Fix CIDR trie lookups honoring TTLs (#26854)

* Fix CIDR trie lookups honoring TTLs

* changelog

Author: kingzacko1

changelog/unreleased/pr-26854.toml

@@ -0,0 +1,4 @@
+type = "f"
+message = "Fixed Enterprise MongoDB Data Adapter CIDR entries being cached up to one hour after their TTL had expired."
+
+pulls = ["26854"]

graylog2-server/src/main/java/org/graylog2/utilities/CIDRPatriciaTrie.java

@@ -113,8 +113,20 @@ public void insertCIDR(String cidr, String rangeName, long expireAfter) {
         }
     }
 
+    /**
+     * Returns the rangeName of the range with the longest prefix that contains the IP address, ignoring any
+     * range whose TTL has elapsed, or null if no live range contains it.
+     *
+     * <p>An expired range is skipped rather than terminating the search, so a lookup falls through to a
+     * shorter enclosing range that is still live.
+     *
+     * @param ip IP address to check against the collection of ranges
+     * @return the name of the longest-prefix live range containing the IP if one exists, null otherwise
+     * @see #longestPrefixRangeLookupWithTtl(String, long) to supply an explicit lookup time, or 0 to ignore
+     * expiry entirely
+     */
     public String longestPrefixRangeLookup(String ip) {
-        return longestPrefixRangeLookupWithTtl(ip, 0L);
+        return longestPrefixRangeLookupWithTtl(ip, DateTime.now(DateTimeZone.UTC).getMillis());
     }
 
     /**

graylog2-server/src/test/java/org/graylog2/utilities/CIDRPatriciaTrieTest.java

@@ -105,10 +105,12 @@ public void testCleanCopy() {
             // Copy should be a deep copy.
             assertThat(copy).isNotSameAs(trie);
             // No operations performed on the original trie, so all nodes should still exist in the trie.
+            // Probed with an explicit lookup time of 0 to ignore expiry: the point here is that cleanCopy
+            // did not mutate the original, not whether these nodes have expired (two of them have).
             assertThat(trie).satisfies(t -> {
-                assertThat(t.longestPrefixRangeLookup("192.168.1.100")).isEqualTo("IPv4 Range 1");
-                assertThat(t.longestPrefixRangeLookup("10.0.5.1")).isEqualTo("IPv4 Range 2");
-                assertThat(t.longestPrefixRangeLookup("35.139.253.123")).isEqualTo("IPv4 Range 3");
+                assertThat(t.longestPrefixRangeLookupWithTtl("192.168.1.100", 0L)).isEqualTo("IPv4 Range 1");
+                assertThat(t.longestPrefixRangeLookupWithTtl("10.0.5.1", 0L)).isEqualTo("IPv4 Range 2");
+                assertThat(t.longestPrefixRangeLookupWithTtl("35.139.253.123", 0L)).isEqualTo("IPv4 Range 3");
             });
             // Confirm two nodes with TTLs have been cleaned out of the copy and the one without a TTL has not.
             assertThat(copy).satisfies(t -> {
@@ -146,6 +148,52 @@ public void testCleanCopyExpiredNodes() {
         }
     }
 
+    @Test
+    public void testLookupSkipsExpiredRange() {
+        try {
+            final CIDRPatriciaTrie trie = new CIDRPatriciaTrie();
+            final long expireAt = DateTime.now(DateTimeZone.UTC).getMillis() + 500L;
+            trie.insertCIDR("192.168.1.0/24", "Expiring Range", expireAt);
+            trie.insertCIDR("10.0.0.0/8", "Permanent Range");
+
+            // Before expiry both resolve.
+            assertThat(trie.longestPrefixRangeLookup("192.168.1.100")).isEqualTo("Expiring Range");
+            assertThat(trie.longestPrefixRangeLookup("10.0.5.1")).isEqualTo("Permanent Range");
+
+            DateTimeUtils.setCurrentMillisOffset(501);
+
+            // The expired range no longer matches, even though cleanCopy has not run and the node is
+            // still present in the trie.
+            assertThat(trie.longestPrefixRangeLookup("192.168.1.100")).isNull();
+            assertThat(trie.longestPrefixRangeLookupWithTtl("192.168.1.100", 0L)).isEqualTo("Expiring Range");
+
+            // A range without a TTL is unaffected.
+            assertThat(trie.longestPrefixRangeLookup("10.0.5.1")).isEqualTo("Permanent Range");
+        } finally {
+            DateTimeUtils.setCurrentMillisSystem();
+        }
+    }
+
+    @Test
+    public void testLookupFallsBackToLiveEnclosingRangeWhenLongestPrefixExpired() {
+        try {
+            final CIDRPatriciaTrie trie = new CIDRPatriciaTrie();
+            final long expireAt = DateTime.now(DateTimeZone.UTC).getMillis() + 500L;
+            trie.insertCIDR("10.1.2.0/24", "Specific Expiring", expireAt);
+            trie.insertCIDR("10.0.0.0/8", "Broad Permanent");
+
+            // The more specific range wins while it is live.
+            assertThat(trie.longestPrefixRangeLookup("10.1.2.42")).isEqualTo("Specific Expiring");
+
+            DateTimeUtils.setCurrentMillisOffset(501);
+
+            // Once it expires the search continues to the shorter enclosing range rather than giving up.
+            assertThat(trie.longestPrefixRangeLookup("10.1.2.42")).isEqualTo("Broad Permanent");
+        } finally {
+            DateTimeUtils.setCurrentMillisSystem();
+        }
+    }
+
     @Test
     public void testToBinaryIP() {
         String cidrBinary = CIDRPatriciaTrie.toBinaryString("2002:0000:0000:1234:0000:0000:0000:0000", 64);