Re: Proposal to apply mask to IP address set on rule

At Wed, 21 May 2025 19:17:20 -0400, Greg Troxel <[email protected]> wrote:
Subject: Re: Proposal to apply mask to IP address set on rule
> 
> Emmanuel Nyarko <[email protected]> writes:
> 
> >> On 21 May 2025, at 10:11 PM, Greg Troxel <[email protected]> wrote:
> >> 
> >> Emmanuel Nyarko <[email protected]> writes:
> >> 
> >>> I think a simple warning will do. That rightmost bits are not 0s.
> >> 
> >> Certainly better than silent failure, but I think one should be able to
> >> use prefixes like 192.168.1.7/24.  As I said, that is a way of
> >> documenting that it was .7 that got it added, but that the intent was
> >> to block the neighborhood.
> > Very good case here.i couldn t agree more.
> >
> > But I think that s an information you can not easily know sometimes. Or ?
> > 
> >  Especially when dealing with incident responses after you re
> >  suspecting malicious activities from a source ip and maybe trying
> >  to block. Might be from a diff network, etc. so should probably
> >  warn to use a .0 when adding a mask.
> 
> I am not saying it should be required, or any kind of rule.  If someone
> wants to put in a subnet with 0 in the host part because that's what
> they are thinking about, that's totally fine.  I just meant that putting
> in a host should be acceptable.

Indeed!  Even a warning would be very bogus -- useless and annoying.

It is extremely common to express a "subnet" as "addr/mask" and still
have non-zero host bits in the "addr" part.  IPF, for one other NetBSD
example allows this.  My IPF rules are filled with such examples.

One of the only tools I've used that treats non-zero host bits in a
subnet expression as worth warning, or in its case throwing an error
about, is tcpdump(1), and it is extremely annoying as a result -- not
conducive to allowing cut&paste, especially with modern CIDR
expressions.  Why the heck do I have to manually figure out the new
decimal number to type in order to cut out a couple more bits!?!?!?

-- 
					Greg A. Woods <[email protected]>

Kelowna, BC     +1 250 762-7675           RoboHack <[email protected]>
Planix, Inc. <[email protected]>     Avoncote Farms <[email protected]>

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRuK6dmwVAucmRxuh9mfXG3eL/0fwUCaC+wNAAKCRBmfXG3eL/0
f65/AKDbjdt0IdPv+ZzUngp69Vl8mPQWQQCgk1QQ/0ptBrQ7N79IHP4xRQVk/IA=
=B5K0
-----END PGP SIGNATURE-----