Painless convenience function for matching IP addresses

[stu-elastic]

Matching an ipaddress to a cidr, canonicalizing IPv6 addresses, stripping low-order bytes from addresses.

Meta: #60659

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Scripting)

[andrewstucki]

Not sure what the state of this is in terms of prioritization, but it would definitely help on the ingest side of things.

Right now I'm trying to add network direction detection to a good chunk of filebeat modules. Currently with modules that are defined completely in ingest pipelines we have no way of doing CIDR matching to say whether a particular event captures a network request to/from a whitelisted CIDR block range considered inside a DMZ.

[andrewstucki]

As far as CIDR inclusion goes, I think that, at least for ingest purposes, supporting something similar to the functionality of the contains method from netty would be sufficient.

So, in the case of doing an ip address check for inclusion in a CIDR blocks. Something to the effect of:

def block = new CIDR("192.168.0.0/8");
if (block.contains("192.168.1.1")) {
...
}

Alternatively, we could also do something similar to the CIDR matching implementation in EQL. Exposing CIDRUtils.isInRange to the execution context seems like it'd be sufficient for most ingest purposes that I can think of:

elasticsearch/x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/expression/function/scalar/string/CIDRUtils.java

Line 23 in 709068d

public static boolean isInRange(String address, String... cidrAddresses) {

[interpreter95]

Hi @andrewstucki, just wanted to check if this issue is still active?

If so I could try to implement either of your suggestions (please let me know which one you'd prefer).

Also, is canonicalizing IPv6 addresses and stripping low-order bytes from addresses up for grabs as well?

[stu-elastic]

just wanted to check if this issue is still active?

Hi @interpreter95. Yes it is.

Go ahead and implement:

def block = new CIDR("192.168.0.0/8");
if (block.contains("192.168.1.1")) {
...
}

Also, is canonicalizing IPv6 addresses and stripping low-order bytes from addresses up for grabs as well?

Let's start with CIDR.contains. Since these APIs are long lived (two major revisions to change), we're conservative about adding new ones until we have a strong use case.