static int check_cidr_zero_bits(uint8_t *address, unsigned int len,
				unsigned int mask)
{
	/* <address> is an integer in big-endian form, <len> bits long. All
	   bits between <mask> and <len> must be zero. */
	int i;
	unsigned int byte_len;
	unsigned int byte_mask;
	unsigned int bit_mask;
	if (len == 32) {
		DBG_INFO("Looking at address %02x%02x%02x%02x, mask %u\n",
			 address[0], address[1], address[2], address[3],
			  mask);
	} else if (len == 128){
		DBG_INFO("Looking at address "
			 "%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
			 "%02x%02x-%02x%02x-%02x%02x-%02x%02x, mask %u\n",
			 address[0], address[1], address[2], address[3],
			 address[4], address[5], address[6], address[7],
			 address[8], address[9], address[10], address[11],
			 address[12], address[13], address[14], address[15],
			 mask);
	}

	if (mask > len){
		DBG_INFO("mask %u is too big (> %u)\n", mask, len);
		return -1;
	}
	if (mask == len){
		/* single address subnet.
		 * In IPv4 all 255s is invalid by the bitmask != address rule
		 * in MS-ADTS. IPv6 does not suffer.
		 */
		if (len == 32){
			if (address[0] == 255 &&
			    address[1] == 255 &&
			    address[2] == 255 &&
			    address[3] == 255){
				return -1;
			}
		}
		return 0;
	}

	byte_len = len / 8;
	byte_mask = mask / 8;

	for (i = byte_len - 1; i > byte_mask; i--){
		DBG_DEBUG("checking byte %d %02x\n", i, address[i]);
		if (address[i] != 0){
			return -1;
		}
	}
	bit_mask = (1 << (8 - (mask & 7))) - 1;
	DBG_DEBUG("checking bitmask %02x & %02x overlap %02x\n", bit_mask, address[byte_mask],
		  bit_mask & address[byte_mask]);
	if (address[byte_mask] & bit_mask){
		return -1;
	}

	/* According to MS-ADTS, the mask can't exactly equal the bitmask for
	 * IPv4 (but this is fine for v6). That is 255.255.80.0/17 is bad,
	 * because the bitmask implied by "/17" is 255.255.80.0.
	 *
	 * The bit_mask used in the previous check is the complement of what
	 * we want here.
	 */
	if (len == 32 && address[byte_mask] == (uint8_t)~bit_mask){
		bool ok = false;
		for (i = 0; i < byte_mask; i++){
			if (address[i] != 255){
				ok = true;
				break;
			}
		}
		if (ok == false){
			return -1;
		}
	}
	return 0;
}
static int check_cidr_zero_bits(uint8_t *address, unsigned int len,
				unsigned int mask)
{
	 
	int i;
	unsigned int byte_len;
	unsigned int byte_mask;
	unsigned int bit_mask;
	if (len == 32) {
		DBG_INFO("Looking at address %02x%02x%02x%02x, mask %u\n",
			 address[0], address[1], address[2], address[3],
			  mask);
	} else if (len == 128){
		DBG_INFO("Looking at address "
			 "%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
			 "%02x%02x-%02x%02x-%02x%02x-%02x%02x, mask %u\n",
			 address[0], address[1], address[2], address[3],
			 address[4], address[5], address[6], address[7],
			 address[8], address[9], address[10], address[11],
			 address[12], address[13], address[14], address[15],
			 mask);
	}

	if (mask > len){
		DBG_INFO("mask %u is too big (> %u)\n", mask, len);
		return -1;
	}
	if (mask == len){
		 
		if (len == 32){
			if (address[0] == 255 &&
			    address[1] == 255 &&
			    address[2] == 255 &&
			    address[3] == 255){
				return -1;
			}
		}
		return 0;
	}

	byte_len = len / 8;
	byte_mask = mask / 8;

	for (i = byte_len - 1; i > byte_mask; i--){
		DBG_DEBUG("checking byte %d %02x\n", i, address[i]);
		if (address[i] != 0){
			return -1;
		}
	}
	bit_mask = (1 << (8 - (mask & 7))) - 1;
	DBG_DEBUG("checking bitmask %02x & %02x overlap %02x\n", bit_mask, address[byte_mask],
		  bit_mask & address[byte_mask]);
	if (address[byte_mask] & bit_mask){
		return -1;
	}

	 
	if (len == 32 && address[byte_mask] == (uint8_t)~bit_mask){
		bool ok = false;
		for (i = 0; i < byte_mask; i++){
			if (address[i] != 255){
				ok = true;
				break;
			}
		}
		if (ok == false){
			return -1;
		}
	}
	return 0;
}