Syslog allowlist: CIDR ranges and discrete IPs #11

Merged

hannah-vernon merged 1 commit from feature/syslog-cidr-allowlist into dev

2026-08-25 16:04:52 -05:00

hannah-vernon commented

2026-08-25 16:04:20 -05:00

Owner

What does this PR do?

Extends the syslog source allowlist to accept CIDR ranges, discrete IP addresses, or any mix of both, so many LAN machines can send syslog to Viegard without enumerating every host, while single-host configurations keep working unchanged.

Viegard.Application.Net.CidrSet: shared pre-parsed matcher. Entries are bare addresses (exact /32 / /128 semantics) or CIDR ranges; IPv4-mapped IPv6 normalized on both sides; matching is pure, with fail-open/fail-closed semantics left to each caller.
SyslogDatagramHandler matches peers against the set; the allowlist remains checked before any parsing and remains fail-closed (enabled listener requires a non-empty, fully parseable list; startup now reports the specific bad entry and reason).
Docs: swag-syslog-setup.md shows the mixed single-host + LAN-range configuration.
Deliberately untouched: ProtectedAddressList (policy) keeps its own verified implementation; consolidation onto CidrSet is possible later but not worth churning security-critical code in this PR.

Fixes #

How was this tested?

dotnet build Viegard.slnx - 0 errors, 0 warnings
dotnet test Viegard.slnx - 260/260 pass (20 new: CIDR admit/reject boundaries, mixed exact+range lists, IPv4-mapped IPv6 peers, and a brand-new validator test file covering fail-closed empty-list, invalid entries incl. /33 and /-1, ports, listen address)
PostgreSQL integration tests skipped (dev-workstation WSL still down per GPO issue); this change does not touch queue or persistence code

Checklist

I have read the Contributing Guide
Changes are focused - one logical change per PR
Documentation updated (docs/swag-syslog-setup.md)
New dependencies: none
No secrets, credentials, or real infrastructure identifiers in the diff (RFC 5737/1918 examples only)
No commented-out code or debug leftovers

## What does this PR do? Extends the syslog source allowlist to accept **CIDR ranges, discrete IP addresses, or any mix of both**, so many LAN machines can send syslog to Viegard without enumerating every host, while single-host configurations keep working unchanged. - **`Viegard.Application.Net.CidrSet`**: shared pre-parsed matcher. Entries are bare addresses (exact /32 / /128 semantics) or CIDR ranges; IPv4-mapped IPv6 normalized on both sides; matching is pure, with fail-open/fail-closed semantics left to each caller. - **`SyslogDatagramHandler`** matches peers against the set; the allowlist remains checked before any parsing and remains fail-closed (enabled listener requires a non-empty, fully parseable list; startup now reports the specific bad entry and reason). - **Docs:** `swag-syslog-setup.md` shows the mixed single-host + LAN-range configuration. - Deliberately untouched: `ProtectedAddressList` (policy) keeps its own verified implementation; consolidation onto `CidrSet` is possible later but not worth churning security-critical code in this PR. Fixes # ## How was this tested? - [x] `dotnet build Viegard.slnx` - 0 errors, 0 warnings - [x] `dotnet test Viegard.slnx` - 260/260 pass (20 new: CIDR admit/reject boundaries, mixed exact+range lists, IPv4-mapped IPv6 peers, and a brand-new validator test file covering fail-closed empty-list, invalid entries incl. /33 and /-1, ports, listen address) - [ ] PostgreSQL integration tests skipped (dev-workstation WSL still down per GPO issue); this change does not touch queue or persistence code ## Checklist - [x] I have read the [Contributing Guide](../CONTRIBUTING.md) - [x] Changes are focused - one logical change per PR - [x] Documentation updated (docs/swag-syslog-setup.md) - [x] New dependencies: none - [x] No secrets, credentials, or real infrastructure identifiers in the diff (RFC 5737/1918 examples only) - [x] No commented-out code or debug leftovers

hannah-vernon added 1 commit

2026-08-25 16:04:20 -05:00

Support CIDR ranges and discrete IPs in the syslog source allowlist 1f70fb3f64

Motivated by Hannah's plan to accept syslog from many LAN machines:
AllowedSources entries may now be bare addresses, CIDR ranges, or a
mix; bare addresses keep exact /32-/128 semantics, so existing
configurations behave unchanged.

- Viegard.Application.Net.CidrSet: shared pre-parsed matcher (bare IP
  or CIDR entries, IPv4-mapped IPv6 normalization, pure matching;
  callers own their fail-open/fail-closed semantics)
- SyslogDatagramHandler uses CidrSet; startup validation remains
  fail-closed and now reports the specific parse failure
- New SyslogSourceOptionsValidatorTests (the validator previously had
  no dedicated test file) plus handler tests for CIDR admit/reject,
  mixed exact+range lists, and IPv4-mapped IPv6 peers
- docs/swag-syslog-setup.md shows the mixed-list configuration

Verified: dotnet build 0 warnings; dotnet test 260 passing (Postgres
integration tests skip: no local Docker; queue internals untouched).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>