

    ImportReport::accepted_count

    source
    fn ImportReport::accepted_count(self : ImportReport) -> Int

    ImportReport::can_audit

    source
    fn ImportReport::can_audit(self : ImportReport) -> Bool

    ImportReport::error_count

    source
    fn ImportReport::error_count(self : ImportReport) -> Int

    ImportReport::format

    source
    fn ImportReport::format(self : ImportReport) -> ImportFormat

    ImportReport::is_clean

    source
    fn ImportReport::is_clean(self : ImportReport) -> Bool

    ImportReport::issues

    source

    ImportReport::rules

    source
    fn ImportReport::rules(self : ImportReport) -> Array[Rule]

    ImportReport::source_count

    source
    fn ImportReport::source_count(self : ImportReport) -> Int

    ImportReport::summary

    source
    fn ImportReport::summary(self : ImportReport) -> String

    ImportReport::text_report

    source
    fn ImportReport::text_report(self : ImportReport) -> String

    ImportReport::to_ruleset

    source
    fn ImportReport::to_ruleset(self : ImportReport) -> RuleSet

    ImportReport::warning_count

    source
    fn ImportReport::warning_count(self : ImportReport) -> Int

    Rule

    source
    pub struct Rule {
      id : String
      action : RuleAction
      block : CidrBlock
      source_block : String
      note : String
    } derive(Eq, 
    Debug    )

    A single ordered firewall, proxy, or gateway rule.

    Rule::action

    source
    fn Rule::action(self : Rule) -> RuleAction

    Rule::block

    source
    fn Rule::block(self : Rule) -> CidrBlock

    Rule::id

    source
    fn Rule::id(self : Rule) -> String

    Rule::is_canonical

    source
    fn Rule::is_canonical(self : Rule) -> Bool

    Rule::matches

    source
    fn Rule::matches(self : Rule, ip : IPv4) -> Bool

    Rule::new

    source
    fn Rule::new(id : String, action : RuleAction, block : CidrBlock, source_block? : String, note? : String) -> Rule

    Rule::note

    source
    fn Rule::note(self : Rule) -> String

    Rule::parse

    source
    fn Rule::parse(id : String, line : String) -> Result[Rule, String]

    Rule::same_decision

    source
    fn Rule::same_decision(self : Rule, other : Rule) -> Bool

    Rule::source_block

    source
    fn Rule::source_block(self : Rule) -> String

    Rule::summary

    source
    fn Rule::summary(self : Rule) -> String

    RuleAction

    source
    pub(all) enum RuleAction {
      Allow
      Deny
    } derive(Eq, 
    Debug    )

    Action taken when a CIDR rule matches.

    RuleAction::label

    source
    fn RuleAction::label(self : RuleAction) -> String

    RuleAction::parse

    source
    fn RuleAction::parse(input : String) -> Result[RuleAction, String]

    RuleChange

    source
    pub struct RuleChange {
      kind : RuleChangeKind
      before_id : String
      after_id : String
      block : String
      message : String
    } derive(Eq, 
    Debug    )

    A change item matched by CIDR range.

    RuleChange::after_id

    source
    fn RuleChange::after_id(self : RuleChange) -> String

    RuleChange::before_id

    source
    fn RuleChange::before_id(self : RuleChange) -> String

    RuleChange::block

    source
    fn RuleChange::block(self : RuleChange) -> String

    RuleChange::kind

    source

    RuleChange::message

    source
    fn RuleChange::message(self : RuleChange) -> String

    RuleChange::new

    source
    fn RuleChange::new(kind : RuleChangeKind, before_id : String, after_id : String, block : String, message : String) -> RuleChange

    RuleChange::summary

    source
    fn RuleChange::summary(self : RuleChange) -> String

    RuleChangeKind

    source
    pub(all) enum RuleChangeKind {
      AddedRule
      RemovedRule
      ActionChanged
      NoteChanged
      UnchangedRule
    } derive(Eq, 
    Debug    )

    Type of change between two rule sets.

    RuleChangeKind::is_risky

    source
    fn RuleChangeKind::is_risky(self : RuleChangeKind) -> Bool

    RuleChangeKind::label

    source
    fn RuleChangeKind::label(self : RuleChangeKind) -> String

    RuleSet

    source
    pub struct RuleSet {
      rules : Array[Rule]
      parse_errors : Array[String]
    } derive(
    Debug    )

    RuleSet::audit

    source
    fn RuleSet::audit(self : RuleSet) -> AuditReport

    RuleSet::audit_with_policy

    source
    fn RuleSet::audit_with_policy(self : RuleSet, policy : AuditPolicy) -> AuditReport

    RuleSet::coverage_ranges

    source
    fn RuleSet::coverage_ranges(self : RuleSet, action : RuleAction) -> Array[AddressRange]

    Returns the union of all rule blocks with the requested action.

