IP classification with ip_cidr_contains - is there an optimal approach??

[enotspe]

Hello, I want to classify the IP type os a given ip. I have come around with this code

# Function to classify an IP address based on its type
if ip_cidr_contains("10.0.0.0/8", .ip) ||
   ip_cidr_contains("172.16.0.0/12", .ip) ||
   ip_cidr_contains("192.168.0.0/16", .ip) {
    .ip_type = "private"
} else if ip_cidr_contains("127.0.0.0/8", .ip) {
    .ip_type = "loopback"
} else if ip_cidr_contains("169.254.0.0/16", .ip) {
    .ip_type = "link_local"
} else if ip_cidr_contains("224.0.0.0/4", .ip) {
    .ip_type = "multicast"
} else if ip_cidr_contains("100.64.0.0/10", .ip) {
    .ip_type = "carrier_nat"
} else if ip_cidr_contains("192.0.0.0/24", .ip) ||
          ip_cidr_contains("192.0.2.0/24", .ip) ||
          ip_cidr_contains("198.51.100.0/24", .ip) ||
          ip_cidr_contains("203.0.113.0/24", .ip) {
    .ip_type = "documentation"
} else if ip_cidr_contains("240.0.0.0/4", .ip) {
    .ip_type = "reserved"
} else {
    .ip_type = "public"
}

it works fine, but i dont like so many if. I dont think that is very optimal. Is there a better way to do it?

[pront]

For completeness, copy pasting discord answer:

bfung_ — 2/10/25, 18:10
👋  that's the only way to do it today.  It might not be pretty, but it's very clear what it does!

[enotspe]

it seems that chatgpt has a different opinion lol.

Although not very sure if this approach is more efficient, certainly code looks cleaner.

      # Define a map of IP ranges and their classifications
      range_map = {
          "10.0.0.0/8": "private",
          "172.16.0.0/12": "private",
          "192.168.0.0/16": "private",
          "127.0.0.0/8": "loopback",
          "169.254.0.0/16": "link_local",
          "224.0.0.0/4": "multicast",
          "100.64.0.0/10": "carrier_nat",
          "192.0.0.0/24": "documentation",
          "192.0.2.0/24": "documentation",
          "198.51.100.0/24": "documentation",
          "203.0.113.0/24": "documentation",
          "240.0.0.0/4": "reserved",
          
          # IPv6 Ranges
          "::1/128": "loopback",
          "fc00::/7": "private",  # Unique Local Addresses (ULA)
          "fe80::/10": "link_local",
          "ff00::/8": "multicast",
          "100::/64": "discard",  # RFC 6666
          "2001:db8::/32": "documentation",  # RFC 3849
          "2002::/16": "6to4_tunnel",
          "::ffff:0:0/96": "ipv4_mapped",
          "::/128": "unspecified",
          "::ffff:0:0:0/96": "ipv4_translated",
          "2001::/23": "reserved",  # IANA reserved block
          "4000::/2": "reserved"   # Reserved for future use
      }
      
      # Default to "public"
      .source.ip_type = "public"
      
      # Check which range the IP belongs to
      for_each(range_map) -> |cidr, ip_type| {
          if ip_cidr_contains!(cidr, to_string!(.source.ip)) {
              .source.ip_type = ip_type
          }
      }

what it would be more efficient for sure would be if there would be a way to break the for_each iteration

      for_each(range_map) -> |cidr, ip_type| {
          if ip_cidr_contains!(cidr, to_string!(.source.ip)) {
              .source.ip_type = ip_type
              break
          }
      }

but break is not supported and reserved for future use

error[E205]: reserved keyword
   ┌─ :46:9
   │
46 │         break
   │         ^^^^^
   │         │
   │         this identifier name is reserved for future use in the language
   │         use a different name instead
   │
   = see language documentation at https://vrl.dev
   = try your code in the VRL REPL, learn more at https://vrl.dev/examples

[pront]

what it would be more efficient for sure would be if there would be a way to break the for_each iteration

I agree, a break would be nice; you can create a new feature request here: https://github.com/vectordotdev/vrl/issues

Not convinced about the efficiency part. If you can make assumptions about frequency and order them accordingly then still the multiple if blocks might be the best.

[enotspe]

normally private IPs would be first to hit, so if we can check that first and break, that might be as efficient as the if block approach.

Certainly defining a map object and looping over it is easier to maintain (and to look at it)

[JakubOnderka]

Since Vector 0.45, you can write it like this:

# Function to classify an IP address based on its type
if ip_cidr_contains(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]  .ip) {
    .ip_type = "private"
} else if ip_cidr_contains("127.0.0.0/8", .ip) {
    .ip_type = "loopback"
} else if ip_cidr_contains("169.254.0.0/16", .ip) {
    .ip_type = "link_local"
} else if ip_cidr_contains("224.0.0.0/4", .ip) {
    .ip_type = "multicast"
} else if ip_cidr_contains("100.64.0.0/10", .ip) {
    .ip_type = "carrier_nat"
} else if ip_cidr_contains(["192.0.0.0/24", "192.0.2.0/24", "198.51.100.0/24", "203.0.113.0/24"], .ip) {
    .ip_type = "documentation"
} else if ip_cidr_contains("240.0.0.0/4", .ip) {
    .ip_type = "reserved"
} else {
    .ip_type = "public"
}