[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
bin/51669: hosts.allow syntax for IPv6 literals is ... unclear
>Synopsis: hosts.allow syntax for IPv6 literals is ... unclear
>Arrival-Date: Tue Nov 29 09:35:00 +0000 2016
>Release: NetBSD 7.0
System: NetBSD smistad.uninett.no 7.0 NetBSD 7.0 (GENERIC.201509250726Z) amd64
The manual page for hosts.allow on NetBSD has this to say
about how one can specify an address range in IPv6:
o An expression of the form `ipv6-addr/ipv6-mask' is interpreted
as masked IPv6 address match, just like masked IPv4 address
match (see above). Note that `ipv6-mask' portion must always be
This doesn't quite add up with the implementation, it seems.
First off, the thing behind the / isn't an ipv6-mask, it's a
prefix length. And the implementation only (?) accepts
`[ipv6-net/prefixlen]', and the above does not say that the
brackets are a required part of the syntax.
Furthermore, this also deviates from the syntax used by both
FreeBSD and Linux, which specify `[ipv6-net]/prefixlen',
i.e. the prefixlen is only accepted outside of the brackets.
The FreeBSD man page is a lot clearer on this specific point:
o An expression of the form `[n:n:n:n:n:n:n:n]/m' is interpreted
as a `[net]/prefixlen' pair. A IPv6 host address is matched if
`prefixlen' bits of `net' is equal to the `prefixlen' bits of
the address. For example, the [net]/prefixlen pattern
`[3ffe:505:2:1::]/64' matches every address in the range
`3ffe:505:2:1::' through `3ffe:505:2:1:ffff:ffff:ffff:ffff'.
This appears, modulo an a/an correction, to be identical to
the documentation on Debian Linux as well.
Experiment with variations of the above patterns, and see that
you can only do `[ipv6-net/prefixlen]' syntax on NetBSD.
Inspect the man pages of those other projects.
Not supplied here...
There's of course a compatibility issue if we're going to
start accepting '[ipv6-net]/prefixlen' syntax as well, the old
syntax should probably continue to be supported.
Main Index |
Thread Index |