redjack/ipset — Issue #14: Reopen Issue 6 - ipset checking
Author: JohnMcHugh
Created: 2012-03-02 19:13:47+00:00
State: open

In addition to raising an error when the cidr netblock descriptor is out of range for the ip address type (v4 or v6), ipsetbuild (at least) needs to raise an error when the given network prefix is inconsistent with the block size. RFC 4632 while not providing a formal definition for the relationship between the network prefix and the block size descriptor strongly implies that the low order bits of the prefix should be zero

"For example, the legacy "Class B" network 172.16.0.0, with an implied
network mask of 255.255.0.0, is defined as the prefix 172.16.0.0/16,
the "/16" indicating that the mask to extract the network portion of
the prefix is a 32-bit value where the most significant 16 bits are
ones and the least significant 16 bits are zeros. Similarly, the
legacy "Class C" network number 192.168.99.0 is defined as the prefix
192.168.99.0/24; the most significant 24 bits are ones and the least
significant 8 bits are zeros."

Until we see a good reason to do otherwise, I would like to see the set building program and any other programs that take potentially human crafted input perform a check on cidr inputs to ensure consistency between the prefix and the block size indicator.