Struct IpRestrictionPlugin 

pub struct IpRestrictionPlugin {
    allow: Vec<String>,
    deny: Vec<String>,
}

Restricts access based on the request’s remote_addr.

The deny list is evaluated first (a match rejects with error code IP_DENIED); when the allow list is non-empty, the client IP must match one of its entries or the request is rejected with IP_NOT_ALLOWED. Rejections produce a 403 JSON response. Does not write to context.message.

Fields

allow: Vec<String>

Allowed IPs/CIDRs; when non-empty, acts as a whitelist.

deny: Vec<String>

Denied IPs/CIDRs; checked before the allow list.

Implementations

impl IpRestrictionPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config. Never fails; both lists default to empty (which permits all traffic).

Accepted keys:

• allow (array of strings, default []): IPs or CIDR blocks (e.g. "10.0.0.0/8") that may pass when the list is non-empty.
• deny (array of strings, default []): IPs or CIDR blocks that are always rejected; takes precedence over allow.

type: ip-restriction
config:
  allow: ["10.0.0.0/8", "192.168.1.5"]
  deny: ["10.1.2.3"]

fn ip_matches(patterns: &[String], addr: &str) -> bool

Checks whether addr (an IP, optionally with a :port suffix) matches any pattern — either an exact IP or a net/bits CIDR block (IPv4 and IPv6). Unparseable addresses never match.

Trait Implementations

impl Plugin for IpRestrictionPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.