RE: Possibly dangerous interpretation of address/prefix pair in -s option

From: Jozsef Kadlecsik <kadlec@netfilter.org>
To: Stefan Riha <stefan@sriha.net>
Cc: Reindl Harald <h.reindl@thelounge.net>,
	Alex Buie <alex.buie@datto.com>,
	"netfilter@vger.kernel.org" <netfilter@vger.kernel.org>
Subject: RE: Possibly dangerous interpretation of address/prefix pair in -s option
Date: Wed, 8 Jun 2022 15:56:45 +0200 (CEST)	[thread overview]
Message-ID: <eef7aaa0-e8f4-2672-956b-47ec49547b33@netfilter.org> (raw)
In-Reply-To: <010201812f0adc45-929753b5-ff42-41a8-a922-fdb605cde46f-000000@eu-west-1.amazonses.com>

On Sat, 4 Jun 2022, Stefan Riha wrote:

> >> It seems people can come to wrong conclusions due to the syntax which is used at 
> different systems with different internal meanings. The feature cannot of 
> course be changed, but maybe it'd worth to update the documentation.
> 
> I see, are you thinking of adding something like this to the manpage:
> 
> -s --source address[/mask][,...]

> Source specification. Address can be either a network name, a hostname, 
> a network IP address (with /mask), or a plain IP address. It can also be 
> a plain IP address with /mask, in which case the mask will be applied to 
> the plain IP address to compute the associated network IP address. Note 
> that in the latter case, the plain IP address is automatically 
> reinterpreted (i.e. modified or re-calculated) by the system as a 
> network IP address.

The mask is unconditionally applied to the IP address. Please note, we 
support non-continuous netmasks too. So something like this describes 
better how the input is handled:

-s, --source address[/mask][,...]

Source specification. Address can be either a network name, a hostname, a 
network IP address (with /mask), or a plain IP address. Hostnames will be 
resolved  once  only, before the rule is submitted to the kernel.  Please 
note that specifying any name to be resolved with a remote query such  as 
DNS  is  a  really bad idea.  The mask can be either an ipv4 network mask 
(for iptables) or a plain number, specifying the number  of  1's  at  the 
left  side  of the network mask.  Thus, an iptables mask of 24 is 
equivalent to 255.255.255.0. When specified, the mask always applied to 
the network IP address part before processing the rule. ...

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlecsik.jozsef@wigner.hu
PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
Address : Wigner Research Centre for Physics
          H-1525 Budapest 114, POB. 49, Hungary