16 prop_all_cidrs_contain_themselves,
17 prop_contains_proper_intransitive
20 import Data.List (nubBy)
22 import Test.QuickCheck
24 import qualified Bit as B
32 data Cidr = None | Cidr { ipv4address :: IPv4Address,
33 maskbits :: Maskbits }
37 instance Show Cidr where
38 show Cidr.None = "None"
39 show cidr = (show (ipv4address cidr)) ++ "/" ++ (show (maskbits cidr))
42 instance Arbitrary Cidr where
44 ipv4 <- arbitrary :: Gen IPv4Address
45 mask <- arbitrary :: Gen Maskbits
46 return (Cidr ipv4 mask)
48 coarbitrary _ = variant 0
51 -- Two CIDR ranges are equivalent if they have the same network bits
52 -- and the masks are the same.
53 equivalent :: Cidr -> Cidr -> Bool
54 equivalent Cidr.None Cidr.None = True
55 equivalent Cidr.None _ = False
56 equivalent _ Cidr.None = False
57 equivalent (Cidr addr1 mbits1) (Cidr addr2 mbits2) =
58 (mbits1 == mbits2) && ((apply_mask addr1 mbits1) == (apply_mask addr2 mbits2))
60 -- Returns the mask portion of a CIDR address. That is, everything
61 -- after the trailing slash.
62 maskbits_from_cidr_string :: String -> Maskbits
63 maskbits_from_cidr_string s =
64 maskbits_from_string ((splitWith (`elem` "/") s) !! 1)
67 -- Takes an IP address String in CIDR notation, and returns a list of
68 -- its octets (as Ints).
69 octets_from_cidr_string :: String -> [Octet]
70 octets_from_cidr_string s =
71 map octet_from_string (take 4 (splitWith (`elem` "./") s))
74 cidr_from_string :: String -> Cidr
76 | addr == IPv4Address.None = Cidr.None
77 | mbits == Maskbits.None = Cidr.None
78 | otherwise = Cidr addr mbits
80 addr = ipv4address_from_octets (oct1) (oct2) (oct3) (oct4)
85 octs = octets_from_cidr_string s
86 mbits = maskbits_from_cidr_string s
90 min_host :: Cidr -> IPv4Address
91 min_host Cidr.None = IPv4Address.None
92 min_host (Cidr IPv4Address.None _) = IPv4Address.None
93 min_host (Cidr _ Maskbits.None) = IPv4Address.None
94 min_host (Cidr addr mask)
95 | mask == ThirtyTwo = addr
96 | mask == ThirtyOne = addr { octet4 = apply_mask oct4 Seven }
97 | mask == Thirty = addr { octet4 = apply_mask oct4 Six }
98 | mask == TwentyNine = addr { octet4 = apply_mask oct4 Five }
99 | mask == TwentyEight = addr { octet4 = apply_mask oct4 Four }
100 | mask == TwentySeven = addr { octet4 = apply_mask oct4 Three }
101 | mask == TwentySix = addr { octet4 = apply_mask oct4 Two }
102 | mask == TwentyFive = addr { octet4 = apply_mask oct4 One }
103 | mask == TwentyFour = addr { octet4 = min_octet }
104 | mask == TwentyThree = addr { octet3 = apply_mask oct3 Seven,
106 | mask == TwentyTwo = addr { octet3 = apply_mask oct3 Six,
108 | mask == TwentyOne = addr { octet3 = apply_mask oct3 Five,
110 | mask == Twenty = addr { octet3 = apply_mask oct3 Four,
112 | mask == Nineteen = addr { octet3 = apply_mask oct3 Three,
114 | mask == Eighteen = addr { octet3 = apply_mask oct3 Two,
116 | mask == Seventeen = addr { octet3 = apply_mask oct3 One,
118 | mask == Sixteen = addr { octet3 = min_octet,
120 | mask == Fifteen = addr { octet2 = apply_mask oct2 Seven,
123 | mask == Fourteen = addr { octet2 = apply_mask oct2 Six,
126 | mask == Thirteen = addr { octet2 = apply_mask oct2 Five,
129 | mask == Twelve = addr { octet2 = apply_mask oct2 Four,
132 | mask == Eleven = addr { octet2 = apply_mask oct2 Three,
135 | mask == Ten = addr { octet2 = apply_mask oct2 Two,
138 | mask == Nine = addr { octet2 = apply_mask oct2 One,
141 | mask == Eight = addr { octet2 = min_octet,
