From 8e85ae44bc532d28a4e01a84eb2f89e979e897b6 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Tue, 9 Jan 2018 21:58:33 -0800
Subject: [PATCH] Fix matching of IPv6 networks
 https://www.virtualmin.com/node/54905

---
 miniserv.pl          | 17 +++++++++++++++--
 webmin/webmin-lib.pl | 22 ++++++++++++++++++++--
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/miniserv.pl b/miniserv.pl
index 1184a0e9c..45ffc6f90 100755
--- a/miniserv.pl
+++ b/miniserv.pl
@@ -2847,8 +2847,8 @@ for($i=2; $i<@_; $i++) {
 		local $v6size = $2;
 		local $v6addr = &canonicalize_ip6($1);
 		local $bytes = $v6size / 8;
-		@mo = split(/:/, $v6addr);
-		local @io6 = split(/:/, &canonicalize_ip6($_[0]));
+		@mo = &expand_ipv6_bytes($v6addr);
+		local @io6 = &expand_ipv6_bytes(&canonicalize_ip6($_[0]));
 		for($j=0; $j<$bytes; $j++) {
 			if ($mo[$j] ne $io6[$j]) {
 				$mismatch = 1;
@@ -6235,6 +6235,19 @@ foreach my $w (@w) {
 return lc(join(":", @w));
 }
 
+# expand_ipv6_bytes(address)
+# Given a canonical IPv6 address, split it into an array of bytes
+sub expand_ipv6_bytes
+{
+my ($addr) = @_;
+my @rv;
+foreach my $w (split(/:/, $addr)) {
+	$w =~ /^(..)(..)$/ || return ( );
+	push(@rv, hex($1), hex($2));
+	}
+return @rv;
+}
+
 sub get_somaxconn
 {
 return defined(&SOMAXCONN) ? SOMAXCONN : 128;
diff --git a/webmin/webmin-lib.pl b/webmin/webmin-lib.pl
index 8c69d01cb..1c8ae26bb 100755
--- a/webmin/webmin-lib.pl
+++ b/webmin/webmin-lib.pl
@@ -1549,8 +1549,8 @@ for(my $i=1; $i<@_; $i++) {
 		my $v6size = $2;
 		my $v6addr = &canonicalize_ip6($1);
 		my $bytes = $v6size / 8;
-		my @mo = split(/:/, $v6addr);
-		my @io = split(/:/, &canonicalize_ip6($_[0]));
+		my @mo = &expand_ipv6_bytes($v6addr);
+		my @io = &expand_ipv6_bytes(&canonicalize_ip6($_[0]));
 		for(my $j=0; $j<$bytes; $j++) {
 			if ($mo[$j] ne $io[$j]) {
 				$mismatch = 1;
@@ -1566,6 +1566,24 @@ for(my $i=1; $i<@_; $i++) {
 return 0;
 }
 
+=head2 expand_ipv6_bytes(address)
+
+Given a canonical IPv6 address, split it into an array of bytes
+
+=cut
+sub expand_ipv6_bytes
+{
+my ($addr) = @_;
+my @rv;
+foreach my $w (split(/:/, $addr)) {
+	$w =~ /^(..)(..)$/ || return ( );
+	push(@rv, hex($1), hex($2));
+	}
+return @rv;
+}
+
+
+
 =head2 prefix_to_mask(prefix)
 
 Converts a number like 24 to a mask like 255.255.255.0.