    This is a structural view. Ordered first-match behavior is intentionally handled separately by RuleSet::decide.

    RuleSet::coverage_report

    source
    fn RuleSet::coverage_report(self : RuleSet, action : RuleAction, target : CidrBlock) -> String

    RuleSet::coverage_stats

    source
    fn RuleSet::coverage_stats(self : RuleSet) -> CoverageStats

    RuleSet::decide

    source
    fn RuleSet::decide(self : RuleSet, ip : IPv4) -> Decision

    RuleSet::diff_from

    source
    fn RuleSet::diff_from(self : RuleSet, previous : RuleSet) -> DiffReport

    RuleSet::evaluate_gate

    source
    fn RuleSet::evaluate_gate(self : RuleSet, audit_policy : AuditPolicy, gate_policy : GatePolicy) -> GateResult

    RuleSet::explain_ip

    source
    fn RuleSet::explain_ip(self : RuleSet, ip : IPv4) -> String

    RuleSet::explain_many

    source
    fn RuleSet::explain_many(self : RuleSet, probes : Array[String]) -> String

    RuleSet::first_rule_for_block

    source
    fn RuleSet::first_rule_for_block(self : RuleSet, block : CidrBlock) -> String

    RuleSet::from_lines

    source
    fn RuleSet::from_lines(lines : Array[String]) -> RuleSet

    RuleSet::inventory_report

    source
    fn RuleSet::inventory_report(self : RuleSet) -> String

    RuleSet::matching_rules

    source
    fn RuleSet::matching_rules(self : RuleSet, ip : IPv4) -> Array[Rule]

    RuleSet::new

    source
    fn RuleSet::new(rules : Array[Rule]) -> RuleSet

    RuleSet::parse_errors

    source
    fn RuleSet::parse_errors(self : RuleSet) -> Array[String]

    RuleSet::rules

    source
    fn RuleSet::rules(self : RuleSet) -> Array[Rule]

    Severity

    source
    pub(all) enum Severity {
      Info
      Warning
      Critical
    } derive(Eq, 
    Debug    )

    Severity assigned to an audit finding.

    Severity::label

    source
    fn Severity::label(self : Severity) -> String

    Severity::score

    source
    fn Severity::score(self : Severity) -> Int

    aggregate_blocks

    source
    fn aggregate_blocks(blocks : Array[CidrBlock]) -> AggregationReport

    Aggregates already parsed CIDR blocks.

    aggregate_cidr_strings

    source
    fn aggregate_cidr_strings(inputs : Array[String]) -> AggregationReport

    Parses and aggregates a list of CIDR strings.

    Invalid entries are preserved in errors rather than aborting the whole operation, making the API suitable for configuration linting.

    audit_rules

    source
    fn audit_rules(rules : Array[Rule]) -> AuditReport

    audit_rules_with_policy

    source
    fn audit_rules_with_policy(rules : Array[Rule], policy : AuditPolicy) -> AuditReport

    clip_ranges_to_block

    source
    fn clip_ranges_to_block(target : CidrBlock, coverage : Array[AddressRange]) -> Array[AddressRange]

    Clips address ranges to a target CIDR and returns a merged union.

    diff_rule_sets

    source
    fn diff_rule_sets(current : RuleSet, previous : RuleSet) -> DiffReport

    import_csv_rules

    source
    fn import_csv_rules(lines : Array[String]) -> ImportReport

    Imports rows in action,cidr,note form.

    A header row is optional. Quoted fields, embedded commas, and doubled quote escapes are supported. Extra columns are folded into the note and reported as a warning so information is not silently discarded.

    import_nginx_access

    source
    fn import_nginx_access(lines : Array[String]) -> ImportReport

    Imports Nginx access directives such as allow 10.0.0.0/8;.

    deny all; and allow all; are converted to 0.0.0.0/0. Other Nginx directives are rejected so accidental input from an unrelated section is visible to the caller.

    import_plain_rules

    source
    fn import_plain_rules(lines : Array[String]) -> ImportReport

    Imports the native compact syntax: allow 10.0.0.0/8 note.

    merge_address_ranges

    source
    fn merge_address_ranges(input : Array[AddressRange]) -> Array[AddressRange]

    Sorts and merges overlapping or adjacent address ranges.

    parse_rules

    source
    fn parse_rules(lines : Array[String]) -> RuleSet

    ranges_from_blocks

    source
    fn ranges_from_blocks(blocks : Array[CidrBlock]) -> Array[AddressRange]

    Converts CIDR blocks into a sorted, non-overlapping union of address ranges.

    uncovered_ranges

    source
    fn uncovered_ranges(target : CidrBlock, coverage : Array[AddressRange]) -> Array[AddressRange]

    Finds holes inside target that are not covered by any supplied range.

    Source Files

    Powered by MoonBit

    Site sourceReport issuePackagesBuild queueSkillsStatistics

    © 2026 mooncakes.io