Re: Possibly dangerous interpretation of address/prefix pair in -s option

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 6/8/2022 7:34 AM, Stefan Riha wrote:
The mask is unconditionally applied to the IP address.
Yes. Note again that it is unconditionally applied by other programs too, yet they do not discard the full ip address. When I use 10.0.0.2/24 in the "Address=" keywork of a systemd-networkd configuration, then the the mask is used to compute a prefix route (which is automatically added if not otherwise declared). Yet the full Ip address is kept, and assigned to the nic.

This is a different context and meaning than the usage in `iptables`.

In `systemd-networkd`, that is a host address field, not a network address field, and that specifying a length, a la 10.0.0.2/24, is short hand for configuring IP address 10.0.0.2 with a mask 255.255.255.0 as this is for configuring an address on a network interface, which normally requires an IP address and a mask pair.

Where as in `iptables`, an address supplied to -d or -s is is a network address field that defaults to /32 when no length is specified, which is a single address.

It makes all the difference if the field if is a network field or an single address field.

--
gordonfish



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux