|
| 1 | +/** |
| 2 | + * BSD-3-Clause License. |
| 3 | + * Copyright (c) 2025 Semtech |
| 4 | + */ |
| 5 | +package net.airvantage.proxysocket.tools; |
| 6 | + |
| 7 | +import java.net.InetAddress; |
| 8 | +import java.net.InetSocketAddress; |
| 9 | +import java.net.UnknownHostException; |
| 10 | +import java.util.function.Predicate; |
| 11 | + |
| 12 | +/** |
| 13 | + * Predicate compatible class that tests whether an InetSocketAddress belongs to a given subnet (CIDR). |
| 14 | + * Supports both IPv4 and IPv6 CIDR notation. |
| 15 | + * |
| 16 | + * <p>Example usage: |
| 17 | + * <pre> |
| 18 | + * // Single subnet |
| 19 | + * Predicate<InetSocketAddress> predicate = new SubnetPredicate("10.0.0.0/8"); |
| 20 | + * |
| 21 | + * // Multiple subnets |
| 22 | + * Predicate<InetSocketAddress> predicate = |
| 23 | + * new SubnetPredicate("10.0.0.0/8") |
| 24 | + * .or(new SubnetPredicate("192.168.0.0/16")) |
| 25 | + * .or(new SubnetPredicate("2001:db8::/32")) |
| 26 | + * ); |
| 27 | + * </pre> |
| 28 | + * |
| 29 | + * Note: it's possible to create a SubnetPredicate with a hostname instead of an IP address, |
| 30 | + * the address will be resolved to an IP address using InetAddress.getByName(hostname). |
| 31 | + * If the hostname is not resolvable, an IllegalArgumentException will be thrown. |
| 32 | + * But if the hostname resolves to a mix of IPv4/IPv6 addresses or multiple addresses, |
| 33 | + * the predicate will only match the first address found. |
| 34 | + * |
| 35 | + * Thread-safety: This class is immutable and thread-safe. |
| 36 | + */ |
| 37 | +public class SubnetPredicate implements Predicate<InetSocketAddress> { |
| 38 | + private final byte[] networkAddress; |
| 39 | + private final int prefixLength; |
| 40 | + private final int addressLength; // 4 for IPv4, 16 for IPv6 |
| 41 | + |
| 42 | + /** |
| 43 | + * Creates a predicate for the given CIDR subnet. |
| 44 | + * |
| 45 | + * @param cidr CIDR notation string (e.g., "10.0.0.0/8" or "2001:db8::/32") |
| 46 | + * @throws IllegalArgumentException if the CIDR notation is invalid |
| 47 | + */ |
| 48 | + public SubnetPredicate(String cidr) { |
| 49 | + if (cidr == null || cidr.isEmpty()) { |
| 50 | + throw new IllegalArgumentException("CIDR notation cannot be null or empty"); |
| 51 | + } |
| 52 | + |
| 53 | + int slashIndex = cidr.indexOf('/'); |
| 54 | + if (slashIndex == -1) { |
| 55 | + throw new IllegalArgumentException("Invalid CIDR notation: missing '/' separator"); |
| 56 | + } |
| 57 | + |
| 58 | + String addressPart = cidr.substring(0, slashIndex); |
| 59 | + String prefixLengthPart = cidr.substring(slashIndex + 1); |
| 60 | + |
| 61 | + try { |
| 62 | + this.prefixLength = Integer.parseInt(prefixLengthPart); |
| 63 | + } catch (NumberFormatException e) { |
| 64 | + throw new IllegalArgumentException("Invalid prefix length: " + prefixLengthPart, e); |
| 65 | + } |
| 66 | + |
| 67 | + byte[] rawAddress; |
| 68 | + try { |
| 69 | + InetAddress addr = InetAddress.getByName(addressPart); |
| 70 | + rawAddress = addr.getAddress(); |
| 71 | + } catch (UnknownHostException e) { |
| 72 | + throw new IllegalArgumentException("Invalid IP address: " + addressPart, e); |
| 73 | + } |
| 74 | + |
| 75 | + this.addressLength = rawAddress.length; |
| 76 | + |
| 77 | + // Validate prefix length |
| 78 | + int maxPrefixLength = addressLength * 8; // converts address length to bits |
| 79 | + if (prefixLength < 0 || prefixLength > maxPrefixLength) { |
| 80 | + throw new IllegalArgumentException( |
| 81 | + "Invalid prefix length " + prefixLength + " for address type (must be 0-" + maxPrefixLength + ")" |
| 82 | + ); |
| 83 | + } |
| 84 | + |
| 85 | + // Apply the mask to the network address to normalize it |
| 86 | + this.networkAddress = applyMask(rawAddress); |
| 87 | + } |
| 88 | + |
| 89 | + /** |
| 90 | + * Tests whether the given socket address belongs to this subnet. |
| 91 | + * |
| 92 | + * @param socketAddress the socket address to test |
| 93 | + * @return true if the address is in this subnet, false otherwise |
| 94 | + */ |
| 95 | + @Override |
| 96 | + public boolean test(InetSocketAddress socketAddress) { |
| 97 | + if (socketAddress == null) { |
| 98 | + return false; |
| 99 | + } |
| 100 | + |
| 101 | + InetAddress address = socketAddress.getAddress(); |
| 102 | + if (address == null) { |
| 103 | + return false; |
| 104 | + } |
| 105 | + |
| 106 | + byte[] testAddress = address.getAddress(); |
| 107 | + |
| 108 | + // Different address families don't match |
| 109 | + if (testAddress.length != addressLength) { |
| 110 | + return false; |
| 111 | + } |
| 112 | + |
| 113 | + byte[] maskedTestAddress = applyMask(testAddress); |
| 114 | + |
| 115 | + // Compare network portions |
| 116 | + for (int i = 0; i < networkAddress.length; i++) { |
| 117 | + if (networkAddress[i] != maskedTestAddress[i]) { |
| 118 | + return false; |
| 119 | + } |
| 120 | + } |
| 121 | + |
| 122 | + return true; |
| 123 | + } |
| 124 | + |
| 125 | + /** |
| 126 | + * Applies a subnet mask to an IP address. |
| 127 | + * |
| 128 | + * @param address the raw IP address bytes |
| 129 | + * @return the masked address bytes |
| 130 | + */ |
| 131 | + private byte[] applyMask(byte[] address) { |
| 132 | + byte[] result = new byte[address.length]; |
| 133 | + |
| 134 | + int fullBytes = prefixLength / 8; |
| 135 | + int remainingBits = prefixLength % 8; |
| 136 | + |
| 137 | + // Copy the full bytes |
| 138 | + System.arraycopy(address, 0, result, 0, fullBytes); |
| 139 | + |
| 140 | + // Apply mask to the partial byte if any |
| 141 | + if (remainingBits > 0) { |
| 142 | + int mask = 0xFF << (8 - remainingBits); |
| 143 | + result[fullBytes] = (byte) (address[fullBytes] & mask); |
| 144 | + } |
| 145 | + |
| 146 | + // Remaining bytes are already 0 |
| 147 | + return result; |
| 148 | + } |
| 149 | + |
| 150 | + @Override |
| 151 | + public String toString() { |
| 152 | + try { |
| 153 | + InetAddress addr = InetAddress.getByAddress(networkAddress); |
| 154 | + return addr.getHostAddress() + "/" + prefixLength; |
| 155 | + } catch (UnknownHostException e) { |
| 156 | + return "SubnetPredicate[invalid]"; |
| 157 | + } |
| 158 | + } |
| 159 | +} |
| 160 | + |
0 commit comments