Add isIpPrefix

Makefile

@@ -11,7 +11,7 @@ COPYRIGHT_YEARS := 2023
 LICENSE_IGNORE := -e internal/testdata/
 LICENSE_HEADER_VERSION := 0294fdbe1ce8649ebaf5e87e8cdd588e33730bbb
 # NOTE: Keep this version in sync with the version in `/bazel/deps.bzl`.
-PROTOVALIDATE_VERSION ?= v0.4.2
+PROTOVALIDATE_VERSION ?= v0.5.1
 
 # Set to use a different compiler. For example, `GO=go1.18rc1 make test`.
 GO ?= go

bazel/deps.bzl

@@ -56,10 +56,10 @@ _dependencies = {
     },
     # NOTE: Keep Version in sync with `/Makefile`.
     "com_github_bufbuild_protovalidate": {
-        "sha256": "0dfa0a054f8739938172e28cdaa666c3e175e337d1fbf411ef76e729458be232",
-        "strip_prefix": "protovalidate-0.4.2",
+        "sha256": "67c360e29651a3bf81f7a2394f5d7f5353a67c0f79cb304ba420d27900e30203",
+        "strip_prefix": "protovalidate-0.5.1",
         "urls": [
-            "https://github.com/bufbuild/protovalidate/archive/v0.4.2.tar.gz",
+            "https://github.com/bufbuild/protovalidate/archive/v0.5.1.tar.gz",
         ],
     },
 }

buf/validate/internal/BUILD.bazel

@@ -131,3 +131,12 @@ cc_test(
         "@com_google_googletest//:gtest_main",
     ],
 )
+
+cc_test(
+    name = "extra_func_test",
+    srcs = ["extra_func_test.cc"],
+    deps = [
+        ":extra_func",
+        "@com_google_googletest//:gtest_main",
+    ],
+)

buf/validate/internal/extra_func.cc

@@ -220,6 +220,130 @@ cel::CelValue isIP(google::protobuf::Arena* arena, cel::CelValue::StringHolder l
   return isIPvX(arena, lhs, cel::CelValue::CreateInt64(0));
 }
 
+/**
+ * IP Prefix Validation
+ */
+bool IsIpv4Prefix(const std::string_view to_validate, bool strict) {
+  std::vector<std::string> split = absl::StrSplit(to_validate.data(), '/');
+  if (split.size() != 2) {
+    return false;
+  }
+  std::string ip = split[0];
+  std::string prefixlen = split[1];
+
+  // validate ip
+  if (!IsIpv4(ip)) {
+    return false;
+  }
+
+  // validate prefixlen
+  if (prefixlen.empty()) {
+    return false;
+  }
+  int prefixlen_int;
+  if (!absl::SimpleAtoi(prefixlen, &prefixlen_int)) {
+    return false;
+  }
+  if (prefixlen_int < 0 || prefixlen_int > 32) {
+    return false;
+  }
+
+  // check host part is all-zero if strict
+  if (strict) {
+    struct sockaddr_in sa;
+    if (inet_pton(AF_INET, ip.c_str(), &sa.sin_addr) != 1) {
+      return false;
+    }
+    struct in_addr mask;
+    mask.s_addr = htonl(std::pow(2, 32 - prefixlen_int) - 1);
+    return ((sa.sin_addr.s_addr & mask.s_addr) == 0);
+  }
+
+  return true;
+}
+
+bool IsIpv6Prefix(const std::string_view to_validate, bool strict) {
+  std::vector<std::string> split = absl::StrSplit(to_validate.data(), '/');
+  if (split.size() != 2) {
+    return false;
+  }
+  std::string ip = split[0];
+  std::string prefixlen = split[1];
+
+  // validate ip
+  if (!IsIpv6(ip)) {
+    return false;
+  }
+
+  // validate prefixlen
+  if (prefixlen.empty()) {
+    return false;
+  }
+  int prefixlen_int;
+  if (!absl::SimpleAtoi(prefixlen, &prefixlen_int)) {
+    return false;
+  }
+  if (prefixlen_int < 0 || prefixlen_int > 128) {
+    return false;
+  }
+
+  // check host part is all-zero if strict
+  if (strict) {
+    struct sockaddr_in6 sa_six;
+    if (inet_pton(AF_INET6, ip.c_str(), &sa_six.sin6_addr) != 1) {
+      return false;
+    }
+    struct in6_addr mask;
+    for (int i=0; i<4; i++) {
+      if ((prefixlen_int / 32) < i) {
+        mask.__in6_u.__u6_addr32[i] = htonl(0xffffffff);
+      } else if ((prefixlen_int / 32) == i) {
+        mask.__in6_u.__u6_addr32[i] = htonl(std::pow(2, 32*(i+1) - prefixlen_int) - 1);
+      } else {
+        mask.__in6_u.__u6_addr32[i] = htonl(0);
+      }
+    }
+    for (int i=0; i<4; i++) {
+      if ((sa_six.sin6_addr.__in6_u.__u6_addr32[i] & mask.__in6_u.__u6_addr32[i]) != 0) {
+        return false;
+      }
+    }
+  }
+
+  return true;
+}
+
+bool IsIpPrefix(const std::string_view to_validate, bool strict) {
+  return IsIpv4Prefix(to_validate, strict) || IsIpv6Prefix(to_validate, strict);
+}
+
+cel::CelValue isIpPrefix(google::protobuf::Arena* arena, cel::CelValue::StringHolder lhs, cel::CelValue rhs1, cel::CelValue rhs2) {
+  std::string_view str = lhs.value();
+  bool strict = false;
+  int ver = 0;
+  if (rhs1.IsBool()) {
+    strict = rhs1.BoolOrDie();
+  } else if (rhs1.IsInt64()) {
+    ver = rhs1.Int64OrDie();
+    if (rhs2.IsBool()) {
+      strict = rhs2.BoolOrDie();
+    }
+  } else {
+    return cel::CelValue::CreateBool(false);
+  }
+
+  switch (ver) {
+    case 0:
+      return cel::CelValue::CreateBool(IsIpPrefix(str, strict));
+    case 4:
+      return cel::CelValue::CreateBool(IsIpv4Prefix(str, strict));
+    case 6:
+      return cel::CelValue::CreateBool(IsIpv6Prefix(str, strict));
+    default:
+      return cel::CelValue::CreateBool(false);
+  }
+}
+
 /**
  * Naive URI validation.
  */
@@ -322,6 +446,12 @@ absl::Status RegisterExtraFuncs(
   if (!isIpStatus.ok()) {
     return isIpStatus;
   }
+  auto isIpPrefixStatus =
+      cel::FunctionAdapter<cel::CelValue, cel::CelValue::StringHolder, cel::CelValue, cel::CelValue>::
+          CreateAndRegister("isIpPrefix", true, &isIpPrefix, &registry);
+  if (!isIpPrefixStatus.ok()) {
+    return isIpPrefixStatus;
+  }
   auto startsWithStatus =
       cel::FunctionAdapter<cel::CelValue, cel::CelValue::BytesHolder, cel::CelValue>::
           CreateAndRegister("startsWith", true, &startsWith, &registry);

