adam/jarl
1
0 Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases 34 Wiki Activity

Address ranges in address match lists (IPv4 and IPv6)

Browse Source 
ACLs, views' match lists, options with address match lists and blocking
client groups take ranges such as 10.0.10.101-10.0.10.199 or
2001:db8::100-2001:db8::1ff (negated, or with spaces around the dash, too).
Jarl stores the range as written and writes the fewest prefixes that cover
exactly that range to named.conf, with the range as a comment. New package
internal/iprange; namedconf gets an AMRange element (a range used to parse
as an ACL name), ExpandRanges and statement comments. Mistakes are refused
when entered, validation sees what ranges cover, and IPv6 ranges in the
IPv4-mapped space get a warning. The web UI shows what a range becomes
while typing (GET /catalog/ranges).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adamandClaude Opus 5.5 committed 2026-10-11 23:17:14 +01:00
1 parent 49b1c872c9
commit e2e5007f94
32 files changed
+905 -31
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/e2e.sh
+20
View File
@@ -239,6 +239,26 @@ contains "172.16.0.0/12"
run "acl delete in-use refused" 5 sh -c "$J option set allow-transfer '{ trusted; }' --zone adbraun.test && $J acl delete trusted"
run "option unset" 0 $J option unset allow-transfer --zone adbraun.test
run "acl delete" 0 $J acl delete trusted
# Address ranges: kept as written, written to named.conf as prefixes.
run "acl with ranges" 0 $J acl create ranged "127.0.0.2 - 127.0.0.3" 2001:db8::100-2001:db8::1ff
run "acl list keeps the ranges" 0 $J acl list
contains "127.0.0.2-127.0.0.3"
run "named.conf has the prefixes" 0 grep -A4 'acl "ranged"' $E/etc-jarl/named.conf
contains "127.0.0.2/31;"
contains "2001:db8::100/120;"
contains "// 127.0.0.2-127.0.0.3"
run "a reversed range is refused (exit 6)" 6 $J acl create badrange 127.0.0.9-127.0.0.1
contains "start is after the end"
run "zone allow-query by the range" 0 $J option set allow-query '{ ranged; }' --zone adbraun.test
range_dig() { $DIG +tries=1 +time=3 -b "$1" -p $DNS @127.0.0.1 ns1.adbraun.test A | awk '/status:/ {sub(",", "", $6); print $6}'; }
for src in 127.0.0.2 127.0.0.3; do
if [ "$(range_dig $src)" = NOERROR ]; then ok "range: $src may query"; else bad "range: $src got $(range_dig $src)"; fi
done
for src in 127.0.0.1 127.0.0.4; do
if [ "$(range_dig $src)" = REFUSED ]; then ok "range: $src is refused"; else bad "range: $src got $(range_dig $src)"; fi
done
run "unset the zone's allow-query" 0 $J option unset allow-query --zone adbraun.test
run "acl delete ranged" 0 $J acl delete ranged
run "tsig create" 0 $J tsig create xfer-test
contains "secret:"
run "tsig rotate" 0 $J tsig rotate xfer-test