From 09e6d6be23701cc7b67199fe2e663c0391175102 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 30 Oct 2026 06:24:55 +0000 Subject: [PATCH] upstream: treat unscoped IPv6 link-local addresses as having wildcard scope when used in `Match address` or similar. Seems like the least surprising thing to do Anthropic ANT-2026-4VBYIC2Q OpenBSD-Commit-ID: b1437244abdad94abdd9e5adf59211f1866576c2 --- addr.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/addr.c b/addr.c index 20762329c..609186646 100644 --- a/addr.c +++ b/addr.c @@ -1,4 +1,4 @@ -/* $OpenBSD: addr.c,v 1.10 2026/03/03 09:57:25 dtucker Exp $ */ +/* $OpenBSD: addr.c,v 1.11 2026/10/30 06:24:55 djm Exp $ */ /* * Copyright (c) 2004-2008 Damien Miller @@ -506,5 +506,11 @@ addr_netmatch(const struct xaddr *host, const struct xaddr *net, u_int masklen) return -1; if (addr_and(&tmp_result, host, &tmp_mask) == -1) return -1; + /* + * A network specified without an interface scope (e.g. fe80::/10) + * matches hosts in any scope; otherwise the scope must match too. + */ + if (net->af == AF_INET6 && net->scope_id == 0) + tmp_result.scope_id = 0; return addr_cmp(&tmp_result, net); }