Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pflua emits an internal error on "ip dst 10" #254

Open
takikawa opened this issue Sep 15, 2016 · 0 comments
Open

Pflua emits an internal error on "ip dst 10" #254

takikawa opened this issue Sep 15, 2016 · 0 comments

Comments

@takikawa
Copy link
Member

takikawa commented Sep 15, 2016

Edit: my original description here was incorrect, I think this is a weird corner case in pflang that should maybe be ruled out?

I think the pflang expression ip dst 10 is not valid according to the WIreshark docs, but tcpdump accepts it. It appears to compile it to a check that the address is really "10" though:

$ /usr/sbin/tcpdump -d "ip dst 10"
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 5
(002) ld       [30]
(003) jeq      #0xa             jt 4    jf 5
(004) ret      #262144
(005) ret      #0

Instead of what I expected which is the same as ip dst net 10:

$ /usr/sbin/tcpdump -d "ip dst net 10"
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 6
(002) ld       [30]
(003) and      #0xff000000
(004) jeq      #0xa000000       jt 5    jf 6
(005) ret      #262144
(006) ret      #0

Meanwhile, for a dotted pair it does the expected thing:

/usr/sbin/tcpdump -d "ip dst 10.10"
(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 6
(002) ld       [30]
(003) and      #0xffff0000
(004) jeq      #0xa0a0000       jt 5    jf 6
(005) ret      #262144
(006) ret      #0

Pflang also accepts the expression (i.e., parses it and doesn't error) but will emit an internal error later in the process:

$ ../tools/pflua-compile "ip dst 10"
luajit: ./pf/utils.lua:138: attempt to perform arithmetic on local 'b' (a nil value)
stack traceback:
    ./pf/utils.lua:138: in function 'ipv4_to_int'
    ./pf/expand.lua:388: in function 'expander'
    ./pf/expand.lua:1207: in function 'expand_bool'
    ./pf/expand.lua:1214: in function 'expand'
    ./pf.lua:37: in function 'compile_filter'
    ../tools/pflua-compile:58: in main chunk
    [C]: at 0x004046e0

Is being compatible with libpcap desirable in this situation or should this be a (more helpful) error?

@takikawa takikawa changed the title Pflua doesn't allow IPv4 dst/src that aren't quads Pflua has an internal error on "ip dst 10" Sep 16, 2016
@takikawa takikawa changed the title Pflua has an internal error on "ip dst 10" Pflua emits an internal error on "ip dst 10" Sep 16, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant