Pull request 2201: 6192-access-ipv6-zone

Updates AdguardTeam#6192.

Squashed commit of the following:

commit e98c2f0
Merge: 4dd9218 6f7d5cc
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Tue Apr 16 17:24:38 2024 +0300

    Merge branch 'master' into 6192-access-ipv6-zone

commit 4dd9218
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Tue Apr 16 16:12:24 2024 +0300

    all: upd chlog

commit e126e12
Merge: d57c34c 201ac73
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Tue Apr 16 14:34:45 2024 +0300

    Merge branch 'master' into 6192-access-ipv6-zone

commit d57c34c
Merge: decb768 df7f19e
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Mon Apr 15 16:26:57 2024 +0300

    Merge branch 'master' into 6192-access-ipv6-zone

commit decb768
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Thu Apr 11 17:06:54 2024 +0300

    all: upd chlog

commit c8184be
Merge: 5e0059b ff7c715
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Thu Apr 11 16:52:10 2024 +0300

    Merge branch 'master' into 6192-access-ipv6-zone

commit 5e0059b
Author: Stanislav Chzhen <s.chzhen@adguard.com>
Date:   Wed Apr 10 16:59:37 2024 +0300

    dnsforward: access ipv6 zone

CHANGELOG.md

@@ -29,6 +29,8 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 ### Fixed
 
+- Support for link-local subnets, i.e. `fe80::/16`, in the access settings
+  ([#6192]).
 - The ability to apply an invalid configuration for private RDNS, which led to
   server inoperability.
 - Ignoring query log for clients with ClientID set ([#5812]).
@@ -40,6 +42,7 @@ NOTE: Add new changes BELOW THIS COMMENT.
 
 [#5345]: https://github.com/AdguardTeam/AdGuardHome/issues/5345
 [#5812]: https://github.com/AdguardTeam/AdGuardHome/issues/5812
+[#6192]: https://github.com/AdguardTeam/AdGuardHome/issues/6192
 [#6854]: https://github.com/AdguardTeam/AdGuardHome/issues/6854
 [#6875]: https://github.com/AdguardTeam/AdGuardHome/issues/6875
 

internal/dnsforward/access.go

@@ -156,7 +156,10 @@ func (a *accessManager) isBlockedIP(ip netip.Addr) (blocked bool, rule string) {
 	}
 
 	for _, ipnet := range ipnets {
-		if ipnet.Contains(ip) {
+		// Remove zone before checking because prefixes stip zones.
+		//
+		// TODO(d.kolyshev):  Cover with tests.
+		if ipnet.Contains(ip.WithZone("")) {
 			return blocked, ipnet.String()
 		}
 	}