net.IPNet inside other net.IPNet?

In net.IPNet type we have the Contains method to check if a net.IP is inside it. But what I want is to know if a net.IPNet is inside another net.IPNet. I tried a solution working with big.Int but it didn't work (also, the function interface was terrible). Any ideas?

// ipnet2 contains ipnet1 ?
func ContainsCIDR(ipnet1, ipnet2 net.IPNet) bool {
	var begin big.Int
	begin.SetBytes([]byte(ipnet1.IP))

	var mask big.Int
	mask.SetBytes([]byte(ipnet1.Mask))

	var diff big.Int
	diff.Xor(&begin, &mask)

	var end big.Int
	end.Add(&begin, &diff)

	ipBegin := net.IP(begin.Bytes())
	ipEnd := net.IP(end.Bytes())

	return ipnet2.Contains(ipBegin) && ipnet2.Contains(ipEnd)
}

Check that the mask for the outer subnet is the same size or smaller than the inner, then verify that the starting address for the inner subnet is contained in the outer:

func ContainsCIDR(ipnet1, ipnet2 *net.IPNet) bool {
	ones1, _ := ipnet1.Mask.Size()
	ones2, _ := ipnet2.Mask.Size()
	return ones1 <= ones2 && ipnet1.Contains(ipnet2.IP)
}

You can do this with the IPAddress Go library using the following code. Note that IPAddress works with other types of subnets, not just CIDR subnets, as shown. The same code also works with individual addresses. Disclaimer: I am the project manager.

func testContains(containing, contained string) {
	containsIPAddress(containing, contained)
	containsNet(containing, contained)
	fmt.Println()
}

func containsIPAddress(containing, contained string) {
	containingAddr, containedAddr := ipaddr.NewIPAddressString(containing),
		ipaddr.NewIPAddressString(contained)
	fmt.Printf("ipaddress: %s contains %s %v\n", containingAddr, containedAddr,
		containingAddr.Contains(containedAddr))
}

func containsNet(containing, contained string) {
	_, ipNetContaining, err := net.ParseCIDR(containing)
	var ipNetContained *net.IPNet
	if err == nil {
		_, ipNetContained, err = net.ParseCIDR(contained)
	}
	if err != nil {
		fmt.Printf("net: %s not a CIDR subnet\n", contained)
		return
	}
	containingAddr, _ := ipaddr.NewIPAddressFromNetIPNet(ipNetContaining)
	containedAddr, _ := ipaddr.NewIPAddressFromNetIPNet(ipNetContained)
	fmt.Printf("net: %s contains %s %v\n", containingAddr, containedAddr,
		containingAddr.Contains(containedAddr))
}

Running some test cases:

package main

import (
	"fmt"
	"github.com/seancfoley/ipaddress-go/ipaddr"
	"net"
)

func main() {
	testContains("172.17.0.0/16", "172.17.192.0/18")
	testContains("172.17.0.0/16", "172.17.191.0/18")
	testContains("10.10.20.0/30", "10.10.20.3/32")
	testContains("10.10.20.0/30", "10.10.20.3")
	testContains("10.10.20.0/30", "10.10.20.5")
	testContains("10.10.20.0/30", "10.10.20.0/31")
	testContains("10.10.20.0/30", "10.10.20.1-3")
	testContains("1::/64", "2::/72")
	testContains("1::/64", "1::/32")
	testContains("1::/64", "1::/112")
	testContains("1::3-4:5-6", "1::4:5-6")
	testContains("1::3-4:5-6", "1::3-4:5")
	testContains("1::3-4:5-6", "1::4:5-7")
	testContains("1-2::/64", "2::/64")
	testContains("bla", "foo")
}

Output:

ipaddress: 172.17.0.0/16 contains 172.17.192.0/18 true
net: 172.17.0.0/16 contains 172.17.192.0/18 true

ipaddress: 172.17.0.0/16 contains 172.17.191.0/18 true
net: 172.17.0.0/16 contains 172.17.128.0/18 true

ipaddress: 10.10.20.0/30 contains 10.10.20.3/32 true
net: 10.10.20.0/30 contains 10.10.20.3/32 true

ipaddress: 10.10.20.0/30 contains 10.10.20.3 true
net: 10.10.20.3 not a CIDR subnet

ipaddress: 10.10.20.0/30 contains 10.10.20.5 false
net: 10.10.20.5 not a CIDR subnet

ipaddress: 10.10.20.0/30 contains 10.10.20.0/31 true
net: 10.10.20.0/30 contains 10.10.20.0/31 true

ipaddress: 10.10.20.0/30 contains 10.10.20.1-3 true
net: 10.10.20.1-3 not a CIDR subnet

ipaddress: 1::/64 contains 2::/72 false
net: 1::/64 contains 2::/72 false

ipaddress: 1::/64 contains 1::/32 false
net: 1::/64 contains 1::/32 false

ipaddress: 1::/64 contains 1::/112 true
net: 1::/64 contains 1::/112 true

ipaddress: 1::3-4:5-6 contains 1::4:5-6 true
net: 1::4:5-6 not a CIDR subnet

ipaddress: 1::3-4:5-6 contains 1::3-4:5 true
net: 1::3-4:5 not a CIDR subnet

ipaddress: 1::3-4:5-6 contains 1::4:5-7 false
net: 1::4:5-7 not a CIDR subnet

ipaddress: 1-2::/64 contains 2::/64 true
net: 2::/64 not a CIDR subnet

ipaddress: bla contains foo false
net: foo not a CIDR subnet