Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE]PPL Add CIDR IP range command support #671

Closed
YANG-DB opened this issue Sep 16, 2024 · 1 comment
Closed

[FEATURE]PPL Add CIDR IP range command support #671

YANG-DB opened this issue Sep 16, 2024 · 1 comment
Labels
0.6 enhancement New feature or request Lang:PPL Pipe Processing Language support

Comments

@YANG-DB
Copy link
Member

YANG-DB commented Sep 16, 2024

Description:
We propose adding a CIDR (Classless Inter-Domain Routing) function to OpenSearch's Piped Processing Language (PPL) to provide built-in IP address range matching capabilities. This feature would be similar to the ip_range CIDR function already in OpenSearch, enhancing PPL's ability to work with IP addresses and network ranges.

Proposed Functionality:

  1. The CIDR function should take two arguments: an IP address and a CIDR block.
  2. It should return a boolean value indicating whether the IP address is within the specified CIDR range.
  3. The function should support both IPv4 and IPv6 addresses and ranges.
  4. It should handle various CIDR notation formats (e.g., "192.168.0.0/24" or "2001:db8::/32").

Example Usage:

... | where CIDR(src_ip, "192.168.0.0/24")

This would filter results to include only those where src_ip is within the 192.168.0.0/24 network.

... | where CIDR(dst_ip, "10.0.0.0/8") OR CIDR(dst_ip, "172.16.0.0/12") OR CIDR(dst_ip, "192.168.0.0/16")

This would filter results to include destinations in any of the private IP ranges.

... | where CIDR(ipv6_field, "2001:db8::/32")

This would filter results for IPv6 addresses within the specified range.

Implementation Considerations:

  1. Ensure efficient implementation for large-scale data processing
  2. Provide clear error handling for invalid IP addresses or CIDR notations
  3. Consider integrating with existing IP-related functions in PPL (if any)
  4. Optimize for common use cases in network security and analysis
  5. Provide comprehensive documentation with examples for both IPv4 and IPv6 usage

@YANG-DB YANG-DB added enhancement New feature or request untriaged Lang:PPL Pipe Processing Language support labels Sep 16, 2024
@YANG-DB YANG-DB moved this to Todo in PPL Commands Sep 16, 2024
@salyh salyh moved this from Todo to In Progress in PPL Commands Sep 25, 2024
@dblock dblock removed the untriaged label Oct 7, 2024
@dblock
Copy link
Member

dblock commented Oct 7, 2024

[Catch All Triage - 1, 2, 3, 4]

@YANG-DB YANG-DB added the 0.6 label Oct 9, 2024
@salyh salyh moved this from In Progress to InReview in PPL Commands Oct 29, 2024
@salyh salyh moved this from InReview to Done in PPL Commands Oct 30, 2024
@YANG-DB YANG-DB closed this as completed Nov 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
0.6 enhancement New feature or request Lang:PPL Pipe Processing Language support
Projects
Status: Done
Development

No branches or pull requests

2 participants