Issues using iprange ipv6 masks which are not 8 bit multiples

[Oisov]

Right so we have for instance code which looks like this inputs/variables.cf

      "network[uio_wired][6]"
          slist => {
              "2001:700:100::/40",
          },
          comment => "Wired networks in use at UiO";

and we have many network ranges defined like this.

and later in inputs/classes.cf

    any::

      # The following line defined uio_net, uio_wired_net, ..., matte_net, uzw.
      # Setting network[foo][4] in variables.cf now automatically creates the following classes
      # foo_net, foo_ipv6_net, foo_ipv4_net
      "$(var.networks)_ipv$(var.ip_versions)_net"
                             expression => iprange("$(var.network[$(var.networks)][$(var.ip_versions)])");
      "$(var.networks)_net"  expression => classmatch("$(var.networks)_ipv(4|6)_net");
      "ipv$(var.ip_versions)_net"
                             expression => classmatch("(.+)_ipv($(var.ip_versions))_net");

If we change the first block to

     "network[uio_wired][6]"
         slist => {
             "2001:700:100::/41",
         },
         comment => "Wired networks in use at UiO";

then CFengine complains about

   error: Cannot handle ipv6 masks which are not 8 bit multiples (fix me)
   error: Cannot handle ipv6 masks which are not 8 bit multiples (fix me)

Which makes sense as we are using a non multiple of 8 block. However, we strongly feel this is a bug? Most modern languages have moved away from mask tables only being built in 8-bit chunks.

How do we get around this?

EDIT: Seems the error originates from this

core/libcfnet/addr_lib.c

Line 237 in ff09a71

Log(LOG_LEVEL_ERR, "Cannot handle ipv6 masks which are not 8 bit multiples (fix me)");

Could a solution be to change this

core/libcfnet/addr_lib.c

Lines 246 to 254 in ff09a71

	for (i = 0; i < blocks; i++) /* blocks < 16 */
	{
	if (addr1.sin6_addr.s6_addr[i] != addr2.sin6_addr.s6_addr[i])
	{
	return -1;
	}
	}
	return 0;
	}

    if (mask % 8 != 0)
    {
        Log(LOG_LEVEL_ERR, "Cannot handle ipv6 masks which are not 8 bit multiples (fix me)");
        return -1;
    }

    addr1.sin6_family = AF_INET6;
    inet_pton(AF_INET6, address, &addr1.sin6_addr);
    addr2.sin6_family = AF_INET6;
    inet_pton(AF_INET6, s2, &addr2.sin6_addr);

    for (i = 0; i < blocks; i++)        /* blocks < 16 */
    {
        if (addr1.sin6_addr.s6_addr[i] != addr2.sin6_addr.s6_addr[i])
        {
            return -1;
        }
    }
    return 0;
}

to this instead?

    /* 1. Calculate the split: full bytes vs leftover bits */
    int blocks = mask / 8;
    int remaining_bits = mask % 8;

    /* 2. Parse the addresses (Existing code) */
    addr1.sin6_family = AF_INET6;
    inet_pton(AF_INET6, address, &addr1.sin6_addr);
    addr2.sin6_family = AF_INET6;
    inet_pton(AF_INET6, s2, &addr2.sin6_addr);

    if (mask > 128)
    {
        return -1;
    }

    /* 3. Compare the full 8-bit blocks*/
    for (i = 0; i < blocks; i++)
    {
        if (addr1.sin6_addr.s6_addr[i] != addr2.sin6_addr.s6_addr[i])
        {
            return -1;
        }
    }

    /* 4. Compare the remaining bits*/
    if (remaining_bits > 0)
    {
        /* Calculate mask for the partial byte (e.g., /41 -> 1 extra bit) */
        /* 1 bit remaining -> shift 0xFF left by 7 -> 10000000 */
        uint8_t bitmask = (uint8_t)(0xFF << (8 - remaining_bits));

        if ((addr1.sin6_addr.s6_addr[blocks] & bitmask) != 
            (addr2.sin6_addr.s6_addr[blocks] & bitmask))
        {
            return -1;
        }
    }

    return 0;
}

[anntnzrb]

The limitation exists in libcfnet/addr_lib.c at lines 246-250 and 502-506. Your proposed fix is correct - adding the partial byte comparison with 0xFF << (8 - remaining_bits) is the standard CIDR matching approach.

[Oisov]

Right hopefully someone who has time can implement this. Seems to be server side issues, not me not understanding how CFengine works. Phew

[craigcomstock]

Feel free to submit a pull request as it seems you have a notion of what the problem is and how to fix it.

Take a look at https://github.com/cfengine/core/blob/master/CONTRIBUTING.md for information about how to contribute. Thanks!

[larsewi]

Found a ticket for this in our bug tracker CFE-2034. Pinged project manager.