Re: Proposal to apply mask to IP address set on rule

At Fri, 23 May 2025 08:34:36 +0200, Edgar Fuß <[email protected]> wrote:
Subject: Re: Proposal to apply mask to IP address set on rule
> 
> I would say that 192.168.123.248/28 is almost always an error, where you 
> either meant 192.168.123.240/28 or 192.168.123.248/29.

Huh?

Why would it be an error?

A bitmask is a bitmask -- apply the mask to the value and use the
result!

Perhaps, as Christoph noted in a separate message, there may be some
merit in warning when the mask has non-contiguous set bits, but that's
clearly never the case with the "/bits" form.


> As is 192.168.123.0/8, 

Well perhaps that is worth a warning, but only because RFC 1918 defines
192.168/16 as a special subnet, and so widening it beyond 16 bits is the
only questionable part.

> where you probably swapped net and host len and meant /24.

That makes no sense to me whatsoever.

-- 
					Greg A. Woods <[email protected]>

Kelowna, BC     +1 250 762-7675           RoboHack <[email protected]>
Planix, Inc. <[email protected]>     Avoncote Farms <[email protected]>

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRuK6dmwVAucmRxuh9mfXG3eL/0fwUCaDDXBAAKCRBmfXG3eL/0
fwpTAKCLZ7GSt7B2UtriF10/PKQ84WX+0QCfatTdHXA9ffrBjLH0WdUPvWQtGWQ=
=LH7u
-----END PGP SIGNATURE-----