Add isIpPrefix

Makefile

@@ -15,7 +15,7 @@ ARGS ?= --strict --strict_message --strict_error
 # Set to use a different version of protovalidate-conformance.
 # Should be kept in sync with the version referenced in proto/buf.lock and
 # 'buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go' in go.mod.
-CONFORMANCE_VERSION ?= v0.4.3
+CONFORMANCE_VERSION ?= v0.5.1
 
 .PHONY: help
 help: ## Describe useful make targets

celext/lib.go

@@ -19,6 +19,7 @@ import (
 	"math"
 	"net"
 	"net/mail"
+	"net/netip"
 	"net/url"
 	"strings"
 
@@ -168,6 +169,56 @@ func (l lib) CompileOptions() []cel.EnvOption {
 					return types.Bool(l.validateIP(addr, vers))
 				})),
 		),
+		cel.Function("isIpPrefix",
+			cel.MemberOverload(
+				"string_is_ip_prefix_bool",
+				[]*cel.Type{cel.StringType},
+				cel.BoolType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					prefix, ok := args[0].Value().(string)
+					if !ok {
+						return types.Bool(false)
+					}
+					return types.Bool(l.validateIPPrefix(prefix, 0, false))
+				})),
+			cel.MemberOverload(
+				"string_int_is_ip_prefix_bool",
+				[]*cel.Type{cel.StringType, cel.IntType},
+				cel.BoolType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					prefix, pok := args[0].Value().(string)
+					vers, vok := args[1].Value().(int64)
+					if !pok || !vok {
+						return types.Bool(false)
+					}
+					return types.Bool(l.validateIPPrefix(prefix, vers, false))
+				})),
+			cel.MemberOverload(
+				"string_bool_is_ip_prefix_bool",
+				[]*cel.Type{cel.StringType, cel.BoolType},
+				cel.BoolType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					prefix, pok := args[0].Value().(string)
+					strict, sok := args[1].Value().(bool)
+					if !pok || !sok {
+						return types.Bool(false)
+					}
+					return types.Bool(l.validateIPPrefix(prefix, 0, strict))
+				})),
+			cel.MemberOverload(
+				"string_int_bool_is_ip_prefix_bool",
+				[]*cel.Type{cel.StringType, cel.IntType, cel.BoolType},
+				cel.BoolType,
+				cel.FunctionBinding(func(args ...ref.Val) ref.Val {
+					prefix, pok := args[0].Value().(string)
+					vers, vok := args[1].Value().(int64)
+					strict, sok := args[2].Value().(bool)
+					if !pok || !vok || !sok {
+						return types.Bool(false)
+					}
+					return types.Bool(l.validateIPPrefix(prefix, vers, strict))
+				})),
+		),
 		cel.Function("isUri",
 			cel.MemberOverload(
 				"string_is_uri_bool",
@@ -371,3 +422,23 @@ func (l lib) validateIP(addr string, ver int64) bool {
 		return false
 	}
 }
+
+func (l lib) validateIPPrefix(p string, ver int64, strict bool) bool {
+	prefix, err := netip.ParsePrefix(p)
+	if err != nil {
+		return false
+	}
+	if strict && (prefix.Addr() != prefix.Masked().Addr()) {
+		return false
+	}
+	switch ver {
+	case 0:
+		return true
+	case 4:
+		return prefix.Addr().Is4()
+	case 6:
+		return prefix.Addr().Is6()
+	default:
+		return false
+	}
+}

celext/lib_test.go

@@ -101,6 +101,82 @@ func TestCELLib(t *testing.T) {
 				"[b'123', b'123'].unique()",
 				false,
 			},
+			{
+				"'1.2.3.0/24'.isIpPrefix()",
+				true,
+			},
+			{
+				"'1.2.3.4/24'.isIpPrefix()",
+				true,
+			},
+			{
+				"'1.2.3.0/24'.isIpPrefix(true)",
+				true,
+			},
+			{
+				"'1.2.3.4/24'.isIpPrefix(true)",
+				false,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118'.isIpPrefix()",
+				true,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118'.isIpPrefix()",
+				true,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118'.isIpPrefix(true)",
+				false,
+			},
+			{
+				"'1.2.3.4'.isIpPrefix()",
+				false,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:430b'.isIpPrefix()",
+				false,
+			},
+			{
+				"'1.2.3.0/24'.isIpPrefix(4)",
+				true,
+			},
+			{
+				"'1.2.3.4/24'.isIpPrefix(4)",
+				true,
+			},
+			{
+				"'1.2.3.0/24'.isIpPrefix(4,true)",
+				true,
+			},
+			{
+				"'1.2.3.4/24'.isIpPrefix(4,true)",
+				false,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118'.isIpPrefix(4)",
+				false,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118'.isIpPrefix(6)",
+				true,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118'.isIpPrefix(6)",
+				true,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:4000/118'.isIpPrefix(6,true)",
+				true,
+			},
+			{
+				"'fd7a:115c:a1e0:ab12:4843:cd96:626b:430b/118'.isIpPrefix(6,true)",
+				false,
+			},
+			{
+				"'1.2.3.0/24'.isIpPrefix(6)",
+				false,
+			},
 		}
 
 		for _, tc := range tests {

go.mod

@@ -3,7 +3,7 @@ module github.com/bufbuild/protovalidate-go
 go 1.19
 
 require (
-	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.31.0-20230914171853-63dfe56cc2c4.1
+	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.31.0-20231030212536-12f9cba37c9d.2
 	github.com/envoyproxy/protoc-gen-validate v1.0.2
 	github.com/google/cel-go v0.18.1
 	github.com/stretchr/testify v1.8.4

go.sum

@@ -1,5 +1,7 @@
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.31.0-20230914171853-63dfe56cc2c4.1 h1:2gmp+PRca1fqQHf/WMKOgu9inVb0R0N07TucgY3QZCQ=
 buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.31.0-20230914171853-63dfe56cc2c4.1/go.mod h1:xafc+XIsTxTy76GJQ1TKgvJWsSugFBqMaN27WhUblew=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.31.0-20231030212536-12f9cba37c9d.2 h1:m8rKyv88R8ZIR1549RMXckZ4FZJGxrq/7aRYl6U3WHc=
+buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.31.0-20231030212536-12f9cba37c9d.2/go.mod h1:xafc+XIsTxTy76GJQ1TKgvJWsSugFBqMaN27WhUblew=
 github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230512164433-5d1fd1a340c9 h1:goHVqTbFX3AIo0tzGr14pgfAW2ZfPChKO21Z9MGf/gk=
 github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230512164433-5d1fd1a340c9/go.mod h1:pSwJ0fSY5KhvocuWSx4fz3BA8OrA1bQn+K1Eli3BRwM=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=