how to compare ip address(ipv4 and ipv6) in rego ?

[paramesh-yv]

how to compare ip address(ipv4 and ipv6) in rego ?

string comparsion is not working.

valid_range {
"192.1.2.27" > "192.1.2.220"
}

this results in TRUE.

Is there any built-in function for comparing ip-address.

I dnot want to convert ip into integer and then compare.

[anderseknert]

Hi there! There's a bunch of built-in functions for dealing with IP addresses included in Rego: https://www.openpolicyagent.org/docs/latest/policy-reference/#net

I'm not sure about "greater than" comparison though, as I don't think a use case for that has been presented before. Could you help me understand when that is useful?

[vootukuru]

Hi ,
usecase was The begin address must come before the end address in a range for both IPv4 and IPv6 addresses.

[vootukuru]

Can we use any builtin functions?

[vootukuru]

when i try to do this :

package ip_validation

import strconv

ipv4_valid(address) {
regex.match(address, ipv4_pattern)
}

ipv6_valid(address) {
regex.match(address, ipv6_pattern)
}

valid_range(begin, end) {
ipv4_valid(begin)
ipv4_valid(end)
compare_ipv4(begin, end)
}

input_validation {
valid_range(input.begin, input.end)
}

compare_ipv4(begin, end) {
ip_to_number(begin) < ip_to_number(end)
}

ip_to_number(ip) = n {
parts = split(ip, ".")
n = strconv.parseInt(parts[0], 10) * 16777216 + strconv.parseInt(parts[1], 10) * 65536 + strconv.parseInt(parts[2], 10) * 256 + strconv.parseInt(parts[3], 10)
}

ipv4_pattern = ^(\d{1,3}\.){3}\d{1,3}$
ipv6_pattern = ^([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}$

[vootukuru]

Seeing this error : 1 error occurred: policy.rego:4: rego_parse_error: unexpected import path, must begin with one of: {data, future, input}, got: strconv
import strconv
^

[anderseknert]

There's no "strcov" to import in Rego. You can use the to_number built-in function. No built-in function requires importing.

[anderseknert]

See the full list here: https://www.openpolicyagent.org/docs/latest/policy-reference/#built-in-functions

[anderseknert]

Other than that, looks like you're on the right track 👍

[paramesh-yv]

package ip_validation

default input_validation = false

valid_range(begin, end) {
compare_ipv4(begin, end)
}

input_validation {
valid_range("192.168.1.20", "192.168.1.77")
}

compare_ipv4(begin, end) {
nb := ip_to_number(begin)
ne := ip_to_number(end)
nb < ne
}

ip_to_number(ip) = n {
parts = split(ip, ".")
n = to_number(parts[0]) * 16777216 + to_number(parts[1]) * 65536 + to_number(parts[2]) * 256 + to_number(parts[3])
}