Summary¶

After the fix for #39159 (PR https://github.com/theforeman/foreman/pull/10926) was merged into develop,
an invalid mask now bypasses validation and gets saved when the network address contains a CIDR suffix (e.g. /24).
This behavior is not in any GA release yet.
Discussed on the forum: https://community.theforeman.org/t/subnet-network-address-cidr-suffix-validation-direction-after-10926/47109

Description¶

The PR added strip_network_cidr to app/models/subnet.rb, called from normalize_addresses as a before_validation hook. The relevant line:

self.cidr = parts[1].to_i if mask.blank? || cidr.nil?

The suffix from the address is only adopted when the mask is blank or cannot be parsed (i.e. invalid). As a result,
when an invalid mask is passed together with a suffix, the mask is recomputed from that suffix, so input that should be rejected ends up being saved.

Relatedly, whether the suffix is adopted depends on the state of the mask, so the behavior is inconsistent:

Mask state	Example input	Result	Saved cidr
Valid (255.255.0.0 = /16)	network 192.168.60.0/24 + mask 255.255.0.0	suffix ignored, /16 wins	16
Blank (unspecified)	network 192.168.61.0/24 (no mask/prefix)	suffix adopted (normal completion)	24
Invalid (not-a-mask)	network 192.168.91.0/24 + mask not-a-mask	suffix adopted, invalid mask swallowed	24

In addition, input where the suffix and the prefix/mask disagree (e.g. address /24 with prefix 16) is saved without warning.
Confirmed the same in the WebUI.

Steps to Reproduce¶

# 1. No suffix + invalid mask
hammer subnet create --name example-no-suffix --network 192.168.90.0 --mask not-a-mask

# 2. With suffix + the same invalid mask
hammer subnet create --name example-with-suffix --network 192.168.91.0/24 --mask not-a-mask
hammer subnet info --name example-with-suffix

Actual Behavior¶

# 1. No suffix -> rejected as expected
Could not create the subnet:
  Cidr can't be blank
  Network mask is invalid

# 2. With suffix -> created
Subnet created.
# info: network 192.168.91.0 / cidr 24 / mask 255.255.255.0

With a suffix present, the invalid mask is silently replaced with 255.255.255.0 and the subnet is created.
Mask validation stops taking effect the moment a suffix is added to the address.

Expected Behavior¶

The invalid mask should be rejected regardless of whether the address carries a suffix — i.e. the same result as case 1 above.

---

Proposed direction¶

Reject a network address that contains a CIDR suffix, and remove strip_network_cidr.
Prefix length continues to be specified via the Network Prefix field.
The rationale and the alternatives (strip / middle-ground) were discussed on the forum thread above; there have been no objections to the reject approach so far.

Related¶

• Original bug: https://projects.theforeman.org/issues/39159
• PR that introduced the current behavior: https://github.com/theforeman/foreman/pull/10926
• Forum discussion: https://community.theforeman.org/t/subnet-network-address-cidr-suffix-validation-direction-after-10926/47109