CIDR search returns incorrect results

[Tyr Johanson]

Search for 172.24.4.0/24 returned private subnet with /24 in subnet range, but totally different subnet range.

[Steve McLellan (sjmc7)]

A search for 172.24.4.0/24 will be treated as a search for:

{"_all": ["172", "24", "4", "0", "24]}

The search term won't automatically be treated as an IP range search.

[Tyr Johanson (tyr-6)]

According to search help in UI

IP Addresses
172.24.4.0/16 [10.0.0.1 TO 10.0.0.4]

IPv4 addresses may be searched based on ranges and with CIDR notation.

[Steve McLellan (sjmc7)]

The query coming out of the UI is (using 192.168.20.0/24 as that's my example data):

  {query_string: {query: "192.168.20.0\/24", phrase_slop: 10, lenient: true, analyze_wildcard: true}}

The documentation's incorrect; CIDRs are not valid in query_strings (though it looks like it's getting added in Elasticsearch 5.0 https://github.com/elastic/elasticsearch/pull/14773).

The equivalent "range" query ([172.40.0.8 TO 172.40.0.14]) DOES work on fields mapped as "ip" types, but as an additional wrinkle, since most of them are in nested document types it can't be done in a simple query_string since nested fields are ALSO not supported in query_strings. For instance, this works with Servers:

  "query": {"nested": {"path": "networks", "query": {"query_string": {"query": "networks.ipv4_addr:[172.40.0.8 TO 172.40.0.14]"}}}}

This does not:

  "query": {"query_string": {"query": "networks.ipv4_addr:[172.40.0.8 TO 172.40.0.14]"}}}}

Finally, none of the subnet fields are mapped as "ip" fields because Lucene (and thus Elasticsearch) didn't support IPv6 data in ip fields until Elasticsearch 5, so many fields that contain IP addresses are only mapped as strings.

For now I think the solution is to remove reference to CIDR-type searches, and deemphasise IP range-type searches. I think we should also denormalize v4-type IP addresses on all resource types that make sense (so add ipv4 and ipv6 fields to resources that have IP addresses).

[Steve McLellan (sjmc7)]

I stand corrected; support was added for mask type queries in 2.2. However, it requires that you specify the field (since the _all field doesn't know about IP addresses).

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/382572