Re: Possible iptables 4.4.11 issues

["Maciej Żenczykowski" <zenczykowski@gmail.com>]

>>> -A OUTPUT -p 6 --dport 888 -o eth1 -j IPMARK --addr
>>> dst --and-mask -1 --or-mask -64 --shift 0
>>> After upgrading to iptables 1.4.11 the following iptables-restore error is
>>> produced:
>>>
>>> iptables-restore v1.4.11: IPMARK: Bad value for "and-mask" option: "-1"
>>
>> This is intentional. Bitwise operations work best when fed unsigned numbers
>> only.
>
> but this used to work, we shouldn't break this sort of things Jan.

Assuming 2's complement arithmetic, an --and-mask of -1 should be a no-op
(since -1 is all 1's in binary)

However when reading --and-mask -1 my first gut instinct is that this
is --and-mask ~1 and is thus clears the least significant bit.
I also instinctively incorrectly assume --or-mask -64 sets all but bit
6, when it is actually setting all but the bottom 6 bits (ie. bits 0
through 5)...

To me this sort of lack of clarity is undesirable, and I can certainly
understand the desire to disable masks with negative integers.

-- Maciej