add ALLOWED_NETS, use netip, small linting fixes

README.md

@@ -26,6 +26,7 @@ Simple socks5 server using go-socks5 with authentication, allowed ips list and d
 |PROXY_PORT|String|1080|Set listen port for application inside docker container|
 |ALLOWED_DEST_FQDN|String|EMPTY|Allowed destination address regular expression pattern. Default allows all.|
 |ALLOWED_IPS|String|Empty|Set allowed IP's that can connect to proxy, separator `,`|
+|ALLOWED_NETS|String|Empty|Set allowed networks that can connect to proxy, separator `,`|
 
 
 # Build your own image:

ruleset.go

@@ -3,8 +3,9 @@ package main
 import (
 	"regexp"
 
+	"context"
+
 	"github.com/armon/go-socks5"
-	"golang.org/x/net/context"
 )
 
 // PermitDestAddrPattern returns a RuleSet which selectively allows addresses

server.go

@@ -2,19 +2,20 @@ package main
 
 import (
 	"log"
-	"net"
+	"net/netip"
 	"os"
 
 	"github.com/armon/go-socks5"
-	"github.com/caarlos0/env/v6"
+	env "github.com/caarlos0/env/v6"
 )
 
 type params struct {
-	User            string    `env:"PROXY_USER" envDefault:""`
-	Password        string    `env:"PROXY_PASSWORD" envDefault:""`
-	Port            string    `env:"PROXY_PORT" envDefault:"1080"`
-	AllowedDestFqdn string    `env:"ALLOWED_DEST_FQDN" envDefault:""`
-	AllowedIPs      []string  `env:"ALLOWED_IPS" envSeparator:"," envDefault:""`
+	User            string   `env:"PROXY_USER" envDefault:""`
+	Password        string   `env:"PROXY_PASSWORD" envDefault:""`
+	Port            string   `env:"PROXY_PORT" envDefault:"1080"`
+	AllowedDestFqdn string   `env:"ALLOWED_DEST_FQDN" envDefault:""`
+	AllowedIPs      []string `env:"ALLOWED_IPS" envSeparator:"," envDefault:""`
+	AllowedNets     []string `env:"ALLOWED_NETS" envSeparator:"," envDefault:""`
 }
 
 func main() {
@@ -48,15 +49,25 @@ func main() {
 	}
 
 	// Set IP whitelist
-	if len(cfg.AllowedIPs) > 0 {
-		whitelist := make([]net.IP, len(cfg.AllowedIPs))
-		for i, ip := range cfg.AllowedIPs {
-			whitelist[i] = net.ParseIP(ip)
+	if len(cfg.AllowedIPs) > 0 || len(cfg.AllowedNets) > 0 {
+		whitelist := make([]netip.Addr, len(cfg.AllowedIPs))
+		whitelistnet := make([]netip.Prefix, len(cfg.AllowedNets))
+
+		if len(cfg.AllowedIPs) > 0 {
+			for i, ip := range cfg.AllowedIPs {
+				whitelist[i], _ = netip.ParseAddr(ip)
+			}
+		}
+		if len(cfg.AllowedNets) > 0 {
+			for i, inet := range cfg.AllowedNets {
+				whitelistnet[i], _ = netip.ParsePrefix(inet)
+			}
 		}
-		server.SetIPWhitelist(whitelist)
+
+		server.SetIPWhitelist(whitelist, whitelistnet)
 	}
 
-	log.Printf("Start listening proxy service on port %s\n", cfg.Port)
+	log.Printf("Started proxy service listening on port %s\n", cfg.Port)
 	if err := server.ListenAndServe("tcp", ":"+cfg.Port); err != nil {
 		log.Fatal(err)
 	}