Determine allow/deny for an IP via CIDR rules

Problem

You are implementing a simple IPv4 firewall.

You are given an ordered list of rules. Each rule has:

• an action : either ALLOW or DENY
• a CIDR block in the form a.b.c.d/p (e.g., 192.168.0.0/16 )

You are also given a query IPv4 address ip (e.g., 192.168.1.10).

A rule matches the IP if the IP is within the rule’s CIDR range.

Task

Return the action for the first rule in the list that matches ip. If no rule matches, return a configurable default action (assume ALLOW unless stated otherwise).

Input / Output

• Input: rules (list of (action, cidr) ), and ip
• Output: "ALLOW" or "DENY"

Notes / Constraints

• IPv4 only.
• Rules may overlap.
• CIDR prefix length p is in [0, 32] .
• You may assume all inputs are well-formed strings.