144 | mask == Seven = addr { octet1 = apply_mask oct1 Seven,
148 | mask == Six = addr { octet1 = apply_mask oct1 Six,
152 | mask == Five = addr { octet1 = apply_mask oct1 Five,
156 | mask == Four = addr { octet1 = apply_mask oct1 Four,
160 | mask == Three = addr { octet1 = apply_mask oct1 Three,
164 | mask == Two = addr { octet1 = apply_mask oct1 Two,
168 | mask == One = addr { octet1 = apply_mask oct1 One,
172 | mask == Zero = addr { octet1 = min_octet,
185 max_host :: Cidr -> IPv4Address
186 max_host Cidr.None = IPv4Address.None
187 max_host (Cidr IPv4Address.None _) = IPv4Address.None
188 max_host (Cidr _ Maskbits.None) = IPv4Address.None
189 max_host (Cidr addr mask)
190 | mask == ThirtyTwo = ipv4address_from_octets oct1 oct2 oct3 oct4
191 | mask == ThirtyOne = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 a26 a27 a28 a29 a30 a31 B.One)
192 | mask == Thirty = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 a26 a27 a28 a29 a30 B.One B.One)
193 | mask == TwentyNine = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 a26 a27 a28 a29 B.One B.One B.One)
194 | mask == TwentyEight = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 a26 a27 a28 B.One B.One B.One B.One)
195 | mask == TwentySeven = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 a26 a27 B.One B.One B.One B.One B.One)
196 | mask == TwentySix = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 a26 B.One B.One B.One B.One B.One B.One)
197 | mask == TwentyFive = ipv4address_from_octets oct1 oct2 oct3 (Octet a25 B.One B.One B.One B.One B.One B.One B.One)
198 | mask == TwentyFour = ipv4address_from_octets oct1 oct2 oct3 (max_octet)
199 | mask == TwentyThree = ipv4address_from_octets oct1 oct2 (Octet a17 a18 a19 a20 a21 a22 a23 B.One) (max_octet)
200 | mask == TwentyTwo = ipv4address_from_octets oct1 oct2 (Octet a17 a18 a19 a20 a21 a22 B.One B.One) (max_octet)
201 | mask == TwentyOne = ipv4address_from_octets oct1 oct2 (Octet a17 a18 a19 a20 a21 B.One B.One B.One) (max_octet)
202 | mask == Twenty = ipv4address_from_octets oct1 oct2 (Octet a17 a18 a19 a20 B.One B.One B.One B.One) (max_octet)
203 | mask == Nineteen = ipv4address_from_octets oct1 oct2 (Octet a17 a18 a19 B.One B.One B.One B.One B.One) (max_octet)
204 | mask == Eighteen = ipv4address_from_octets oct1 oct2 (Octet a17 a18 B.One B.One B.One B.One B.One B.One) (max_octet)
205 | mask == Seventeen = ipv4address_from_octets oct1 oct2 (Octet a17 B.One B.One B.One B.One B.One B.One B.One) (max_octet)
206 | mask == Sixteen = ipv4address_from_octets oct1 oct2 (max_octet) (max_octet)
207 | mask == Fifteen = ipv4address_from_octets oct1 (Octet a9 a10 a11 a12 a13 a14 a15 B.One) (max_octet) (max_octet)
208 | mask == Fourteen = ipv4address_from_octets oct1 (Octet a9 a10 a11 a12 a13 a14 B.One B.One) (max_octet) (max_octet)
209 | mask == Thirteen = ipv4address_from_octets oct1 (Octet a9 a10 a11 a12 a13 B.One B.One B.One) (max_octet) (max_octet)
210 | mask == Twelve = ipv4address_from_octets oct1 (Octet a9 a10 a11 a12 B.One B.One B.One B.One) (max_octet) (max_octet)
211 | mask == Eleven = ipv4address_from_octets oct1 (Octet a9 a10 a11 B.One B.One B.One B.One B.One) (max_octet) (max_octet)
212 | mask == Ten = ipv4address_from_octets oct1 (Octet a9 a10 B.One B.One B.One B.One B.One B.One) (max_octet) (max_octet)
213 | mask == Nine = ipv4address_from_octets oct1 (Octet a9 B.One B.One B.One B.One B.One B.One B.One) (max_octet) (max_octet)