buf/validate/internal/extra_func.h

@@ -33,4 +33,9 @@ namespace buf::validate::internal {
 absl::Status RegisterExtraFuncs(
     google::api::expr::runtime::CelFunctionRegistry& registry, google::protobuf::Arena* regArena);
 
-} // namespace buf::validate::internal
+// define for testing
+bool IsIpv4Prefix(const std::string_view to_validate, bool strict);
+bool IsIpv6Prefix(const std::string_view to_validate, bool strict);
+bool IsIpPrefix(const std::string_view to_validate, bool strict);
+
+} // namespace buf::validate::internal

buf/validate/internal/extra_func_test.cc

@@ -0,0 +1,48 @@
+// Copyright 2023 Buf Technologies, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "buf/validate/internal/extra_func.h"
+
+#include "gtest/gtest.h"
+
+TEST(ExtraFuncTest, TestIpPrefix) {
+    EXPECT_TRUE(buf::validate::internal::IsIpPrefix("1.2.3.0/24", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpPrefix("1.2.3.4/24", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpPrefix("1.2.3.0/24", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpPrefix("1.2.3.4/24", true));
+    EXPECT_TRUE(buf::validate::internal::IsIpPrefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpPrefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118", false));
+    EXPECT_FALSE(buf::validate::internal::IsIpPrefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpPrefix("1.2.3.4", false));
+    EXPECT_FALSE(buf::validate::internal::IsIpPrefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:430b", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpv4Prefix("1.2.3.0/24", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpv4Prefix("1.2.3.4/24", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpv4Prefix("1.2.3.0/24", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv4Prefix("1.2.3.4/24", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv4Prefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118", false));
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv6Prefix("fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv6Prefix("1.2.3.0/24", false));
+    // Additional Tests for IsIpv6Prefix()
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("2001:db8::/29", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv6Prefix("2001:db9::/29", true));
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("2001:db8:ff00::/40", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv6Prefix("2001:db8:ff80::/40", true));
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("2001:db8:ff00:ff00::/57", true));
+    EXPECT_TRUE(buf::validate::internal::IsIpv6Prefix("2001:db8:ff00:ff80::/57", true));
+    EXPECT_FALSE(buf::validate::internal::IsIpv6Prefix("2001:db8:ff00:ffc0::/57", true));
+}
+