From c53a5699c8242636fd913a4d07b4447efebe3bbf Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Mon, 5 Mar 2007 04:57:57 +0000 Subject: [PATCH] 2154. [func] Scoped (e.g. IPv6 link-local) addresses may now be matched in acls by omitting the scope. [RT #16599] --- CHANGES | 3 ++ doc/arm/Bv9ARM-book.xml | 57 +++++++++++++++++----------------- lib/isc/include/isc/netaddr.h | 11 +++++-- lib/isc/include/isc/sockaddr.h | 3 +- lib/isc/netaddr.c | 4 +-- 5 files changed, 44 insertions(+), 34 deletions(-) diff --git a/CHANGES b/CHANGES index 635c8e44e4..936f1df6f7 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +2154. [func] Scoped (e.g. IPv6 link-local) addresses may now be + matched in acls by omitting the scope. [RT #16599] + 2153. [bug] nsupdate could leak memory. [RT #16691] 2152. [cleanup] Use sizeof(buf) instead of fixed number in diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 19d2c2b980..302222b85f 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -2798,33 +2798,29 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. ip6_addr - - - An IPv6 address, such as 2001:db8::1234. - IPv6 scoped addresses that have ambiguity on their scope - zones must be - disambiguated by an appropriate zone ID with the percent - character - (`%') as delimiter. - It is strongly recommended to use string zone names rather - than - numeric identifiers, in order to be robust against system - configuration changes. - However, since there is no standard mapping for such names - and - identifier values, currently only interface names as link - identifiers - are supported, assuming one-to-one mapping between - interfaces and links. - For example, a link-local address fe80::1 on the - link attached to the interface ne0 - can be specified as fe80::1%ne0. - Note that on most systems link-local addresses always have - the - ambiguity, and need to be disambiguated. - - - + + + An IPv6 address, such as 2001:db8::1234. + IPv6 scoped addresses that have ambiguity on their + scope zones must be disambiguated by an appropriate + zone ID with the percent character (`%') as + delimiter. It is strongly recommended to use + string zone names rather than numeric identifiers, + in order to be robust against system configuration + changes. However, since there is no standard + mapping for such names and identifier values, + currently only interface names as link identifiers + are supported, assuming one-to-one mapping between + interfaces and links. For example, a link-local + address fe80::1 on the link + attached to the interface ne0 + can be specified as fe80::1%ne0. + Note that on most systems link-local addresses + always have the ambiguity, and need to be + disambiguated. + + + @@ -2874,6 +2870,11 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. netmask 255.0.0.0 and 1.2.3.0/28 is network 1.2.3.0 with netmask 255.255.255.240. + + When specifying a prefix involving a IPv6 scoped address + the scope may be omitted. In that case the prefix will + match packets from any scope. + diff --git a/lib/isc/include/isc/netaddr.h b/lib/isc/include/isc/netaddr.h index f53f78a144..80d005df91 100644 --- a/lib/isc/include/isc/netaddr.h +++ b/lib/isc/include/isc/netaddr.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: netaddr.h,v 1.32 2006/12/22 01:59:43 marka Exp $ */ +/* $Id: netaddr.h,v 1.33 2007/03/05 04:57:57 marka Exp $ */ #ifndef ISC_NETADDR_H #define ISC_NETADDR_H 1 @@ -48,13 +48,18 @@ struct isc_netaddr { isc_boolean_t isc_netaddr_equal(const isc_netaddr_t *a, const isc_netaddr_t *b); +/*%< + * Compare network addresses 'a' and 'b'. Return #ISC_TRUE if + * they are equal, #ISC_FALSE if not. + */ + isc_boolean_t isc_netaddr_eqprefix(const isc_netaddr_t *a, const isc_netaddr_t *b, unsigned int prefixlen); /*%< * Compare the 'prefixlen' most significant bits of the network - * addresses 'a' and 'b'. Return #ISC_TRUE if they are equal, - * #ISC_FALSE if not. + * addresses 'a' and 'b'. If 'b''s scope is zero then 'a''s scope is + * ignored. Return #ISC_TRUE if they are equal, #ISC_FALSE if not. */ isc_result_t diff --git a/lib/isc/include/isc/sockaddr.h b/lib/isc/include/isc/sockaddr.h index b7a8a2feb2..c77c59cf95 100644 --- a/lib/isc/include/isc/sockaddr.h +++ b/lib/isc/include/isc/sockaddr.h @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: sockaddr.h,v 1.52 2006/12/22 01:45:00 marka Exp $ */ +/* $Id: sockaddr.h,v 1.53 2007/03/05 04:57:57 marka Exp $ */ #ifndef ISC_SOCKADDR_H #define ISC_SOCKADDR_H 1 @@ -84,6 +84,7 @@ isc_sockaddr_eqaddrprefix(const isc_sockaddr_t *a, const isc_sockaddr_t *b, /*%< * Return ISC_TRUE iff the most significant 'prefixlen' bits of the * socket addresses 'a' and 'b' are equal, ignoring the ports. + * If 'b''s scope is zero then 'a''s scope will be ignored. */ unsigned int diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c index f92dd035fb..1a7a3348b0 100644 --- a/lib/isc/netaddr.c +++ b/lib/isc/netaddr.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: netaddr.c,v 1.35 2005/04/27 04:57:13 sra Exp $ */ +/* $Id: netaddr.c,v 1.36 2007/03/05 04:57:57 marka Exp $ */ /*! \file */ @@ -79,7 +79,7 @@ isc_netaddr_eqprefix(const isc_netaddr_t *a, const isc_netaddr_t *b, if (a->family != b->family) return (ISC_FALSE); - if (a->zone != b->zone) + if (a->zone != b->zone && b->zone != 0) return (ISC_FALSE); switch (a->family) {