214 | mask == Eight = ipv4address_from_octets oct1 (max_octet) (max_octet) (max_octet)
215 | mask == Seven = ipv4address_from_octets (Octet a1 a2 a3 a4 a5 a6 a7 B.One) (max_octet) (max_octet) (max_octet)
216 | mask == Six = ipv4address_from_octets (Octet a1 a2 a3 a4 a5 a6 B.One B.One) (max_octet) (max_octet) (max_octet)
217 | mask == Five = ipv4address_from_octets (Octet a1 a2 a3 a4 a5 B.One B.One B.One) (max_octet) (max_octet) (max_octet)
218 | mask == Four = ipv4address_from_octets (Octet a1 a2 a3 a4 B.One B.One B.One B.One) (max_octet) (max_octet) (max_octet)
219 | mask == Three = ipv4address_from_octets (Octet a1 a2 a3 B.One B.One B.One B.One B.One) (max_octet) (max_octet) (max_octet)
220 | mask == Two = ipv4address_from_octets (Octet a1 a2 B.One B.One B.One B.One B.One B.One) (max_octet) (max_octet) (max_octet)
221 | mask == One = ipv4address_from_octets (Octet a1 B.One B.One B.One B.One B.One B.One B.One) (max_octet) (max_octet) (max_octet)
222 | mask == Zero = ipv4address_from_octets (max_octet) (max_octet) (max_octet) (max_octet)
260 min_octet1 :: Cidr -> Octet
261 min_octet1 cidr = octet1 (min_host cidr)
263 min_octet2 :: Cidr -> Octet
264 min_octet2 cidr = octet2 (min_host cidr)
266 min_octet3 :: Cidr -> Octet
267 min_octet3 cidr = octet3 (min_host cidr)
269 min_octet4 :: Cidr -> Octet
270 min_octet4 cidr = octet4 (min_host cidr)
272 max_octet1 :: Cidr -> Octet
273 max_octet1 cidr = octet1 (max_host cidr)
275 max_octet2 :: Cidr -> Octet
276 max_octet2 cidr = octet2 (max_host cidr)
278 max_octet3 :: Cidr -> Octet
279 max_octet3 cidr = octet3 (max_host cidr)
281 max_octet4 :: Cidr -> Octet
282 max_octet4 cidr = octet4 (max_host cidr)
286 -- Return true if the first argument (a CIDR range) contains the
287 -- second (another CIDR range). There are a lot of ways we can be fed
288 -- junk here. For lack of a better alternative, just return False when
289 -- we are given nonsense.
290 contains :: Cidr -> Cidr -> Bool
291 contains Cidr.None _ = False
292 contains _ Cidr.None = False
293 contains (Cidr _ Maskbits.None) _ = False
294 contains (Cidr IPv4Address.None _) _ = False
295 contains _ (Cidr _ Maskbits.None) = False
296 contains _ (Cidr IPv4Address.None _) = False
298 -- If the number of bits in the network part of the first address is
299 -- larger than the number of bits in the second, there is no way that
300 -- the first range can contain the second. For, if the number of
301 -- network bits is larger, then the number of host bits must be
302 -- smaller, and if cidr1 has fewer hosts than cidr2, cidr1 most
303 -- certainly does not contain cidr2.
305 -- On the other hand, if the first argument (cidr1) has fewer (or the
306 -- same number of) network bits as the second, it can contain the
307 -- second. In this case, we need to check that every host in cidr2 is
308 -- contained in cidr1. If a host in cidr2 is contained in cidr1, then
309 -- at least mbits1 of an address in cidr2 will match cidr1. For
312 -- cidr1 = 192.168.1.0/23, cidr2 = 192.168.1.100/24
314 -- Here, cidr2 contains all of 192.168.1.0 through
315 -- 192.168.1.255. However, cidr1 contains BOTH 192.168.0.0 through
316 -- 192.168.0.255 and 192.168.1.0 through 192.168.1.255. In essence,
317 -- what we want to check is that cidr2 "begins with" something that
318 -- cidr1 CAN begin with. Since cidr1 can begin with 192.168.1, and
319 -- cidr2 DOES, cidr1 contains cidr2..
