I’ve been moving visualchat.co.uk to ruby on rails recently and one of the things they have to do is block certain ip addresses, in fact, entire ranges of ip addresses, as they get a lot of naughty mischievous chilldren (read as fucktards) creating havoc.

I tinkered about a bit and then asked on #ruby-lang where one David Black answered the call. The code he gave me is my favourite bit of ruby code ever. I think his method of comparing ip addresses is so very nice it’s unbelievable.

He told me to create an ip address class, which includes the comparable mixin (see here for more info).

Like this:

  2. module Infrid
  3. class IPAddress
  4. include Comparable
  6. def initialize(address)
  7. @address = address
  8. end
  10. def split
  11. @address.split(‘.‘).map {|s| s.to_i }
  12. end
  14. def <=>(other)
  15. split <=> other.split
  16. end
  18. def to_s
  19. @address
  20. end
  21. end
  22. end

Note that I put this code in my own Infrid module which I store in lib/Infrid of my rails app.

Now you can create ip address objects, and do code like this.

  1. ip_address_a = IPAddress.new(‘127.0.0.1‘)
  2. ip_address_b = IPAddress.new(‘126.0.0.1‘)
  3. ip_address_c = IPAddress.new(‘127.4.34.3‘)
  5. ip_address_a < ip_address_b
  6. >> true
  7. ip_address_a > ip_address_c
  8. >> true
  9. ip_address_a.between ip_address_b, ip_address_c
  10. >> true

How cool is that?

I then use this in my rails app to check if an ip address is banned. I have a banned_ip model which keeps ranges of ip’s using first_ip and last_ip.

It looks like this:

  2. class BannedIp < ActiveRecord::Base
  3. @banned_ips # hash of ips and masks
  5. validates_presence_of :first_ip, :message =>"first address is needed"
  6. validates_presence_of :last_ip, :message =>"last address is needed"
  7. validates_format_of :first_ip, :with => REG_IP, :message => "is invalid (must be x.x.x.x where x is 0-255)", :if => Proc.new {|ar| !ar.first_ip.blank? }
  8. validates_format_of :last_ip, :with => REG_IP, :message => "is invalid (must be x.x.x.x where x is 0-255)", :if => Proc.new {|ar| !ar.last_ip.blank? }
  10. def self.banned?(ip)
  11. reload_banned_ips if @banned_ips.nil?
  12. begin
  13. ip = Infrid::IPAddress.new(ip)
  14. @banned_ips.each { |b|
  15. return true if ip.between?(b[0], b[1])
  16. }
  17. rescue
  18. logger.info "IP FORMAT ERROR"
  19. return true
  20. end
  21. false
  22. end
  24. def self.banned_ips
  25. reload_banned_ips if @banned_ips.nil?
  26. @banned_ips.collect {|b| b[0].to_s + ".." + b[1].to_s }.join"\n"
  27. end
  29. #keeps a cache of all banned ip ranges
  30. def self.reload_banned_ips
  31. r = connection.select_all("select first_ip, last_ip from banned_ips")
  32. if !r
  33. @banned_ips=[]
  34. end
  35. @banned_ips = r.map {|item| [Infrid::IPAddress.new(item["first_ip"]),Infrid::IPAddress.new(item["last_ip"])] }
  36. end
  37. end

You can then call the banned? method with the ip address from the request, e.g. request.remote_ip, or any other ip you want.

It’s worth noting that I have this reload_banned_ips method which stores my ip address objects in a static variable @banned_ips. My reasoning for this is that I don’t want to go back to the db and create ip_address objects every single time I check if an ip address is banned.

I’ll talk about this and my “non-drb-drb” rails technique for saving on db activity in a future blog post.

Also, a note for the pedants, I wouldn’t have done any of this if I wasn’t checking an ip address falls within a range, in which case it would’ve been a straight forward string comparison.

Again, thanks to David Black, who turned me on to the comparable module and in doing so showed me some kick arse , yet very elegant rails moves. His website is www.rubypal.com