[PATCH conntrack-tools 2/2] conntrackd: incorrect filtering of Address with cidr /0

[Pablo Neira Ayuso]

Set an all zero mask when cidr /0 is specified.

Signed-off-by: Pablo Neira Ayuso <pa...@netfilter.org>
---
 src/cidr.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/cidr.c b/src/cidr.c
index 91025b6091ed..6ef85c74a626 100644
--- a/src/cidr.c
+++ b/src/cidr.c
@@ -24,6 +24,9 @@
 /* returns the netmask in host byte order */
 uint32_t ipv4_cidr2mask_host(uint8_t cidr)
 {
+       if (cidr == 0)
+               return 0;
+
        return 0xFFFFFFFF << (32 - cidr);
 }
 
@@ -42,10 +45,13 @@ void ipv6_cidr2mask_host(uint8_t cidr, uint32_t *res)
                res[i] = 0xFFFFFFFF;
                cidr -= 32;
        }
-       res[i] = 0xFFFFFFFF << (32 - cidr);
-       for (j = i+1; j < 4; j++) {
+       if (cidr == 0)
+               res[i] = 0;
+       else
+               res[i] = 0xFFFFFFFF << (32 - cidr);
+
+       for (j = i + 1; j < 4; j++)
                res[j] = 0;
-       }
 }
 
 void ipv6_cidr2mask_net(uint8_t cidr, uint32_t *res)
-- 
2.11.0