Take into account cidr value for the from address when creating the set

When creating a set from a range expressed as a network like
10.1.1.172/29, the from address was taken as the IP address part and
not masked with the netmask from the cidr.

diff --git a/kernel/net/netfilter/ipset/ip_set_bitmap_ip.c b/kernel/net/netfilter/ipset/ip_set_bitmap_ip.c
index 3b5920bfc784ec91f601b2d13d2c302b9b175aa1..49323110560c839ea557e65218ac1e39cd2c611b 100644 (file)
--- a/kernel/net/netfilter/ipset/ip_set_bitmap_ip.c
+++ b/kernel/net/netfilter/ipset/ip_set_bitmap_ip.c
@@ -478,6 +478,7 @@ bitmap_ip_create(struct ip_set *set, struct nlattr *tb[], u32 flags)
 
                if (cidr >= 32)
                        return -IPSET_ERR_INVALID_CIDR;
+               first_ip &= ip_set_hostmask(cidr);
                last_ip = first_ip | ~ip_set_hostmask(cidr);
        } else
                return -IPSET_ERR_PROTOCOL;