用 Python 检查 CIDR 网段重叠：部署前发现重复与包含

python3 --version
mkdir cidr-check-demo
cd cidr-check-demo

"""Find the first overlap in a small local CIDR inventory. Python 3.9+."""
import argparse
import ipaddress
from pathlib import Path
import sys

MAX_BYTES = 128 * 1024
MAX_NETWORKS = 1000


def read_networks(path):
    if not path.is_file():
        raise ValueError("input must be a regular file")
    with path.open("rb") as stream:
        raw = stream.read(MAX_BYTES + 1)
    if len(raw) > MAX_BYTES:
        raise ValueError(f"input exceeds {MAX_BYTES} bytes")
    text = raw.decode("utf-8")
    if text.startswith("\ufeff"):
        raise ValueError("remove the UTF-8 BOM first")
    rows = []
    for line_number, line in enumerate(text.splitlines(), 1):
        token = line.split("#", 1)[0].strip()
        if not token:
            continue
        if len(rows) >= MAX_NETWORKS:
            raise ValueError(f"more than {MAX_NETWORKS} networks")
        if token.count("/") != 1 or "%" in token:
            raise ValueError(f"line {line_number}: expected unscoped IP/prefix")
        prefix = token.split("/", 1)[1]
        if not prefix.isascii() or not prefix.isdecimal():
            raise ValueError(f"line {line_number}: prefix must be decimal digits")
        try:
            network = ipaddress.ip_network(token, strict=True)
        except ValueError as exc:
            raise ValueError(f"line {line_number}: {exc}") from exc
        rows.append((line_number, network))
    if not rows:
        raise ValueError("no networks found")
    return rows


def first_overlap(rows):
    for index, (left_line, left) in enumerate(rows):
        for right_line, right in rows[index + 1:]:
            if left.version == right.version and left.overlaps(right):
                return left_line, left, right_line, right
    return None


def main():
    parser = argparse.ArgumentParser(description=__doc__, allow_abbrev=False)
    parser.add_argument("file", type=Path, help="UTF-8 file: one CIDR per line")
    args = parser.parse_args()
    try:
        rows = read_networks(args.file)
        conflict = first_overlap(rows)
    except (OSError, ValueError) as exc:
        print(f"ERROR: {exc}", file=sys.stderr)
        return 2
    if conflict:
        left_line, left, right_line, right = conflict
        print(f"OVERLAP: line {left_line} {left} <-> line {right_line} {right}")
        return 1
    print(f"OK: {len(rows)} networks; no overlaps within each IP version")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

python3 check_cidrs.py --help
cat > networks.txt <<'CIDRS'
# planned subnets
192.0.2.0/24
192.0.2.128/25
2001:db8:1::/64
CIDRS
if python3 check_cidrs.py networks.txt; then
    rc=0
else
    rc=$?
fi
printf 'exit=%s\n' "$rc"

OVERLAP: line 2 192.0.2.0/24 <-> line 3 192.0.2.128/25
exit=1

cat > networks-fixed.txt <<'CIDRS'
192.0.2.0/25
192.0.2.128/25
2001:db8:1::/64
CIDRS
python3 check_cidrs.py networks-fixed.txt

OK: 3 networks; no overlaps within each IP version

if python3 check_cidrs.py networks-fixed.txt; then
    printf 'NEXT: inventory passed; review the deployment separately\n'
else
    rc=$?
    printf 'STOP: CIDR preflight exit=%s\n' "$rc" >&2
    exit "$rc"
fi

python3 - <<'PY_CHECK'
import hashlib
from pathlib import Path
import subprocess
import sys
import tempfile

cases = [
    ("adjacent", "192.0.2.0/25\n192.0.2.128/25\n", 0),
    ("nested", "192.0.2.0/24\n192.0.2.128/25\n", 1),
    ("duplicate", "192.0.2.0/24\n192.0.2.0/24\n", 1),
    ("ipv6", "2001:db8::/32\n2001:db8:1::/48\n", 1),
    ("mixed", "192.0.2.0/24\n2001:db8::/32\n", 0),
    ("host-bits", "192.0.2.9/24\n", 2),
    ("empty", "# nothing planned yet\n", 2),
]
with tempfile.TemporaryDirectory(prefix="cidr-tests-", dir=".") as folder:
    path = Path(folder) / "input.txt"
    for label, text, expected in cases:
        path.write_text(text, encoding="utf-8")
        before = hashlib.sha256(path.read_bytes()).digest()
        result = subprocess.run(
            [sys.executable, "check_cidrs.py", str(path)],
            capture_output=True, text=True, timeout=10,
        )
        assert result.returncode == expected, (label, result)
        if expected == 2:
            assert not result.stdout and result.stderr.startswith("ERROR:")
        else:
            assert not result.stderr
            assert result.stdout.startswith("OVERLAP:" if expected else "OK:")
        assert hashlib.sha256(path.read_bytes()).digest() == before
        print(f"PASS: {label}; exit={result.returncode}; input unchanged")
PY_CHECK

printf '192.0.2.9/24\n' > host-bits.txt
if python3 check_cidrs.py host-bits.txt; then
    rc=0
else
    rc=$?
fi
printf 'exit=%s\n' "$rc"

ERROR: line 1: 192.0.2.9/24 has host bits set
exit=2