aikido-zen 1.2.1 → 1.3.0.beta.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6c3172c2e8ea724f5b362592c7c9d326396c2ff05ba98a1573ed7ed587a1e55
-  data.tar.gz: 7c63642333e1f64c6b3011a12f52637438b98348e94754da47cb72f3c84f10ec
+  metadata.gz: c0416061d1a6fa8f04202889043e9dc773c4637879e9ad420f93193508e8426d
+  data.tar.gz: 163be1d25bfa8ce3f521dc251b15afdb5ea5d434f8f696e4497f74d38cd2e947
 SHA512:
-  metadata.gz: 32e2a25c9f2f55a21a3bf2d6e487b36ec3b8780dcaae3db9a82324669a99bf8c0514a6bbe9c810c20b877039e0827fa2446c053f610cf1317b3d5f064bc1e653
-  data.tar.gz: 41dda121db561eea1d99b0d4c76df3672e1d6e210e9d841e48ea467418120b3ce665151dc7dae9d889593300c40da1738bf3fa2266084fd7af603882146d21e3
+  metadata.gz: 2eb9f7becd746a85011c38577a83ebde83fb71c506b5bf4c0bea1a65a7958440aaa1205ed7f56fa7bdec77b69898050d88c7a1b0661cafa70cfea3d6048ebb99
+  data.tar.gz: 72def8195a17b242d688e072b66f1173d4cfe2ede3c67b95aa06303968f4dee9aff1e9b466b0394e21b5b8ae93086b73020c16a46c53b1c362e89b42203ebacc

data/benchmarks/ip_list/benchmark.rb

@@ -0,0 +1,39 @@
+#!/usr/bin/env ruby
+
+require "benchmark"
+require "aikido-zen"
+
+random_ipv4_ranges = (0..).lazy.map do
+  ip_int = rand(2**32)
+  prefix = rand(8..32)
+  network = IPAddr.new(ip_int, Socket::AF_INET).mask(prefix)
+  "#{network}/#{prefix}"
+end
+
+random_ipv6_ranges = (0..).lazy.map do
+  ip_int = rand(2**128)
+  prefix = rand(1..128)
+  network = IPAddr.new(ip_int, Socket::AF_INET6).mask(prefix)
+  "#{network}/#{prefix}"
+end
+
+random_ip_ranges = (0..).lazy.map do
+  (rand < 0.5) ? random_ipv4_ranges.next : random_ipv6_ranges.next
+end
+
+if __FILE__ == $0
+  ip_ranges = random_ip_ranges.take(1000)
+
+  ip_list = Aikido::Zen::RuntimeSettings::IPList.from_json({
+    "key" => "key",
+    "source" => "source",
+    "description" => "description",
+    "ips" => ip_ranges
+  })
+
+  result = Benchmark.measure do
+    ip_ranges.all? { |ip_range| ip_list.include?(ip_range) }
+  end
+
+  puts result
+end

data/lib/aikido/zen/runtime_settings/ip_list.rb

@@ -7,12 +7,15 @@ module Aikido::Zen
     attr_reader :description
     attr_reader :ips
 
+    attr_reader :ipv4_ranges
+    attr_reader :ipv6_ranges
+
     def self.from_json(data)
       new(
         key: data["key"],
         source: data["source"],
         description: data["description"],
-        ips: RuntimeSettings::IPSet.from_json(data["ips"])
+        ips: Array(data["ips"]).map { |ip| IPAddr.new(ip) }
       )
     end
 
@@ -21,6 +24,22 @@ module Aikido::Zen
       @source = source
       @description = description
       @ips = ips
+
+      @ipv4_ranges = []
+      @ipv6_ranges = []
+
+      ips.each do |ip|
+        if ip.ipv4?
+          @ipv4_ranges << ip.to_range
+        elsif ip.ipv6?
+          @ipv6_ranges << ip.to_range
+        else
+          raise ArgumentError, "Unsupported IP address family: #{ip.inspect}"
+        end
+      end
+
+      @ipv4_ranges.sort_by!(&:begin)
+      @ipv6_ranges.sort_by!(&:begin)
     end
 
     def inspect
@@ -28,7 +47,43 @@ module Aikido::Zen
     end
 
     def include?(ip)
-      @ips.include?(ip)
+      native_ip = nativize_ip(ip)
+      return false if native_ip.nil?
+
+      if native_ip.ipv4?
+        ranges_cover?(@ipv4_ranges, native_ip)
+      elsif native_ip.ipv6?
+        ranges_cover?(@ipv6_ranges, native_ip)
+      else
+        raise ArgumentError, "Unsupported IP address family: #{ip.inspect}"
+      end
+    end
+
+    private
+
+    def nativize_ip(ip)
+      case ip
+      when IPAddr
+        ip.native
+      when String
+        begin
+          IPAddr.new(ip).native
+        rescue IPAddr::InvalidAddressError
+          nil
+        end
+      when nil
+        nil
+      else
+        raise ArgumentError, "no explicit conversion of #{ip.class} to IPAddr"
+      end
+    end
+
+    def ranges_cover?(ranges, ip)
+      index = ranges.bsearch_index { |range| range.begin > ip }
+      index = index ? index - 1 : ranges.size - 1
+      return false if index < 0
+
+      ranges[index].cover?(ip)
     end
   end
 end

data/lib/aikido/zen/runtime_settings/ip_set.rb

@@ -20,6 +20,8 @@ module Aikido::Zen
 
     def include?(ip)
       native_ip = nativize_ip(ip)
+      return false if native_ip.nil?
+
       @ips.any? { |pattern| pattern === native_ip }
     end
     alias_method :===, :include?

data/lib/aikido/zen/version.rb

@@ -2,7 +2,7 @@
 
 module Aikido
   module Zen
-    VERSION = "1.2.1"
+    VERSION = "1.3.0.beta.1"
 
     # The version of libzen_internals that we build against.
     LIBZEN_VERSION = "0.1.60"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aikido-zen
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0.beta.1
 platform: ruby
 authors:
 - Aikido Security
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-04-14 00:00:00.000000000 Z
+date: 2026-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -82,6 +82,7 @@ files:
 - README.md
 - Rakefile
 - benchmarks/README.md
+- benchmarks/ip_list/benchmark.rb
 - benchmarks/rails7.1_benchmark.js
 - benchmarks/rails7.1_sql_injection.js
 - docs/banner.svg