yyqdbngt opened a new issue, #2246: URL: https://github.com/apache/rocketmq-dashboard/issues/2246
## Problem ACL 2.0 whitelist validation accepts IPv4 literals/CIDRs and the all-address IPv6 wildcard `::/0`, but rejects every scoped IPv6 literal and CIDR. A dual-stack deployment can therefore either allow every IPv6 address or cannot express an IPv6 whitelist at all. This prevents least-privilege rules such as `2001:db8:10::/64` and also rejects an exact IPv6 client address. ## Expected behavior - Accept valid IPv4 and IPv6 literals and CIDRs. - Match equivalent compressed and expanded IPv6 forms by address bytes. - Enforce 32-bit and 128-bit prefix limits for the respective families. - Fail closed for malformed input, address-family mismatches, hostnames, and scoped interface addresses. - Preserve the existing IPv4 and all-address wildcard behavior. ## Proposed scope Extend the shared `IpRangeMatcher` to parse address literals without DNS resolution, perform family-aware prefix matching, and add focused IPv6, invalid-input, and compatibility tests. ## Duplicate check Searched open and closed issues and pull requests for IPv6 ACL whitelist, IPv6 CIDR matching, and `IpRangeMatcher`. No matching implementation was found, and no current pull request targeting `rocketmq-studio` changes the matcher or its test. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
