Re: [PATCH] iptables: handle cidr notation more sanely

[Patrick McHardy <kaber@trash.net>]

Patrick Schaaf wrote:
>>>	iptables -A foo -s 10.10/16
>>>
>>>will interpret 10.10/16 as 10.0.0.10/16, and after applying the mask end
>>>up with 10.0.0.0/16, which likely isn't what the user intended.  Yet
>>>some people do expect 10.10 (without the cidr notation) to end up as
>>>10.0.0.10.
> 
> ...
> 
>>Applied, thanks Phil. Hope all those lazy typers are happy now :)
> 
> 
> Better hope the past lazy typers' boot time iptables scripts will not break
> in any critical way by such a radical interpretation change.
> 
> Of course, it's all their own fault when that happens, lazy bastards.

Please don't put words in my mouth. If they rely on undocumented,
clearly illogical (10.10/16 == 10/16) behaviour, then yes, they
are at fault, but its not because of beeing lazy typers. Anyway,
if I'd believe that this is something more than a handful of
people were actually using and that _anyone_ would actually rely
on the old behaviour, I wouldn't have accepted that patch. So if
anyone does report breakage until the next iptables release, I'll
most likely revert the patch.

> Methinks that it would be better to make non-3-dots IP addresses
> a syntax error, period.

I can understand your position about breaking compatibility, but
this seems unreasonable to me. You're saying we should do something
that has even more problems (breaking compatibility for shortcuts
without masks as well), but less value to the user?