sql icon indicating copy to clipboard operation
sql copied to clipboard

[META]PPL Add `CIDR` IP range command support

Open YANG-DB opened this issue 1 year ago • 1 comments

Description: We propose adding a CIDR (Classless Inter-Domain Routing) function to OpenSearch's Piped Processing Language (PPL) to provide built-in IP address range matching capabilities. This feature would be similar to the ip_range CIDR function already in OpenSearch, enhancing PPL's ability to work with IP addresses and network ranges.

Proposed Functionality:

  1. The CIDR function should take two arguments: an IP address and a CIDR block.
  2. It should return a boolean value indicating whether the IP address is within the specified CIDR range.
  3. The function should support both IPv4 and IPv6 addresses and ranges.
  4. It should handle various CIDR notation formats (e.g., "192.168.0.0/24" or "2001:db8::/32").

Example Usage:

... | where CIDR(src_ip, "192.168.0.0/24")

This would filter results to include only those where src_ip is within the 192.168.0.0/24 network.

... | where CIDR(dst_ip, "10.0.0.0/8") OR CIDR(dst_ip, "172.16.0.0/12") OR CIDR(dst_ip, "192.168.0.0/16")

This would filter results to include destinations in any of the private IP ranges.

... | where CIDR(ipv6_field, "2001:db8::/32")

This would filter results for IPv6 addresses within the specified range.

Implementation Considerations:

  1. Ensure efficient implementation for large-scale data processing
  2. Provide clear error handling for invalid IP addresses or CIDR notations
  3. Consider integrating with existing IP-related functions in PPL (if any)
  4. Optimize for common use cases in network security and analysis
  5. Provide comprehensive documentation with examples for both IPv4 and IPv6 usage

Support for PPL CIDR functionality is required for both:

OpenSearch based PPL engine

  • https://github.com/opensearch-project/sql/issues/3036

Spark based PPL engine

  • https://github.com/opensearch-project/opensearch-spark/issues/671

YANG-DB avatar Sep 16 '24 22:09 YANG-DB

[Catch All Triage - 1, 2, 3, 4]

dblock avatar Oct 07 '24 16:10 dblock