s3:lib/access: normalize IPv4 mapped IPv6 addresses in both directions (bug #7383)

metze
(cherry picked from commit 4bfe2d5655d97fbc7e65744425b5a098e77f5ba1)
(cherry picked from commit 62b2083c627abeb8a2fb7e5adc793c630d0d561c)

Signed-off-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit d9ea6a10a8ba84e8a5a5a65c903ed96f9aa59aa5)

diff --git a/source3/lib/access.c b/source3/lib/access.c
index 0b09e83ce35fb4dd83d3c2f2fc26eaa54cbcc888..8fd0fbfed0b62246cfbf96cc766297ca1c6b190a 100644 (file)
--- a/source3/lib/access.c
+++ b/source3/lib/access.c
@@ -178,29 +178,32 @@ static bool string_match(const char *tok,const char *s)
 bool client_match(const char *tok, const void *item)
 {
        const char **client = (const char **)item;
+       const char *tok_addr = tok;
+       const char *cli_addr = client[ADDR_INDEX];
+
+       /*
+        * tok and client[ADDR_INDEX] can be an IPv4 mapped to IPv6,
+        * we try and match the IPv4 part of address only.
+        * Bug #5311 and #7383.
+        */
+
+       if (strnequal(tok_addr, "::ffff:",7)) {
+               tok_addr += 7;
+       }
+
+       if (strnequal(cli_addr,"::ffff:",7)) {
+               cli_addr += 7;
+       }
 
        /*
         * Try to match the address first. If that fails, try to match the host
         * name if available.
         */
 
-       if (string_match(tok, client[ADDR_INDEX])) {
+       if (string_match(tok_addr, cli_addr)) {
                return true;
        }
 
-       if (strnequal(client[ADDR_INDEX],"::ffff:",7) &&
-                       !strnequal(tok, "::ffff:",7)) {
-               /* client[ADDR_INDEX] is an IPv4 mapped to IPv6, but
-                * the list item is not. Try and match the IPv4 part of
-                * address only. This will happen a lot on IPv6 enabled
-                * systems with IPv4 allow/deny lists in smb.conf.
-                * Bug #5311. JRA.
-                */
-               if (string_match(tok, (client[ADDR_INDEX])+7)) {
-                       return true;
-               }
-       }
-
        if (client[NAME_INDEX][0] != 0) {
                if (string_match(tok, client[NAME_INDEX])) {
                        return true;