feat: allow bypassing of basic auth from a list of authorized cidrs (#50)

internal/cidr/match.go

@@ -0,0 +1,42 @@
+package cidr
+
+import (
+	"net"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+func MatchAny(hostPort string, CIDRs ...string) (bool, error) {
+	var remoteHost string
+	if strings.Contains(hostPort, ":") {
+		var err error
+		remoteHost, _, err = net.SplitHostPort(hostPort)
+		if err != nil {
+			return false, errors.WithStack(err)
+		}
+	} else {
+		remoteHost = hostPort
+	}
+
+	remoteAddr := net.ParseIP(remoteHost)
+	if remoteAddr == nil {
+		return false, errors.Errorf("remote host '%s' is not a valid ip address", remoteHost)
+	}
+
+	for _, rawCIDR := range CIDRs {
+		_, net, err := net.ParseCIDR(rawCIDR)
+		if err != nil {
+			return false, errors.WithStack(err)
+		}
+
+		match := net.Contains(remoteAddr)
+		if !match {
+			continue
+		}
+
+		return true, nil
+	}
+
+	return false, nil
+}