You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by "Paul J. Reder" <re...@raleigh.ibm.com> on 1999/08/05 23:07:58 UTC
[Patch}: PR 4770 allow/deny processing fails in CIDR case with more bits in ip than in mask.
In the CIDR case of allow/deny if an ip is specified with bits that occur
beyond the specified number of high order significant bits the allow/deny
processing always fails to match. This is because the processing is
performed as follows:
(in.put.ip.addr & CIDR_BITMASK) == CIDR_IP
instead of the expected:
(in.put.ip.addr & CIDR_BITMASK) == (CIDR_IP & CIDR_BITMASK)
therefore if there are extra bits after the specified high order significant
bits (i.e. 192.168.0.10/29) then the value will never match. The following
patch fixes this problem.
--
Paul J. Reder
----------------------------------------------------------------------------------
--- mod_access.c.old Wed Aug 4 22:11:51 1999
+++ mod_access.c Wed Aug 4 22:05:27 1999
@@ -202,7 +202,7 @@
mask = htonl(mask);
}
a->x.ip.mask = mask;
-
+ a->x.ip.net = (a->x.ip.net & mask); /* pjr - This fixes PR 4770 */
}
else if (ap_isdigit(*where) && is_ip(where)) {
/* legacy syntax for ip addrs: a.b.c. ==> a.b.c.0/24 for example */