Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix mask computation for v6 IPs #205

Merged
merged 2 commits into from
Apr 14, 2017
Merged

Fix mask computation for v6 IPs #205

merged 2 commits into from
Apr 14, 2017

Conversation

santoshankr
Copy link
Contributor

Hey

It looks like IPv6 mask fields are not being computed correctly.
For example, _create_mask(..., 10) returns [0xff, 0x03, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0], when it should be returning [0xff, 0xc0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]

Steps to reproduce:

  1. Create a new chain and add a rule accepting connections from fe80::/10
table = iptc.Table6('filter')
chain = table.create_chain('cX')

rule = iptc.Rule6()
rule.src = 'fe80::/10'
rule.create_target('ACCEPT')
chain.append_rule(rule)
  1. Examine installed rules.
$ sudo ip6tables -nL cX
Chain cX (0 references)
target     prot opt source               destination
ACCEPT     all      fe80::/ff03::        ::/0

Patched version installs the rule we wanted

$ sudo ip6tables -nL cX
Chain cX (0 references)
target     prot opt source               destination
ACCEPT     all      fe80::/10            ::/0

@coveralls
Copy link

coveralls commented Apr 13, 2017

Coverage Status

Coverage remained the same at 59.975% when pulling 09bf65d on santoshankr:ipv6-mask-fix into f8d1df6 on ldx:master.

Copy link
Owner

@ldx ldx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a test for _create_mask()? Thanks!

@@ -273,7 +273,7 @@ def _create_mask(self, plen):
if plen >= 8:
mask.append(0xff)
elif plen > 0:
mask.append(2 ** plen - 1)
mask.append(0xff>>(8-plen)<<(8-plen))
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh right! This should've been mask.append(0xff & (2 ** plen - 1)). Your approach works too. 👍

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need the top plen bits to be 1, so I think that's 0xff ^ (2 ** (8-plen) - 1)?
This is just dropping the bottom 8-plen bits though, so the double shift seemed a bit more obvious.

@coveralls
Copy link

coveralls commented Apr 14, 2017

Coverage Status

Coverage increased (+0.04%) to 60.017% when pulling 599d8b6 on santoshankr:ipv6-mask-fix into f8d1df6 on ldx:master.

@santoshankr
Copy link
Contributor Author

Added a couple of test cases for _create_mask

Copy link
Owner

@ldx ldx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@ldx ldx merged commit 6179e03 into ldx:master Apr 14, 2017
@santoshankr santoshankr deleted the ipv6-mask-fix branch April 15, 2017 07:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants