Hello,
I'd like to first point out that this functionality is supported by nginx out of the box and does not necessarily require Lua or Openresty. You can find relevant documentation on the access module at
http://nginx.org/en/docs/http/ngx_http_access_module.html. The obvious downside here is maintaining a txt file but nginx is very good at understanding CIDR notations.
An example:
nginx.conf:
server {
listen 80;
include /etc/nginx/blacklist.txt
...
}
blacklist.txt:
The biggest complication you will have is writing some utility functions to ensure the real ip address is within a range of addresses. In my opinion, this approach can be bad if the design is not well thought out. If you store an in memory blacklist that is in CIDR notation, it is likely that you will have to 'dump' the entire cache and match each address as a string. This does not yield the best performance.
There are options, however. You can attempt to make a 'best guess' at the size of the subnet for the host.
For example,
Given the IP address 192.168.1.10, we can (if we chose) assume that the most logical subnet for this IP is a /24 (192.168.1.0-192.168.1.255).
If we use the above information we can arrive at the conclusion that the 'subnet host' is 192.168.1.0 (or 11000000 10101000 00000001 00000000 as a potential cache key) and this is consistent for the entire /24.
Given that assumption all requests that share this common subnet host should be denied.
All of the above makes some pretty serious assumptions about your traffic and your app. It is worth exploring other possibilities as well.
Here is a link to an unrelated project written in Lua that is capable of parsing/generating CIDR notation. IMHO it is a useful example of bit math in Lua.
I've written an example perl script that was written to help people understand CIDR addressing. It may or may not be useful to you:
