[PATCH] iptables: xtables_ipmask_to_numeric incorrect with non-CIDR masks

[Phil Oester <kernel@linuxace.com>]

[-- Attachment #1: Type: text/plain, Size: 470 bytes --]

As pointed out by Peter Hoelsken, rules created with non-standard masks such as
0.255.0.0, 0.0.255.0, etc. are displayed when output with iptables -L in CIDR
notation as -1.  This is because the cidr variable in xtables_ipmask_to_numeric
is unsigned, and the return value of -1 from xtables_ipmask_to_cidr is therefore
converted to 4294967295.  Add a cast to workaround the issue.

This closes netfilter bugzilla #854.

Signed-off-by: Phil Oester <kernel@linuxace.com>


[-- Attachment #2: patch-ipt-cidr --]
[-- Type: text/plain, Size: 469 bytes --]

diff --git a/libxtables/xtables.c b/libxtables/xtables.c
index ef5bc07..8437baf 100644
--- a/libxtables/xtables.c
+++ b/libxtables/xtables.c
@@ -1243,7 +1243,7 @@ const char *xtables_ipmask_to_numeric(const struct in_addr *mask)
 	uint32_t cidr;
 
 	cidr = xtables_ipmask_to_cidr(mask);
-	if (cidr < 0) {
+	if (cidr == (unsigned int)-1) {
 		/* mask was not a decent combination of 1's and 0's */
 		sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask));
 		return buf;