321 -- The way that we check this is to apply cidr1's mask to cidr2's
322 -- address and see if the result is the same as cidr1's mask applied
323 -- to cidr1's address.
325 contains (Cidr addr1 mbits1) (Cidr addr2 mbits2)
326 | mbits1 > mbits2 = False
327 | otherwise = addr1masked == addr2masked
329 addr1masked = apply_mask addr1 mbits1
330 addr2masked = apply_mask addr2 mbits1
333 contains_proper :: Cidr -> Cidr -> Bool
334 contains_proper cidr1 cidr2 =
335 (cidr1 `contains` cidr2) && (not (cidr2 `contains` cidr1))
338 -- A CIDR range is redundant (with respect to the given list) if
339 -- another CIDR range in that list properly contains it.
340 redundant :: [Cidr] -> Cidr -> Bool
341 redundant cidrlist cidr = any ((flip contains_proper) cidr) cidrlist
344 -- First, we look at all possible pairs of cidrs, and combine the
345 -- adjacent ones in to a new list. Then, we concatenate that list with
346 -- the original one, and filter out all of the redundancies. If two
347 -- adjacent Cidrs are combined into a larger one, they will be removed
348 -- in the second step since the larger Cidr must contain the smaller
350 combine_all :: [Cidr] -> [Cidr]
352 combine_contained unique_cidrs
354 unique_cidrs = nubBy equivalent valid_cidr_combinations
355 valid_cidr_combinations = filter (/= Cidr.None) cidr_combinations
357 cidrs ++ [ (combine_adjacent x y) | x <- cidrs, y <- cidrs ]
360 -- Take a list of CIDR ranges and filter out all of the ones that are
361 -- contained entirelt within some other range in the list.
362 combine_contained :: [Cidr] -> [Cidr]
363 combine_contained cidrs =
364 filter (not . (redundant cidrs)) cidrs
367 -- If the two Cidrs are not adjacent, return Cidr.None. Otherwise,
368 -- decrement the maskbits of cidr1 and return that; it will contain
369 -- both cidr1 and cidr2.
370 combine_adjacent :: Cidr -> Cidr -> Cidr
371 combine_adjacent cidr1 cidr2
372 | not (adjacent cidr1 cidr2) = Cidr.None
373 | (maskbits cidr1 == Zero) = Cidr.None
374 | otherwise = cidr1 { maskbits = decrement (maskbits cidr1) }
378 -- Determine whether or not two CIDR ranges are adjacent. If two
379 -- ranges lie consecutively within the IP space, they can be
380 -- combined. For example, 10.1.0.0/24 and 10.0.1.0/24 are adjacent,
381 -- and can be combined in to 10.1.0.0/23.
382 adjacent :: Cidr -> Cidr -> Bool
383 adjacent Cidr.None _ = False
384 adjacent _ Cidr.None = False
386 | mbits1 /= mbits2 = False
387 | mbits1 == Maskbits.Zero = False -- They're equal.
388 | otherwise = (mbits1 == (most_sig_bit_different addr1 addr2))
390 addr1 = ipv4address cidr1
391 addr2 = ipv4address cidr2
392 mbits1 = maskbits cidr1
393 mbits2 = maskbits cidr2
401 test_equality1 :: Test
403 TestCase $ assertEqual "10.1.1.0/23 equals itself" True (cidr1 == cidr1)
405 cidr1 = cidr_from_string "10.1.1.0/23"
408 test_contains1 :: Test
410 TestCase $ assertEqual "10.1.1.0/23 contains 10.1.1.0/24" True (cidr1 `contains` cidr2)
412 cidr1 = cidr_from_string "10.1.1.0/23"
413 cidr2 = cidr_from_string "10.1.1.0/24"
416 test_contains2 :: Test
418 TestCase $ assertEqual "10.1.1.0/23 contains itself" True (cidr1 `contains` cidr1)
420 cidr1 = cidr_from_string "10.1.1.0/23"
423 test_contains_proper1 :: Test
424 test_contains_proper1 =
