Filter IP addresses (v4 and v6) using longest prefix match

[qdeslandes]

Sets are used to filter a multiple IP addresses in constant time. Each IP address to filter it inserted into a BPF map, and the program performs a lookup of the packet's IP into the map. This behaviour doesn't work well with subnets filtering: all the IP addresses of the subnet should be inserted into the set for the program to be able to filter the subnet.

# IPs to filter
192.168.1.1
192.168.1.2
192.168.2.0/24

# IPs in the set
192.168.1.1
192.168.1.2
192.168.2.0
192.168.2.1
[...]
192.168.2.254
192.168.2.255

An alternative is to implement subnets filtering using the Longest Prefix Match algorithm. Thankfully, BPF supports BPF_MAP_TYPE_LPM_TRIE maps.