[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter-devel
Subject:    Re: Possible iptables 4.4.11 issues
From:       Pablo Neira Ayuso <pablo () netfilter ! org>
Date:       2011-05-31 9:53:26
Message-ID: 4DE4BA96.3070603 () netfilter ! org
[Download RAW message or body]

On 31/05/11 11:51, Maciej Żenczykowski wrote:
>>>> -A OUTPUT -p 6 --dport 888 -o eth1 -j IPMARK --addr
>>>> dst --and-mask -1 --or-mask -64 --shift 0
>>>> After upgrading to iptables 1.4.11 the following iptables-restore error is
>>>> produced:
>>>>
>>>> iptables-restore v1.4.11: IPMARK: Bad value for "and-mask" option: "-1"
>>>
>>> This is intentional. Bitwise operations work best when fed unsigned numbers
>>> only.
>>
>> but this used to work, we shouldn't break this sort of things Jan.
> 
> Assuming 2's complement arithmetic, an --and-mask of -1 should be a no-op
> (since -1 is all 1's in binary)
> 
> However when reading --and-mask -1 my first gut instinct is that this
> is --and-mask ~1 and is thus clears the least significant bit.
> I also instinctively incorrectly assume --or-mask -64 sets all but bit
> 6, when it is actually setting all but the bottom 6 bits (ie. bits 0
> through 5)...
> 
> To me this sort of lack of clarity is undesirable, and I can certainly
> understand the desire to disable masks with negative integers.

makes sense, thanks for the clarification.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]