Add support for CIDR ranges in ignore_hosts setting.

[shikharj05]

Description

This change adds support to specify CIDR ranges in ignore_hosts settings.

• Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation) Enhancement
• Why these changes are required?
  While ignore_hosts currently supports specifying IP addresses and hostnames, it would be good to support adding CIDR ranges as well. For example, see comment here- [Feature Request] Request to Document Behaviour Change in Unauthenticated Request Handling in OpenSearch 2.11.0 or later #4927 (comment)
• What is the old behavior before changes and new behavior after changes?
  Adding support for CIDR ranges in ignore_hosts

Issues Resolved

#4927

Is this a backport? If so, please add backport PR # and/or commits #, and remove backport-failed label from the original PR.

Do these changes introduce new permission(s) to be displayed in the static dropdown on the front-end? If so, please open a draft PR in the security dashboards plugin and link the draft PR here

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• [TODO] New functionality has been documented
• [NA] New Roles/Permissions have a corresponding security dashboards plugin PR
• [NA] API changes companion pull request created
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

Attention: Patch coverage is 77.77778% with 12 lines in your changes missing coverage. Please review.

Project coverage is 71.54%. Comparing base (e1c05c3) to head (ac5cd05).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...org/opensearch/security/support/SecurityUtils.java	77.77%	3 Missing and 3 partials ⚠️
...a/org/opensearch/security/util/IPAddressUtils.java	75.00%	2 Missing and 2 partials ⚠️
.../org/opensearch/security/auth/BackendRegistry.java	66.66%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5099      +/-   ##
==========================================
- Coverage   71.55%   71.54%   -0.02%     
==========================================
  Files         336      337       +1     
  Lines       22649    22690      +41     
  Branches     3603     3609       +6     
==========================================
+ Hits        16206    16233      +27     
- Misses       4641     4655      +14     
  Partials     1802     1802              

Files with missing lines	Coverage Δ
...ch/security/auth/limiting/AbstractRateLimiter.java	96.15% <100.00%> (+0.69%)	⬆️
.../org/opensearch/security/auth/BackendRegistry.java	77.67% <66.66%> (-0.73%)	⬇️
...a/org/opensearch/security/util/IPAddressUtils.java	75.00% <75.00%> (ø)
...org/opensearch/security/support/SecurityUtils.java	70.51% <77.77%> (+3.84%)	⬆️

... and 9 files with indirect coverage changes

[cwperks]

Thank you for this PR @shikharj05. We will also want to update the documentation accordingly.

We could also consider adding support for config.dynamic.hosts_resolver_mode: ip-hostname or config.dynamic.hosts_resolver_mode: ip-hostname-lookup (IP + Hostname resolution when looking at requests) in a future feature request. Currently this only supports config.dynamic.hosts_resolver_mode: ip-only

^ Looks like these cases are already being handled as well

[shikharj05]

Thank you for this PR @shikharj05. We will also want to update the documentation accordingly.

Ack, will create a separate PR for docs.

[nibix]

If I see it correctly, SubnetUtils and SubnetInfo only support IPv4. If hostAddress is in IPv6 format, it will throw an IllegalArgumentException:

https://github.com/apache/commons-net/blob/aeaa37e9753ce9920c91d22493e074781ef69ff3/src/main/java/org/apache/commons/net/util/SubnetUtils.java#L395C19-L395C43

I guess, we also need to support IPv6?

[shikharj05]

sure, will add support for ipv6.

[nibix]

I do not think that using / is sufficient for identifying CIDRs. The ignore_hosts property supports the whole wildcard matcher feature set which also supports specifying regexes using the /regex/ syntax. This would also hit on these regexes.

[shikharj05]

good catch. one of the options is to implement regex check for ipv4/ipv6 addresses to identify CIDRs specifically - will check other options and update the PR

[cwperks]

You can also keep it simple and get the last index of / as long as / is not the final char in the string