You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by "Paul J. Reder" <re...@raleigh.ibm.com> on 1999/08/05 23:07:58 UTC

[Patch}: PR 4770 allow/deny processing fails in CIDR case with more bits in ip than in mask.

In the CIDR case of allow/deny if an ip is specified with bits that occur
beyond the specified number of high order significant bits the allow/deny
processing always fails to match. This is because the processing is 
performed as follows:
     (in.put.ip.addr & CIDR_BITMASK) == CIDR_IP
instead of the expected:
     (in.put.ip.addr & CIDR_BITMASK) == (CIDR_IP & CIDR_BITMASK)
therefore if there are extra bits after the specified high order significant
bits (i.e. 192.168.0.10/29) then the value will never match. The following
patch fixes this problem.

-- 
Paul J. Reder

----------------------------------------------------------------------------------


--- mod_access.c.old    Wed Aug  4 22:11:51 1999
+++ mod_access.c        Wed Aug  4 22:05:27 1999
@@ -202,7 +202,7 @@
            mask = htonl(mask);
        }
        a->x.ip.mask = mask;
-
+        a->x.ip.net  = (a->x.ip.net & mask);   /* pjr - This fixes PR 4770 */
     }
     else if (ap_isdigit(*where) && is_ip(where)) {
        /* legacy syntax for ip addrs: a.b.c. ==> a.b.c.0/24 for example */