ColdFusion isIPInRange() UDF to support IPv4, IPv6, CIDR & Regex
Tags: coldfusion, cidr, regex, java
Published: 2020-01-09 19:20:52

I received reports of 502 server errors this morning after our web application framework accidentally blacklisted our CDN/WAF provider.  I wanted to ensure that this wouldn't happen again by whitelisting their IPs, but they have many IPs and their data was only available in IPv4 & IPv6 CIDR notation.

ColdFusion doesn't have any built-in IP-related tools other than determining the IP of the current host... so I'm off to search for a potential existing solution.

I checked [CFDocs](https://cfdocs.org/) and discovered that there was an [isIPInRange](https://cfdocs.org/isipinrange) function (without any examples), but it was a [Lucee-only function](https://docs.lucee.org/reference/functions/isipinrange.html). The Lucee function accepts either a comma-separated list or an array of IP definitions, but doesn't support CIDR or Regex.

I checked [CFLib](https://cflib.org/) and discovered that there was a [isIPInRange UDF](https://cflib.org/udf/isIPInRange) with the same name from 2005 that used a list of regex values, but it didn't support CIDR or dash-delimited range (well, unless you wanted to write the regex for that).

I had been using a method that [Anjo Gakhar](https://twitter.com/anujgakhar) blogged about in 2008 that demonstrates the use of the [undocumented coldfusion.util.IPAddressUtils class](https://www.anujgakhar.com/2008/02/21/validate-ip-address-natively-with-coldfusion/) to identify whether a string is a valid IPv4 or IPv6 IP address or not.

I then found a 2018 blog post by [Ben Nadel](https://twitter.com/BenNadel) documenting his implementation of using [Commons IP Math to check if an IPv4 or IPv6 IP exists in a CIDR range](https://www.bennadel.com/blog/3503-using-commons-ip-math-to-check-if-an-ip-address-exists-in-an-ipv4-or-ipv6-cidr-range-in-coldfusion.htm), but it is dependent on separate java library (MIT) called [Commons IP Math](https://github.com/jgonian/commons-ip-math).  The code example also only supported a single CIDR range.

Since none of the existing solutions fully covered my needs, I decided to write my own ColdFusion UDF and combine the best features from all of them.
* Performs IPv4 & IPv6 validation
* Supports IPv4 & IPv6 CIDR range notation
* Supports list or array of ranges
* Supports regex range rules
* Supports dash-delimited IP address range
* Supports single IP (versus a range)
* Requires [Commons IP Math JAR File](https://maven-badges.herokuapp.com/maven-central/com.github.jgonian/commons-ip-math)

Since all my web applications are behind a CDN/WAF and could be negatively impacted if the CDN was blacklisted, I figured it was best for me to add the JAR to the global path instead of using Javaloader.  I also didn't write this as a stand-alone CFC like Ben does.  Most of my projects use a global UDF library and this was the simplest approach to integrate since I wouldn't have to manually update every project.

## Source Code
Here's a link to the [gist](https://gist.github.com/JamoCA/27cf5307d7b8854c62539fdeebbea51f).  Due to the JAR requirement, this unfortunately can't be demoed using [TryCF](https://www.trycf.com/).

{% gist https://gist.github.com/JamoCA/27cf5307d7b8854c62539fdeebbea51f %}
[https://gist.github.com/JamoCA/27cf5307d7b8854c62539fdeebbea51f ]