Fix processing of CIDRs with mask 0

[project/firewall3.git] / iptables.c

diff --git a/iptables.c b/iptables.c
index ab3b302..7d91452 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -22,7 +22,6 @@
 static struct option base_opts[] = {
        { .name = "match",  .has_arg = 1, .val = 'm' },
        { .name = "jump",   .has_arg = 1, .val = 'j' },
-       { .name = "append", .has_arg = 1, .val = 'A' },
        { NULL }
 };
 
@@ -610,7 +609,10 @@ fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
 static void
 ip4prefix2mask(int prefix, struct in_addr *mask)
 {
-       mask->s_addr = htonl(~((1 << (32 - prefix)) - 1));
+       if (prefix > 0)
+               mask->s_addr = htonl(~((1 << (32 - prefix)) - 1));
+       else
+               mask->s_addr = 0;
 }
 
 #ifndef DISABLE_IPV6
@@ -1337,7 +1339,8 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        optind = 0;
        opterr = 0;
 
-       while ((optc = getopt_long(r->argc, r->argv, "m:j:", g->opts, NULL)) != -1)
+       while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
+                                  NULL)) != -1)
        {
                switch (optc)
                {
@@ -1367,6 +1370,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
                case 1:
                        if ((optarg[0] == '!') && (optarg[1] == '\0'))
                        {
+                               optarg[0] = '\0';
                                inv = true;
                                continue;
                        }