Firewall Rule Decisions
MediumNetworking · Databricks
A firewall has an ordered list of rules. Each rule is [action, block], where action is "ALLOW" or "DENY" and block is either:
- a single IPv4 address such as
"10.0.0.1"(matches only that address), or - a CIDR block such as
"192.168.1.0/24": an address followed by a prefix lengthpfrom0to32. It matches every address whose firstpbits equal the firstpbits of the given address. Bits after the prefix in the rule's address are ignored (so"192.168.1.130/25"covers192.168.1.128through192.168.1.255), and/0matches everything.
An IPv4 address is four decimal octets 0..255 separated by dots; compare addresses as 32-bit numbers, not as strings.
For each address in ips, the first rule (in list order) that matches it decides: "ALLOW" means allowed and "DENY" means denied. If no rule matches, the address is denied.
Return a list of booleans, True for allowed and False for denied, one per address in ips.
Example 1
- Input:
- rules = [["DENY", "10.0.5.7"], ["ALLOW", "10.0.0.0/16"], ["DENY", "0.0.0.0/0"]], ips = ["10.0.5.7", "10.0.200.1", "10.1.0.1"]
- Output:
- [False, True, False]
- Explanation
- 10.0.5.7 matches the first rule exactly and is denied, even though the second rule would allow it. 10.0.200.1 shares the first 16 bits with 10.0.0.0, so it is allowed. 10.1.0.1 differs in the second octet and falls through to the catch-all deny.
Example 2
- Input:
- rules = [["ALLOW", "192.168.1.130/25"]], ips = ["192.168.1.200", "192.168.1.100"]
- Output:
- [True, False]
- Explanation
- Only the first 25 bits of the rule address matter, so the block is 192.168.1.128 to 192.168.1.255. The first address is inside it; the second is not, and no rule matching means deny.
Example 3
- Input:
- rules = [], ips = ["8.8.8.8"]
- Output:
- [False]
- Explanation
- With no rules, every request is denied by default.
Constraints
0 <= rules.length <= 10000 <= ips.length <= 1000- All addresses are valid IPv4 addresses with octets
0to255 - Prefix lengths are integers from
0to32