messere1 commented on issue #407:
URL:
https://github.com/apache/rocketmq-dashboard/issues/407#issuecomment-4915114907
Thanks for reporting this. I investigated the ACL source code and can
confirm the root cause.
### Root Cause
The IP whitelist matching logic in `IPAddressUtils.isIPInRange()`
(`common/src/main/java/org/apache/rocketmq/common/utils/IPAddressUtils.java`)
works as follows:
```java
public static boolean isIPInRange(String ip, String cidr) {
String[] parts = cidr.split(SLASH);
if (parts.length == 1) {
return StringUtils.equals(ip, cidr); // ← exact string match
}
// ... CIDR range matching ...
}
```
When `whiteRemoteAddress` is set to `0.0.0.0` (without a `/` suffix), the
method falls into the `parts.length == 1` branch and performs an **exact string
comparison** — so it only matches a client whose source IP is literally
`0.0.0.0`, which is never the case for real connections. This is why @hb520
observed that `0.0.0.0` doesn't wildcard all IPs — it only matches that single
IP.
### Workaround
Use **CIDR notation** to allow all IPv4 addresses:
```
0.0.0.0/0
```
This will correctly match any IPv4 source address.
### Dashboard-side Improvement
From the dashboard perspective, this is a UX issue — the ACL IP whitelist
input could benefit from:
1. **A hint/placeholder** indicating CIDR notation (e.g., `0.0.0.0/0`,
`192.168.1.0/24`) is expected for range matching.
2. **Input validation** — warn when a bare IP like `0.0.0.0` is entered,
suggesting `0.0.0.0/0` instead.
I'd be happy to submit a PR for this if maintainers agree on the approach.
@hb520 Could you confirm your RocketMQ version (4.x / 5.x)? This will help
determine whether a server-side fix (treating bare `0.0.0.0` as wildcard)
should also be considered.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
