RE: Possibly dangerous interpretation of address/prefix pair in -s option

From: "Stefan Riha" <stefan@sriha.net>
To: "Jozsef Kadlecsik" <kadlec@netfilter.org>
Cc: "Reindl Harald" <h.reindl@thelounge.net>,
	"Alex Buie" <alex.buie@datto.com>,
	"netfilter@vger.kernel.org" <netfilter@vger.kernel.org>
Subject: RE: Possibly dangerous interpretation of address/prefix pair in -s option
Date: Wed, 8 Jun 2022 14:34:05 +0000	[thread overview]
Message-ID: <0102018143bca3f1-ec4843ce-f6b1-464b-a9c6-ccd61b399815-000000@eu-west-1.amazonses.com> (raw)
In-Reply-To: <eef7aaa0-e8f4-2672-956b-47ec49547b33@netfilter.org>

> The mask is unconditionally applied to the IP address.

Yes. Note again that it is unconditionally applied by other programs too, yet they do not discard the full ip address. When I use 10.0.0.2/24 in the "Address=" keywork of a systemd-networkd configuration, then the the mask is used to compute a prefix route (which is automatically added if not otherwise declared). Yet the full Ip address is kept, and assigned to the nic. My point is that I (as a beginner) would have thought iptables is "smart enough" to figure out that when I submit 10.0.0.2/24 instead of 10.0.0.0/24, then I actually mean 10.0.0.2, and that the additional information that 10.0.0.2 is part of a network 10.0.0.0/24 would be discarded.

> Please note, we support non-continuous netmasks too.

Interesting, I didn't know and had to look up what that is.

> When specified, the mask always applied to the network IP address part before processing the rule.

How about

> When specified, the mask is always applied to the IP address before processing the rule, and the masked-out part of the IP address is subsequently ignored (or "discarded" instead of "ignored").