From: Amos Jeffries Date: Fri, 6 Nov 2009 11:58:03 +0000 (+1300) Subject: Polish several outstanding IPv6 settings X-Git-Tag: SQUID_3_2_0_1~605 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=18a8e99849e5032075aee5c370e34d8a46a2954d;p=thirdparty%2Fsquid.git Polish several outstanding IPv6 settings * Makes 'ipv6' magic monkier cover full IPv6 unicast space (previously just current active global) * Makes squid.conf default settings which require IPv6 content auto-enable/disable to match the IPv6 built support. --- diff --git a/configure.in b/configure.in index d7a103f93c..ae3ded76d7 100644 --- a/configure.in +++ b/configure.in @@ -2966,6 +2966,7 @@ fi if test "$use_ipng" = "yes"; then AC_DEFINE(USE_IPV6,1,[Enable support for IPv6 ]) + SET_IPV6_SETTINGS="" use_v4mapped=yes dnl Check for forced split-stack mode @@ -3039,7 +3040,9 @@ else AC_DEFINE(USE_IPV6,0,[Enable support for IPv6]) AC_DEFINE(IPV6_SPECIAL_SPLITSTACK,0,[Enable support for IPv6 on split-stack implementations]) AC_DEFINE(IPV6_SPECIAL_V4MAPPED,0,[Enable v4-mapping through v6 sockets]) + SET_IPV6_SETTINGS="\#IPv6 Not Available: " fi +AC_SUBST(SET_IPV6_SETTINGS) dnl Check whether this OS defines ss_len as a member of sockaddr_storage AC_CACHE_CHECK([for ss_len field in struct sockaddr_storage], diff --git a/src/Makefile.am b/src/Makefile.am index 5e4cf0ddc2..ef8fb64f17 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -810,6 +810,7 @@ cf.data: cf.data.pre Makefile s%@DEFAULT_CONFIG_DIR@%$(DEFAULT_CONFIG_DIR)%g;\ s%@DEFAULT_PREFIX@%$(DEFAULT_PREFIX)%g;\ s%@DEFAULT_HOSTS@%$(DEFAULT_HOSTS)%g;\ + s%@IPV6_ONLY_SETTING@%$(SET_IPV6_SETTINGS)%g;\ s%@SQUID@%SQUID\ $(VERSION)%g;"\ < $(srcdir)/cf.data.pre >$@ diff --git a/src/acl/Ip.cc b/src/acl/Ip.cc index 2d4befdfda..95545bd8d6 100644 --- a/src/acl/Ip.cc +++ b/src/acl/Ip.cc @@ -277,9 +277,67 @@ acl_ip_data::FactoryParse(const char *t) /* Special ACL RHS "ipv6" matches IPv6-Unicast Internet */ if (strcasecmp(t, "ipv6") == 0) { debugs(28, 9, "aclIpParseIpData: magic 'ipv6' found."); - t = "2000::/3"; - /* AYJ: due to the nature os IPv6 this will not always work, - * we may need to turn recursive to catch all the valid v6 sub-nets. */ + r = q; // save head of the list for result. + + /* 0000::/4 is a mix of localhost and obsolete IPv4-mapping space. Not valid outside this host. */ + + /* Future global unicast space: 1000::/4 */ + q->addr1 = "1000::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(4, AF_INET6); + + /* Current global unicast space: 2000::/4 = (2000::/4 - 3000::/4) */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "2000::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(3, AF_INET6); + + /* Future global unicast space: 4000::/2 = (4000::/4 - 7000::/4) */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "4000::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(2, AF_INET6); + + /* Future global unicast space: 8000::/2 = (8000::/4 - B000::/4) */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "8000::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(2, AF_INET6); + + /* Future global unicast space: C000::/3 = (C000::/4 - D000::/4) */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "C000::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(3, AF_INET6); + + /* Future global unicast space: E000::/4 */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "E000::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(4, AF_INET6); + + /* F000::/4 is mostly reserved non-unicast. With some exceptions ... */ + + /* RFC 4193 Unique-Local unicast space: FC00::/7 */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "FC00::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(7, AF_INET6); + + /* Link-Local unicast space: FE80::/10 */ + q->next = new acl_ip_data; + q = q->next; + q->addr1 = "FE80::"; + q->mask.SetNoAddr(); + q->mask.ApplyMask(10, AF_INET6); + + return r; } #endif @@ -449,8 +507,11 @@ ACLIP::parse() acl_ip_data *q = acl_ip_data::FactoryParse(t); while (q != NULL) { + /* pop each result off the list and add it to the data tree individually */ + acl_ip_data *next = q->next; + q->next = NULL; data = data->insert(q, acl_ip_data::NetworkCompare); - q = q->next; + q = next; } } } diff --git a/src/cf.data.pre b/src/cf.data.pre index b24b122174..1d05fb3eee 100644 --- a/src/cf.data.pre +++ b/src/cf.data.pre @@ -707,7 +707,9 @@ NOCOMMENT_START # acl manager proto cache_object acl localhost src 127.0.0.1/32 +@IPV6_ONLY_SETTING@acl localhost src ::1/128 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 +@IPV6_ONLY_SETTING@acl to_localhost dst ::1/128 # Example rule allowing access from your local networks. # Adapt to list your (internal) IP networks from where browsing @@ -715,6 +717,8 @@ acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network +@IPV6_ONLY_SETTING@acl localnet src fc00::/7 # RFC 4193 local private network range +@IPV6_ONLY_SETTING@acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http