|
| 1 | +/* |
| 2 | + * SPDX-License-Identifier: Apache-2.0 |
| 3 | + * |
| 4 | + * The OpenSearch Contributors require contributions made to |
| 5 | + * this file be licensed under the Apache-2.0 license or a |
| 6 | + * compatible open source license. |
| 7 | + * |
| 8 | + * Modifications Copyright OpenSearch Contributors. See |
| 9 | + * GitHub history for details. |
| 10 | + */ |
| 11 | + |
| 12 | +package org.opensearch.security.support; |
| 13 | + |
| 14 | +import java.net.InetAddress; |
| 15 | +import java.util.ArrayList; |
| 16 | +import java.util.List; |
| 17 | + |
| 18 | +import org.apache.logging.log4j.LogManager; |
| 19 | +import org.apache.logging.log4j.Logger; |
| 20 | + |
| 21 | +import inet.ipaddr.IPAddressString; |
| 22 | + |
| 23 | +/** |
| 24 | + * A utility class that performs matching of IP addresses against hostname patterns and CIDR ranges. |
| 25 | + * This matcher supports both wildcard hostname patterns (e.g., *.example.com) and CIDR notation (e.g., 192.168.1.0/24). |
| 26 | + */ |
| 27 | +public class HostAndCidrMatcher { |
| 28 | + protected final Logger log = LogManager.getLogger(HostAndCidrMatcher.class); |
| 29 | + private final WildcardMatcher hostMatcher; |
| 30 | + private final List<IPAddressString> cidrMatchers; |
| 31 | + |
| 32 | + /** |
| 33 | + * Constructs a new matcher with the specified host patterns. |
| 34 | + * |
| 35 | + * @param hostPatterns A list of patterns that can include both hostname wildcards |
| 36 | + * (e.g., *.example.com) and CIDR ranges (e.g., 192.168.1.0/24). |
| 37 | + * Must not be null. |
| 38 | + * @throws IllegalArgumentException if hostPatterns is null |
| 39 | + */ |
| 40 | + public HostAndCidrMatcher(List<String> hostPatterns) { |
| 41 | + if (hostPatterns == null) { |
| 42 | + throw new IllegalArgumentException("Host patterns cannot be null"); |
| 43 | + } |
| 44 | + |
| 45 | + this.hostMatcher = WildcardMatcher.from(hostPatterns); |
| 46 | + this.cidrMatchers = hostPatterns.stream().map(IPAddressString::new).filter(IPAddressString::isIPAddress).toList(); |
| 47 | + } |
| 48 | + |
| 49 | + /** |
| 50 | + * Checks if the provided IP address matches any of the configured CIDR ranges. |
| 51 | + * |
| 52 | + * @param address The IP address to check. Can be either IPv4 or IPv6. |
| 53 | + * @return true if the address matches any configured CIDR range, false otherwise |
| 54 | + * or if the address is null |
| 55 | + */ |
| 56 | + public boolean matchesCidr(InetAddress address) { |
| 57 | + if (address == null || cidrMatchers == null) { |
| 58 | + return false; |
| 59 | + } |
| 60 | + |
| 61 | + IPAddressString addressString = new IPAddressString(address.getHostAddress()); |
| 62 | + return cidrMatchers.stream().anyMatch(cidrAddress -> cidrAddress.contains(addressString)); |
| 63 | + } |
| 64 | + |
| 65 | + /** |
| 66 | + * Checks if the provided IP address matches any of the configured hostname patterns. |
| 67 | + * This method can perform DNS lookups depending on the hostResolverMode. |
| 68 | + * |
| 69 | + * @param address The IP address to check |
| 70 | + * @param hostResolverMode The resolution mode. Must be one of {@link HostResolverMode} to enable hostname matching |
| 71 | + * @return true if the address matches any configured hostname pattern, false otherwise, |
| 72 | + * if the address is null, or if the resolver mode is invalid |
| 73 | + * @implNote This method may perform DNS lookups which could impact performance |
| 74 | + */ |
| 75 | + public boolean matchesHostname(InetAddress address, String hostResolverMode) { |
| 76 | + if (address == null || hostMatcher == null) { |
| 77 | + return false; |
| 78 | + } |
| 79 | + |
| 80 | + List<String> valuesToCheck = new ArrayList<>(List.of(address.getHostAddress())); |
| 81 | + if (hostResolverMode != null |
| 82 | + && (hostResolverMode.equalsIgnoreCase(HostResolverMode.IP_HOSTNAME.getValue()) |
| 83 | + || hostResolverMode.equalsIgnoreCase(HostResolverMode.IP_HOSTNAME_LOOKUP.getValue()))) { |
| 84 | + try { |
| 85 | + final String hostName = address.getHostName(); // potential blocking call |
| 86 | + valuesToCheck.add(hostName); |
| 87 | + } catch (Exception e) { |
| 88 | + log.warn("Failed to resolve hostname for {}: {}", address.getHostAddress(), e.getMessage()); |
| 89 | + return false; |
| 90 | + } |
| 91 | + } |
| 92 | + return valuesToCheck.stream().anyMatch(hostMatcher); |
| 93 | + } |
| 94 | + |
| 95 | + /** |
| 96 | + * Checks if the provided IP address matches either hostname patterns or CIDR ranges. |
| 97 | + * |
| 98 | + * @param address The IP address to check |
| 99 | + * @param hostResolverMode The resolution mode for hostname matching |
| 100 | + * @return true if the address matches either hostname patterns or CIDR ranges, |
| 101 | + * false otherwise |
| 102 | + */ |
| 103 | + public boolean matches(InetAddress address, String hostResolverMode) { |
| 104 | + return matchesHostname(address, hostResolverMode) || matchesCidr(address); |
| 105 | + } |
| 106 | +} |
0 commit comments