upstream commit

fix negated address matching where the address list
consists of a single negated match, e.g. "Match addr !192.20.0.1"

Report and patch from Jakub Jelen. bz#2397 ok dtucker@

Upstream-ID: 01dcac3f3e6ca47518cf293e31c73597a4bb40d8

diff --git a/addrmatch.c b/addrmatch.c
index 70b050e050f42c49715d3ff10457129b2ff4711a..6a7ab7d4179fb76b235f7654556ed73980d209dd 100644 (file)
--- a/addrmatch.c
+++ b/addrmatch.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: addrmatch.c,v 1.10 2015/07/08 19:04:21 markus Exp $ */
+/*     $OpenBSD: addrmatch.c,v 1.11 2016/08/23 03:24:10 djm Exp $ */
 
 /*
  * Copyright (c) 2004-2008 Damien Miller <djm@mindrot.org>
@@ -411,7 +411,8 @@ addr_match_list(const char *addr, const char *_list)
                                        break;
                                }
                                ret = 1;
-                       }
+                       } else if (neg)
+                               ret = 1;
                        continue;
                } else {
                        /* If CIDR parse failed, try wildcard string match */