summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhil Oester <kernel@linuxace.com>2006-07-10 04:52:56 +0000
committerPatrick McHardy <kaber@trash.net>2006-07-10 04:52:56 +0000
commit5549ad0e7eac76922e727e61f425e1f1f02e380d (patch)
tree728276ae4c34bc9c9f508eda5ce883e1fe39fd33
parent8a173efc9af7cdc96b37867bdb3f4112be5dcbf9 (diff)
iptables: handle cidr notation more sanely (Phil Oester <kernel@linuxace.com>)
At present, a command such as iptables -A foo -s 10.10/16 will interpret 10.10/16 as 10.0.0.10/16, and after applying the mask end up with 10.0.0.0/16, which likely isn't what the user intended. Yet some people do expect 10.10 (without the cidr notation) to end up as 10.0.0.10. The below patch should satisfy all parties. It zero pads the missing octets only in the cidr case, leaving the IP untouched otherwise. This resolves bug #422
-rw-r--r--iptables.c30
1 files changed, 30 insertions, 0 deletions
diff --git a/iptables.c b/iptables.c
index ea0eae36..78149862 100644
--- a/iptables.c
+++ b/iptables.c
@@ -583,6 +583,34 @@ addr_to_host(const struct in_addr *addr)
return (char *) NULL;
}
+static void
+pad_cidr(char *cidr)
+{
+ char *p, *q;
+ unsigned int onebyte;
+ int i, j;
+ char buf[20];
+
+ /* copy dotted string, because we need to modify it */
+ strncpy(buf, cidr, sizeof(buf) - 1);
+ buf[sizeof(buf) - 1] = '\0';
+
+ p = buf;
+ for (i = 0; i <= 3; i++) {
+ if ((q = strchr(p, '.')) == NULL)
+ break;
+ *q = '\0';
+ if (string_to_number(p, 0, 255, &onebyte) == -1)
+ return;
+ p = q + 1;
+ }
+
+ /* pad remaining octets with zeros */
+ for (j = i; j < 3; j++) {
+ strcat(cidr, ".0");
+ }
+}
+
/*
* All functions starting with "parse" should succeed, otherwise
* the program fails.
@@ -651,6 +679,8 @@ parse_hostnetworkmask(const char *name, struct in_addr **addrpp,
if ((p = strrchr(buf, '/')) != NULL) {
*p = '\0';
addrp = parse_mask(p + 1);
+ if (strrchr(p + 1, '.') == NULL)
+ pad_cidr(buf);
} else
addrp = parse_mask(NULL);
inaddrcpy(maskp, addrp);