net: make multiple improvements to net.BlockList

[jasnell]

New APIs:

• addCIDR(cidr): Parse CIDR string, auto-detect family
• addCIDRs(cidrs): Batch CIDR add
• addAddresses(addresses): Batch address add
• removeAddress(address): Remove exact address rule
• removeRange(start, end): Remove range rule
• removeSubnet(net, prefix): Remove subnet rule (+ trie cleanup)
• removeCIDR(cidr): Remove subnet by CIDR string
• clear(): Remove all rules
• size: Rule count without allocating rules array
• BlockList.PRIVATE_RANGES: Array of RFC 1918 + loopback + link-local + ULA CIDRs

Performance improvements:

• Constant-time address lookup
• Radix trie for subnet lookup
• String check fast path
• V8 fast api for checks
• Batch insert
• R/W locking

Adds a benchmark and more tests.

• Addresses
  • 10 rules ... 9x perf improvement
  • 100 rules ... 13x perf improvement
  • 1000 rules ... 58x perf improvement
  • 10000 rules ... 1186x perf improvement
• Subnets
  • 10 rules ... 5x perf improvement
  • 100 rules ... 6x perf improvement
  • 1000 rules ... 24x perf improvement
  • 10000 rules ... 418x perf improvement

Essentially went from O(n) to mostly O(1) for most cases.

Signed-off-by: James M Snell jasnell@gmail.com

[nodejs-github-bot]

Review requested:

• @nodejs/net
• @nodejs/performance

[codecov]

Codecov Report

❌ Patch coverage is 83.26271% with 79 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.23%. Comparing base (f43086d) to head (e3055ea).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_sockaddr.cc	76.25%	24 Missing and 52 partials ⚠️
lib/internal/blocklist.js	97.93%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64974      +/-   ##
==========================================
- Coverage   90.27%   90.23%   -0.05%     
==========================================
  Files         762      762              
  Lines      247515   247941     +426     
  Branches    46683    46793     +110     
==========================================
+ Hits       223447   223730     +283     
- Misses      15485    15601     +116     
- Partials     8583     8610      +27     

Files with missing lines	Coverage Δ
src/node_sockaddr.h	51.28% <100.00%> (+13.04%)	⬆️
lib/internal/blocklist.js	93.37% <97.93%> (+1.98%)	⬆️
src/node_sockaddr.cc	62.36% <76.25%> (-7.64%)	⬇️

... and 32 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pimterry]

Both Walk and WalkImpl are dead code, these aren't used anywhere.

[pimterry]

We're mirroring IPv4 & IPv6 handling in both directions, and we could save some work by just doing one. We duplicate writes (changing anything IPv4-related writes to both ranges) and we duplicate reads (all checks read both ranges). Surely there's a way we can just duplicate the write side and only check once read-side?

[pimterry]

The removal logic ignores overlaps, which results in a selection of fun ways to get this state out of sync. One example:

bl.addSubnet('10.0.0.0', 8);
bl.addSubnet('10.1.0.0', 16);
bl.removeSubnet('10.0.0.0', 8);

bl.rules // Lists 10.1.0.0./16
bl.check('10.1.2.3') // False - not blocked

This is a bit tricky to fix. If you have rule A & B that overlap, and you remove rule A, you can't clear all of A's range from the trie - you have to clear only the part that didn't overlap. Or you clear everything, but then re-apply B? Fun.

[pimterry]

This no longer does normalizes family which might catch some people out:

> bl.addAddress('10.0.0.1')
> bl.check('10.0.0.1', 'IPv4')
false
> bl.check('10.0.0.1', 'ipv4')
true

Both return true on main.

[pimterry]

I think this is supposed to be testing SocketAddressBlockListWrap::FastCheck, is that right? It looks like it doesn't actually test that, because that path is only for SocketAddress args and this all passes strings.

[pimterry]

It would be nice to validate all in advance, and then apply them all, so that if an exception is thrown then nothing is applied instead of half-applying the array.