425 TestCase $ assertEqual "10.1.1.0/23 contains 10.1.1.0/24 properly" True (cidr1 `contains_proper` cidr2)
427 cidr1 = cidr_from_string "10.1.1.0/23"
428 cidr2 = cidr_from_string "10.1.1.0/24"
431 test_contains_proper2 :: Test
432 test_contains_proper2 =
433 TestCase $ assertEqual "10.1.1.0/23 does not contain itself properly" False (cidr1 `contains_proper` cidr1)
435 cidr1 = cidr_from_string "10.1.1.0/23"
438 test_adjacent1 :: Test
440 TestCase $ assertEqual "10.1.0.0/24 is adjacent to 10.1.1.0/24" True (cidr1 `adjacent` cidr2)
442 cidr1 = cidr_from_string "10.1.0.0/24"
443 cidr2 = cidr_from_string "10.1.1.0/24"
446 test_adjacent2 :: Test
448 TestCase $ assertEqual "10.1.0.0/23 is not adjacent to 10.1.0.0/24" False (cidr1 `adjacent` cidr2)
450 cidr1 = cidr_from_string "10.1.0.0/23"
451 cidr2 = cidr_from_string "10.1.0.0/24"
454 test_adjacent3 :: Test
456 TestCase $ assertEqual "10.1.0.0/24 is not adjacent to 10.2.5.0/24" False (cidr1 `adjacent` cidr2)
458 cidr1 = cidr_from_string "10.1.0.0/24"
459 cidr2 = cidr_from_string "10.2.5.0/24"
462 test_adjacent4 :: Test
464 TestCase $ assertEqual "10.1.1.0/24 is not adjacent to 10.1.2.0/24" False (cidr1 `adjacent` cidr2)
466 cidr1 = cidr_from_string "10.1.1.0/24"
467 cidr2 = cidr_from_string "10.1.2.0/24"
470 test_combine_contained1 :: Test
471 test_combine_contained1 =
472 TestCase $ assertEqual "10.0.0.0/8, 10.1.0.0/16, and 10.1.1.0/24 combine to 10.0.0.0/8" expected_cidrs (combine_contained test_cidrs)
474 cidr1 = cidr_from_string "10.0.0.0/8"
475 cidr2 = cidr_from_string "10.1.0.0/16"
476 cidr3 = cidr_from_string "10.1.1.0/24"
477 expected_cidrs = [cidr1]
478 test_cidrs = [cidr1, cidr2, cidr3]
481 test_combine_contained2 :: Test
482 test_combine_contained2 =
483 TestCase $ assertEqual "192.168.3.0/23 does not contain 192.168.1.0/24" [cidr1, cidr2] (combine_contained [cidr1, cidr2])
485 cidr1 = cidr_from_string "192.168.3.0/23"
486 cidr2 = cidr_from_string "192.168.1.0/24"
489 test_combine_all1 :: Test
491 TestCase $ assertEqual "10.0.0.0/24 is adjacent to 10.0.1.0/24 and 10.0.3.0/23 contains 10.0.2.0/24" expected_cidrs (combine_all test_cidrs)
493 cidr1 = cidr_from_string "10.0.0.0/24"
494 cidr2 = cidr_from_string "10.0.1.0/24"
495 cidr3 = cidr_from_string "10.0.2.0/24"
496 cidr4 = cidr_from_string "10.0.3.0/23"
497 cidr5 = cidr_from_string "10.0.0.0/23"
498 expected_cidrs = [cidr4, cidr5]
499 test_cidrs = [cidr1, cidr2, cidr3, cidr4]
502 test_combine_all2 :: Test
504 TestCase $ assertEqual "127.0.0.1/32 combines with itself recursively" expected_cidrs (combine_all test_cidrs)
506 cidr1 = cidr_from_string "127.0.0.1/32"
507 expected_cidrs = [cidr1]
508 test_cidrs = [cidr1, cidr1, cidr1, cidr1, cidr1]
512 cidr_tests = [ test_equality1,
515 test_contains_proper1,
516 test_contains_proper2,
521 test_combine_contained1,
522 test_combine_contained2,
529 prop_all_cidrs_contain_themselves :: Cidr -> Bool
530 prop_all_cidrs_contain_themselves cidr1 = cidr1 `contains` cidr1
533 -- If cidr1 properly contains cidr2, then by definition cidr2
534 -- does not properly contain cidr1.
535 prop_contains_proper_intransitive :: Cidr -> Cidr -> Property
536 prop_contains_proper_intransitive cidr1 cidr2 =
537 (cidr1 `contains_proper` cidr2) ==>
538 (not (cidr2 `contains_proper` cidr1))