Re: Proposal to apply mask to IP address set on rule

Emmanuel Nyarko <[email protected]> writes:

> If you set say 
> 192.168.64.7/24 on a rule, 
>
> And the mask is applied to the ip in packet bot not on rule ip too.
>
> It just compares the ip field of the address set on rule to the ip in packet (which is masked). Instead of also applying the mask with the  192.168.64.7 so we can be comparing only the network field.

so for 192.168.64.8 arriving it compares

  192.168.64.7
to
  192.168.64.8 & 255.255.255.0 == 192.168.64.0

and fails?

> So pass 192.168.64.7/24 on a rule never matches any packet(even if it
> is in the 192.168.64 subnet) . Because only the network field will be
> in comparison against the whole network + host field on the one set on
> rule.

I think what you have found is a bug.  The IP address from the config
should be processed with the mask at rule compilation time.
It is reasonable to write rules like 192.168.64.7/24.