MDEV-25515 Request: User Account Host Names using CIDR notation

[pranavktiwari]

MDEV-25515 User Account Host Names using CIDR notation

Accept CIDR notation (RFC 4632) as an alternative spelling of the ip/netmask host form, matching MySQL 8.0.23 (WL#14074):

CREATE USER u@'192.168.0.0/24';  -- same as '192.168.0.0/255.255.255.0'

update_hostname() tries the dotted-quad mask first and falls back to the
new calc_cidr(), so both spellings yield the same acl_host_and_ip and are
interchangeable wherever a host is used - user, db, table, routine and
proxy privileges, and the plugin API. IPv4 only. The host string is
stored and reported verbatim; neither spelling is normalised.

Add is_valid_masked_host(), rejecting at DDL time what was previously
accepted and left silently unusable:

- a prefix outside 1..32, or a mask of 0.0.0.0
- a non-contiguous mask, e.g. 10.0.0.0/255.0.255.0
- an address with host bits set, e.g. 10.1.2.3/24
- anything containing '/' that is not a dotted quad, including IPv6
  prefixes such as 2001:db8::/32

The check runs in replace_user_table(), covering CREATE USER and every
GRANT variant that can auto-create an account, and in mysql_rename_user()
for the rename target. It applies only to rows about to be created:

- existing rows are not validated, so an account created by an older
  version stays revocable, renamable and droppable
- acl_load() is unchanged, so a malformed row in the privilege tables
  cannot prevent the server from starting
- RENAME USER validates the target only, so such an account can be
  repaired by renaming it onto a valid host

New error ER_INVALID_HOST_NETMASK.

acl_user_compare() now compares ip_mask before the host string, treating
an unmasked host as /32, so the most specific subnet wins:

u@'10.0.0.0/24' is preferred over u@'10.0.0.0/8'

This corrects precedence for existing netmask accounts as well, and
applies to acl_users only; acl_dbs, acl_hosts, acl_proxy_users and the
table/routine grant hashes are left unchanged.

[Copilot]

Pull request overview

This PR implements support for specifying user account hostnames using CIDR prefix notation (e.g. 10.0.0.0/24) in addition to the existing dotted-quad netmask notation, and ensures masked host entries are ordered by subnet specificity during ACL matching.

Changes:

• Added CIDR prefix parsing and masked-host validation (contiguous, non-zero mask; network address only) for account creation paths.
• Updated ACL user sorting to prefer more-specific masked subnets when resolving otherwise-equal matches.
• Added a mysql-test that exercises valid/invalid CIDR inputs, precedence ordering, and persistence across FLUSH PRIVILEGES.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
sql/sql_acl.cc	Adds CIDR parsing (/N), validates masked hosts on account creation/rename, and sorts masked entries by subnet specificity.
sql/share/errmsg-utf8.txt	Introduces new ER_INVALID_HOST_NETMASK error text for invalid masked-host specifications.
mysql-test/main/grant_cidr.test	New test coverage for CIDR host notation, rejection cases, and precedence rules.
mysql-test/main/grant_cidr.result	Expected output for the new CIDR test.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.