- Ya
- 10 Julai 2026, 23:50 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 011a73e
findByIpInRange's two-sided range predicate forced CockroachDB to scan every block with networkStart <= ip whenever the IP fell in a gap (private/bogon/ spoofed XFF) or high in the address space — measured 5-13s over the ~5.7M-row table, a spoofable DoS on any hot path. Blocks are disjoint (verified across all prod rows), so the single greatest networkStart <= ip candidate is the only possible container: fetch it with LIMIT 1 and verify networkEnd in Java. 2-4ms for both hits and misses; callers keep the exact same contract.