corelight / pycommunityid

A Python implementation of the Community ID flow hashing standard
BSD 3-Clause "New" or "Revised" License
23 stars 10 forks source link

Fix a very fun type confusion problem #4

Closed ckreibich closed 3 years ago

ckreibich commented 3 years ago

"community-id tcp 10.0.0.1 10.0.0.2 10 11569" triggered a FlowTupleError complaining about the 11569 port number. The code allowed a conversion via struct.pack('!H', 11569) that was later followed by a cast to int, but

int(struct.pack('!H', 11569))

is -1 (11569 in hex is 0x2D31, which is '-1' in ASCII), so out of the valid port number range.

This commit tightens the is_port() function so it checks for specific types and reject all others. This brings the FlowTuple constructor in line with what its documentation has always stated.

Added examples to the testsuite. Thanks to @mintos5 for the report.

Fixes #3.