Initial commit

filter_plugins/luanti_wasm_network.py

@@ -0,0 +1,48 @@
+"""Strict CIDR checks without the ansible.utils / netaddr dependency."""
+
+from ipaddress import ip_network
+
+
+def valid_cidr(value: object) -> bool:
+    """Accept canonical IPv4/IPv6 networks, never a wildcard or scoped address."""
+    if not isinstance(value, str) or "/" not in value or "%" in value:
+        return False
+    try:
+        network = ip_network(value, strict=True)
+    except ValueError:
+        return False
+    return network.prefixlen > 0 and str(network) == value
+
+
+def valid_ip_block(value: object) -> bool:
+    """Validate a Kubernetes ipBlock, including contained exception networks."""
+    if not isinstance(value, dict) or set(value) - {"cidr", "except"}:
+        return False
+    if not valid_cidr(value.get("cidr")):
+        return False
+    exceptions = value.get("except", [])
+    if not isinstance(exceptions, list):
+        return False
+    parent = ip_network(value["cidr"])
+    for exception in exceptions:
+        if not valid_cidr(exception):
+            return False
+        child = ip_network(exception)
+        if (
+            child.version != parent.version
+            or child == parent
+            or int(child.network_address) < int(parent.network_address)
+            or int(child.broadcast_address) > int(parent.broadcast_address)
+        ):
+            return False
+    return True
+
+
+class FilterModule:
+    """Expose validation predicates to Ansible templates and assertions."""
+
+    def filters(self):
+        return {
+            "luanti_wasm_valid_cidr": valid_cidr,
+            "luanti_wasm_valid_ip_block": valid_ip_block,
+        }