Your message dated Fri, 09 Dec 2016 10:34:19 +0000 with message-id <[email protected]> and subject line Bug#481010: fixed in ircd-ircu 2.10.12.10.dfsg1-2 has caused the Debian Bug report #481010, regarding ircd-ircu: Incorrectly masks IPv6 addresses causing connection refusal to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 481010: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481010 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: ircd-ircu Version: 2.10.12.10.dfsg1-1 Severity: normal Tags: patch We had a switch outage in the office today, causing many people to be disconnected from IRC. When they attempted to reconnect, many clients failed to connect, receiving the message: ERROR :Your host is trying to (re)connect too fast -- throttled I tracked the problem down to line 123 of IPcheck.c where the code makes an unwarranted assumption that IPv6 addresses should be masked to /64 and IPv4 addresses (after conversion to 6to4 format) should be masked to /48. Neither assumption is correct. Our entire LAN is a /64, and this is not unusual (at all), and indeed IPv6 address autoconfiguration is exactly designed for multiple devices to coexist without collisions inside a /64 subnet. Furthermore, the assumption is not warranted for IPv4 addresses which are canonicalised into 6to4 IPv6 addresses and then masked to /48. It is *expected* that people will configure private networks behind 6to4 gateways, frequently using a /64 network with address autoconfiguration, resulting in the same kind of issue with masking, and the daemon makes no attempt to distinguish between an IPv4 address which *it* has canonicalised, and one which is within the 6to4 address of a realio, trulio, IPv6 gateway. The attached patch fixes the problem by setting the mask to /128 when performing this test at connection time. It is possible that this assumption occurs in other places as well, but this is the one causing us pain right now :-) Regards, Andrew McMillan. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (990, 'unstable') Architecture: i386 (i686) Kernel: Linux 2.6.25.1-hippy (SMP w/2 CPU cores) Locale: LANG=en_NZ.UTF8, LC_CTYPE=POSIX (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/bash Versions of packages ircd-ircu depends on: ii libc6 2.7-10 GNU C Library: Shared libraries ircd-ircu recommends no packages. -- no debconf informationdiff --git a/ircd/IPcheck.c b/ircd/IPcheck.c index c3cb586..c05d104 100644 --- a/ircd/IPcheck.c +++ b/ircd/IPcheck.c @@ -108,8 +108,8 @@ static unsigned int ip_registry_hash(const struct irc_in_addr *ip) } /** Find an IP registry entry if one exists for the IP address. - * If \a ip looks like an IPv6 address, only consider the first 64 bits - * of the address. Otherwise, only consider the final 32 bits. + * We consider the full 128 bits of any address since there might + * potentially be many people on a LAN behind a 6to4 gateway. * @param[in] ip IP address to search for. * @return Matching registry entry, or NULL if none exists. */ @@ -120,8 +120,7 @@ static struct IPRegistryEntry* ip_registry_find(const struct irc_in_addr *ip) ip_registry_canonicalize(&canon, ip); entry = hashTable[ip_registry_hash(&canon)]; for ( ; entry; entry = entry->next) { - int bits = (canon.in6_16[0] == htons(0x2002)) ? 48 : 64; - if (ipmask_check(&canon, &entry->addr, bits)) + if (ipmask_check(&canon, &entry->addr, 128)) break; } return entry;
--- End Message ---
--- Begin Message ---Source: ircd-ircu Source-Version: 2.10.12.10.dfsg1-2 We believe that the bug you reported is fixed in the latest version of ircd-ircu, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Martin Gerhard Loschwitz <[email protected]> (supplier of updated ircd-ircu package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 01 Dec 2016 09:26:50 +0000 Source: ircd-ircu Binary: ircd-ircu Architecture: source Version: 2.10.12.10.dfsg1-2 Distribution: unstable Urgency: medium Maintainer: Martin Gerhard Loschwitz <[email protected]> Changed-By: Martin Gerhard Loschwitz <[email protected]> Description: ircd-ircu - Undernet IRC Server daemon Closes: 481010 669906 846431 Changes: ircd-ircu (2.10.12.10.dfsg1-2) unstable; urgency=medium . * Acknowledging the previous NMU -- thanks! * debian/{rules,control,compat}: Reworked the package to use Debhelper 9 * debian/source/format: Switched to 3.0 Quilt format (Closes: #669906) * debian/copyright: Added machine-readable copyright file * debian/patches/03_fix_ipv6.patch: Patch by Andrew McMillan to fix the incorrect masking of IPv6 addresses (Closes: #481010) * debian/control: Build-Depend on libfl-dev for upcoming changes to the flex packaging (Closes: #846431) * debian/docs: Do no longer install pre-historic changelogs that are not relevant anymore Checksums-Sha1: dcc351b5fe438b394ab7ba9639125e44f655010d 1810 ircd-ircu_2.10.12.10.dfsg1-2.dsc f7ef60127e3967f2487d56be05611b366acb127d 13412 ircd-ircu_2.10.12.10.dfsg1-2.debian.tar.xz Checksums-Sha256: 8561822979f5aae61870401d7068f9ed310f03f2775294e3ab49a3c7ee14af1c 1810 ircd-ircu_2.10.12.10.dfsg1-2.dsc 64c5457625dc650ffc5cb405ca2b720b4748eb031235fcdb029fef676bc175a1 13412 ircd-ircu_2.10.12.10.dfsg1-2.debian.tar.xz Files: 9364a4729fb1ec32d5dc4e07df800c49 1810 net optional ircd-ircu_2.10.12.10.dfsg1-2.dsc 51b46e2b374ff9f9544e6d558538c012 13412 net optional ircd-ircu_2.10.12.10.dfsg1-2.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEExXWpV+gZuhi/B+dmobCbQjM5YegFAlhKhG0ACgkQobCbQjM5 Yeg5pRAA0R1lPRgR5zAd1DpihRw0zMrvQWkP5WV7QTdJVDy+i9lf+YnFiPrQ/aLl WfdEVw9Sgq84b7PhNmTblr1OdYI6Iql+ZGy0BOPfr7cmr/3qlo63a+W+i39HLrL+ qM3LYdRNVzJ6TUZsXtc1oys5VbsZdVIWJwsDZA1AmYoZ3KLh6lNIwsadiqplssBK h2XKOVNMpvRbGqujpAFBJAn9k1foy5xvmgCXDnYCp0F4Iz3XV1loYNIrZYInd0Sk bm/SPAq0GB9Engzb93wVxSUJCulTQe/t7iyXFzb+r9D8odnrQhPaWlo29pb5K6iU oM9F+dr/Tk4V+3KwHQp4SvPfAQz7tz9WwaGIrQZ5dhMjDaUVH3985RV96Jc84trw BlyVJpuVBR0C6pYup35q0ROEby3e8TodmALwGCOJcWDB6XYbvVUX0OPFdU1k2n9u H4by7ahEOrvQZ5bd6X6LMskR40F+eW505bd+UiZTB+D6YXMATaEnYrjSdjXvI3kZ j6pNQRhc6vc0yyX/mK5QBigXY5ODfp8kVsaq6n08iSIZAwJLnq+UbimCNm5At2CT j5sxPJntUG3lUipsdDLeoT+14lXyOUzgBnuK7hUk4/mBYHJd+Cg5yak+yKkJZ/re vF1gqLTHbWMBFIOHzbi0cBcTR+6KJKoI1dkxElRTIEW5SSQythA= =UWnl -----END PGP SIGNATURE-----
--- End Message ---
