tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Proposal to apply mask to IP address set on rule



bad@, let me explain my question to you again.

let's say you want to exclusively allow packets from the 192.168.64.0 neighborhood for some whatever security reasons.

group “ext” on $intf {
    pass from 192.168.64.7/24
}

group default {
 block all
}

The above rules will not match any packet from the 192.168.64 neighborhood hence goes to default and block them. (But you actually intended to pass them.) this is because, when say a packet coming in has src addr to be : 192.168.64.2,

NPF applies the mask to the incoming packet: (192.168.64.2 & 255.255.255.0) ==> 192.168.64.0.

Then BPF directly compares 192.168.64.7(on rule without mask) to 192.168.64.0(masked ip from packet)
Since 192.168.64.7 != 192.168.64.0, hence skips that packet.  


The rules as follows match. Hence you actually get to pass them
Here, after masking 192.168.64.2 & 255.255.255.0, you get 192.168.64.0 and BPF compares directly to unmasked ip on rule(192.168.64.0) hence matches.

group “ext” on $intf {
    pass from 192.168.64.0/24
}

group default {
 block all
}

My main question is, I got informations on the internet that it is also not wrong to write 192.168.64.7/24 to refer to a sub network.

So should we allow 192.168.64.7/24 to match packets from the 192.168.64 neighborhood. Because right now, only 192.168.64.0/24 matches the neighbourhood. Or any non-zero host bit in the mask format shouldn’t match.


On 23 May 2025, at 5:36 PM, Christoph Badura <bad%bsd.de@localhost> wrote:

On Wed, May 21, 2025 at 11:40:13AM +0000, Emmanuel Nyarko wrote:
Supposed we want to block or pass packets from a subnet

Say 192.168.64 subnet.(24 bits masking)

So if We
"pass from 192.168.64.7/24" on a rule.

Is it ideal to also match all packets from 192.168.64 subnet ? As it would if we passed as
192.168.64.0/24 on rule.

It would be helpful if you could give actual examples in the future.
Like actual NPF rules, if you have that in mind.

And actual examples for what you think misbehaves or what produces an
error for you.

It took a long time to figure out what you are meaning.  And I'm not sure I
understand it exactly.

That being said, I'm in league with the others that think address/mask
should only match on the bits allowed by the mask and silently ignore
any not masked bits.[*]  For the reasons given by the other.

--chris

[*] Note that that would include non-contiguous masks.  I'm aware that
they are out of fashion (and for good reasons).


Emmanuel







Home | Main Index | Thread Index | Old Index