Re: linux-ipsec: apps/utils/libs that parse IP/netbits

> If we're inventing new routines for parsing IP addresses, let's make
> sure the API will work with IPv6 addresses without change to the
> calling programs. (I think this one will, from a brief look, but
> someone should look longer, and/or pass the routines to the Linux IPv6
> team for their review.)

The interfaces are pretty generic; the only real issue is whether the IPv6 implementation will retain struct in_addr. There is incentive for them to do so, since it shows up elsewhere... and I'm not sure whether we can do anything useful if they don't, since struct in_addr seems to be definitely the right way to do things for IPv4.

Hmm, one other minor issue is whether the callers will be generous about buffer space for subnettoa(), or will cut it close because they just *know* that a normal Internet subnet spec won't take more than [hastily counts on fingers] 18 characters plus the NUL. But I don't see any easy way that the API can enforce being sensible about that -- the caller can always just lie about the size of it if he's annoyed enough with an interface that tries to enforce generous buffers, and that's even worse.

> atosubnet() masks out the non-network part of the address as well as
> setting the mask value. This is bogus. 1.2.3.4/8 should come out as
> 1.2.3.4/8, not as 1.0.0.0/8. If the caller wants to throw away
> information provided by the user, it would cost them one line to do
> it...

Not if they want to remain ignorant of the insides of struct in_addr. Which they should, for the sake of IPv6 etc. These routines were conceived as a way of getting *subnet* specifications, and well-formed subnets don't have non-mask bits turned on. (The reason for doing the ANDing, rather than detecting and objecting to such bits, is something that came up during previous discussions about syntax: apparently people sometimes want to use a sample host to specify a subnet, because not everybody gives the subnets themselves DNS names. Those people *want* the ANDing done.)

> ...For example, the address of an interface
> (an argument to ifconfig) would be a full host (not network) address
> with a subnet mask.

Is there any example of this other than ifconfig (which is inferring the subnet address from the interface address)?

Quite apart from the issue of wanting to hide the ANDing inside an API, I think it's a mistake to make people do extra work for the normal case. I conjecture that ifconfig is an oddball, not a normal case.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

Hmm, it would be possible to add an inner layer of API that doesn't do the ANDing, and have atosubnet() call that. I'd be happier about doing this if there was more than one customer, though.

> (If someone from the team would submit changes to the net-tools
> maintainers to incorporate this parsing into Linux "ifconfig", I and a
> lot of other people would be ecstatic.)

Sounds like a reasonable thing to do, if we can nail down the details.

Henry Received on Thu Jul 16 00:10:37 1998