2324. [bug] Fix IPv6 matching against "any;" [RT #17533]

diff --git a/CHANGES b/CHANGES
index a8c4a53f6c4187f1968224f7bab12ad2d9f1ec8a..b8bf1221efd062e06f4bffcd79a44dec38e18f55 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2324.  [bug]           Fix IPv6 matching against "any;" [RT #17533]
+
 2323.  [port]          tru64: namespace clash. [RT #17547]
 
 2322.  [port]          MacOS: work around the limitation of setrlimit()

diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index e1b6ce6bd2e36527e67498a9a7cb516cf121d50a..d8d0b9bcfa34fda179ad7b0591915574626ba6a6 100644 (file)
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acl.c,v 1.37.2.5 2008/01/22 05:39:18 each Exp $ */
+/* $Id: acl.c,v 1.37.2.6 2008/01/27 02:12:51 marka Exp $ */
 
 /*! \file */
 
@@ -220,6 +220,8 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 
        /* Found a match. */
        if (result == ISC_R_SUCCESS && node != NULL) {
+               if (node->bit == 0)
+                       family = AF_INET;
                match_num = node->node_num[ISC_IS6(family)];
                if (*(isc_boolean_t *) node->data[ISC_IS6(family)] == ISC_TRUE)
                        *match = match_num;

diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index b830da017541025c0b08e26c138c6b49f776ddaa..a25dbcbc810981f2b9337f5158cf264b0f12f4fa 100644 (file)
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: radix.c,v 1.9.6.2 2008/01/21 23:46:23 tbox Exp $ */
+/* $Id: radix.c,v 1.9.6.3 2008/01/27 02:12:51 marka Exp $ */
 
 /*
  * This source was adapted from MRT's RCS Ids:
@@ -233,7 +233,7 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
        isc_radix_node_t *node;
        isc_radix_node_t *stack[RADIX_MAXBITS + 1];
        u_char *addr;
-       isc_uint32_t bitlen, family;
+       isc_uint32_t bitlen, family, tfamily = -1;
        int cnt = 0;
 
        REQUIRE(radix != NULL);
@@ -250,8 +250,6 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
        addr = isc_prefix_touchar(prefix);
        bitlen = prefix->bitlen;
 
-       /* Bitlen 0 means "any" or "none", which is always treated as IPv4 */
-       family = bitlen ? prefix->family : AF_INET;
 
        while (node->bit < bitlen) {
                if (node->prefix)
@@ -275,11 +273,17 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
                if (_comp_with_mask(isc_prefix_tochar(node->prefix),
                                    isc_prefix_tochar(prefix),
                                    node->prefix->bitlen)) {
+                       /* Bitlen 0 means "any" or "none",
+                          which is always treated as IPv4 */
+                       family = node->prefix->bitlen ?
+                                prefix->family : AF_INET;
                        if (node->node_num[ISC_IS6(family)] != -1 &&
-                           ((*target == NULL) ||
-                            (*target)->node_num[ISC_IS6(family)] >
-                                  node->node_num[ISC_IS6(family)]))
+                                ((*target == NULL) ||
+                                 (*target)->node_num[ISC_IS6(tfamily)] >
+                                  node->node_num[ISC_IS6(family)])) {
                                *target = node;
+                               tfamily = family;
+                       }
                }
        }