Funny iptables -L output with 0.0.0.3 netmask

Funny iptables -L output with 0.0.0.3 netmask

[Patrick Schaaf]

Hi,

just noticed something funny with "iptables -L" - was always fine in the past, 
e.g. with iptables 1.4.10, but now on a box with iptables 1.4.19 (opensuse 
13.1) I see a funny thing.

Rule:
iptables -A somewhere -s 0.0.0.1/0.0.0.3 -j ACCEPT

Previous / normal list output:
ACCEPT     all  --  0.0.0.1/0.0.0.3      anywhere

Funny output I see now:
ACCEPT     all  --  0.0.0.1/-1           anywhere

The "-1" shows for variations of the nifty mask, too, e.g. /0.0.0.1 or 
/0.0.0.5 or even /127.255.255.255 - apparently anything with a leading 0-bit.

iptables-save output is fine.

Sorry if this is known + maybe already fixed in newer iptables versions...

best regards
 Patrick

Re: Funny iptables -L output with 0.0.0.3 netmask

[Jan Engelhardt]

On Thursday 2015-01-22 12:14, Patrick Schaaf wrote:
>
>just noticed something funny with "iptables -L" - was always fine in the past, 
>e.g. with iptables 1.4.10, but now on a box with iptables 1.4.19 (opensuse 
>13.1) I see a funny thing.
>
>iptables -A somewhere -s 0.0.0.1/0.0.0.3 -j ACCEPT
>ACCEPT     all  --  0.0.0.1/-1           anywhere

>Sorry if this is known + maybe already fixed in newer iptables versions...


commit 03e227017cca4f6d62a434bbaacf07e2869775b9
Author: Phil Oester <kernel@linuxace.com>
Date:   Thu Sep 26 09:06:58 2013 -0700

    libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks


Wonder if it's really worth sending an update to 13.1.

Re: Funny iptables -L output with 0.0.0.3 netmask

[Patrick Schaaf]

On Thursday 22 January 2015 13:31:33 Jan Engelhardt wrote:
> >ACCEPT     all  --  0.0.0.1/-1           anywhere
> >
> >Sorry if this is known + maybe already fixed in newer iptables versions...
> 
> commit 03e227017cca4f6d62a434bbaacf07e2869775b9
> Author: Phil Oester <kernel@linuxace.com>
> Date:   Thu Sep 26 09:06:58 2013 -0700
> 
>     libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks
> 
> Wonder if it's really worth sending an update to 13.1.

Thanks, Jan!

I created https://bugzilla.opensuse.org/show_bug.cgi?id=914285 on the issue to 
let them decide :)

best regards
  Patrick