[OpenNMS/opennms] 81045e: NMS-19980: reject descending ranges and compressed...

  Branch: refs/heads/mm/NMS-19980-smoke
  Home:   https://github.com/OpenNMS/opennms
  Commit: 81045e4a3171f5e1f6ec1f3298369335f248b876
      https://github.com/OpenNMS/opennms/commit/81045e4a3171f5e1f6ec1f3298369335f248b876
  Author: Marshall Massengill <[email protected]>
  Date:   2026-07-24 (Fri, 24 Jul 2026)

  Changed paths:
    M core/lib/src/main/java/org/opennms/core/utils/IplikeSqlTranslator.java
    M core/lib/src/test/java/org/opennms/core/utils/IplikeSqlTranslatorTest.java
    M core/schema/src/main/resources/org/opennms/core/schema/iplike.sql
    M core/test-api/db/src/test/java/org/opennms/core/test/db/IPLikeCoverageIT.java

  Log Message:
  -----------
  NMS-19980: reject descending ranges and compressed IPv6 (review fixes)

Two defects found in PR review:

* A descending range after broad fields (0-ffff:0-ffff:1-0:0:0:0:0:0)
  stored [1,0] as a segment; recurse() then enumerated every preceding
  combination (65536^2 and up) through a zero-iteration loop that never
  added a range, so the MAX_RANGES backstop could not fire and one
  short filter string could pin a request thread for minutes to
  effectively forever. Descending segments match nothing in iplike()
  (BETWEEN lo AND hi), so they are now dropped like above-maximum
  elements before expansion; a rule whose segments all drop stays
  untranslatable and falls back to iplike(), which returns false for
  it — semantics unchanged, the reported pattern returns immediately.

* The revision-2 LIKE guard ('%:%:%:%:%:%:%:%') admits a middle
  one-group-compressed IPv6 value such as fe80::1:2:3:4:5:6 (seven
  colons, valid to ::inet), and ltrim(..., ':') then swallows the '::'
  and shifts every later field: the shifted rule matched and the
  correct expansion did not. The revision-1 regex required eight
  nonempty groups and rejected the whole compressed class; a
  strpos(address, '::') = 0 check on the zone-stripped value restores
  exactly that without reintroducing regexes. Fixed in place under the
  unreleased opennms-iplike-plpgsql-2 tag.

Regression tests: the reported descending pattern must return within
the test timeout, list elements around a descending segment still
match, the shifted/correct-expansion rule pairs are pinned false, and
the unrepresentable-values sweep gains the compressed forms (both
polarities, iplike() and native predicates).



To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs