search

Igalia / pflua

Packet filtering in Lua
Other
313 stars 39 forks source link

IPv4: accept dotted triples, dotted pairs, and bare numbers #176

Closed dpino closed 9 years ago

dpino commented 9 years ago

This fixes issue #161 .

kbara commented 9 years ago

Thank you. % ./pflua-match ../tests/data/wingolog.pcap "net 192 or tcp" Matched 19562/19589 packets in 2403 iterations: ../tests/data/wingolog.pcap (47.066013 MPPS).

Parsing looks good, but I overlooked a problem: see next comment.

kbara commented 9 years ago

Sorry, I optimistically spoke too soon. It parses correctly and nests with other expressions nicely, but the semantics are wrong. "net 178" should be the same as "net 178.0.0.0/8".

Buggy:
% ./pflua-match ../tests/data/wingolog.pcap "net 178"
Matched 0/19589 packets in 2572 iterations: ../tests/data/wingolog.pcap (50.367496 MPPS).
Ok:
% ./pflua-match ../tests/data/wingolog.pcap "net 178.79.150.233"
Matched 19576/19589 packets in 1922 iterations: ../tests/data/wingolog.pcap (37.640798 MPPS).
./pflua-match ../tests/data/wingolog.pcap "net 178.0.0.0/8"     
Matched 19576/19589 packets in 2266 iterations: ../tests/data/wingolog.pcap (44.365781 MPPS).
% tcpdump -r ../tests/data/wingolog.pcap "net 178" | wc -l
19576
kbara commented 9 years ago

Closer, but the netmasks are backwards:

+   parse_test("net 192",
+               { 'net', { 'ipv4/len', { 'ipv4', 192, 0, 0, 0 }, 24 } })
+   parse_test("net 192.168",
+               { 'net', { 'ipv4/len', { 'ipv4', 192, 168, 0, 0 }, 16 } })
+   parse_test("net 192.168.1",
+               { 'net', { 'ipv4/len', { 'ipv4', 192, 168, 1, 0 }, 8 } })

the 8 and 24 should switch places; they represent the number of bits specified.

kbara commented 9 years ago

LGTM