You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Edit: my original description here was incorrect, I think this is a weird corner case in pflang that should maybe be ruled out?
I think the pflang expression ip dst 10 is not valid according to the WIreshark docs, but tcpdump accepts it. It appears to compile it to a check that the address is really "10" though:
$ /usr/sbin/tcpdump -d "ip dst 10"
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 5
(002) ld [30]
(003) jeq #0xa jt 4 jf 5
(004) ret #262144
(005) ret #0
Instead of what I expected which is the same as ip dst net 10:
$ /usr/sbin/tcpdump -d "ip dst net 10"
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 6
(002) ld [30]
(003) and #0xff000000
(004) jeq #0xa000000 jt 5 jf 6
(005) ret #262144
(006) ret #0
Meanwhile, for a dotted pair it does the expected thing:
/usr/sbin/tcpdump -d "ip dst 10.10"
(000) ldh [12]
(001) jeq #0x800 jt 2 jf 6
(002) ld [30]
(003) and #0xffff0000
(004) jeq #0xa0a0000 jt 5 jf 6
(005) ret #262144
(006) ret #0
Pflang also accepts the expression (i.e., parses it and doesn't error) but will emit an internal error later in the process:
$ ../tools/pflua-compile "ip dst 10"
luajit: ./pf/utils.lua:138: attempt to perform arithmetic on local 'b' (a nil value)
stack traceback:
./pf/utils.lua:138: in function 'ipv4_to_int'
./pf/expand.lua:388: in function 'expander'
./pf/expand.lua:1207: in function 'expand_bool'
./pf/expand.lua:1214: in function 'expand'
./pf.lua:37: in function 'compile_filter'
../tools/pflua-compile:58: in main chunk
[C]: at 0x004046e0
Is being compatible with libpcap desirable in this situation or should this be a (more helpful) error?
The text was updated successfully, but these errors were encountered:
takikawa
changed the title
Pflua doesn't allow IPv4 dst/src that aren't quads
Pflua has an internal error on "ip dst 10"
Sep 16, 2016
takikawa
changed the title
Pflua has an internal error on "ip dst 10"
Pflua emits an internal error on "ip dst 10"
Sep 16, 2016
Edit: my original description here was incorrect, I think this is a weird corner case in pflang that should maybe be ruled out?
I think the pflang expression
ip dst 10
is not valid according to the WIreshark docs, buttcpdump
accepts it. It appears to compile it to a check that the address is really "10" though:Instead of what I expected which is the same as
ip dst net 10
:Meanwhile, for a dotted pair it does the expected thing:
Pflang also accepts the expression (i.e., parses it and doesn't error) but will emit an internal error later in the process:
Is being compatible with libpcap desirable in this situation or should this be a (more helpful) error?
The text was updated successfully, but these errors were encountered: