Add is_valid_subnet BiF

Also includes consistency tweak for is_valid_ip() plus test cases.
This commit is contained in:
Yacin Nadji 2025-01-24 13:00:32 -05:00 committed by Christian Kreibich
parent 7ba9609992
commit 8b83c2995a
7 changed files with 37 additions and 5 deletions

2
NEWS
View file

@ -27,6 +27,8 @@ New Functionality
- Geneve tunnel options of the current packet can be extracted from scripts - Geneve tunnel options of the current packet can be extracted from scripts
using the new PacketAnalyzer::Geneve::get_options() builtin function. using the new PacketAnalyzer::Geneve::get_options() builtin function.
- The new ``is_valid_subnet()`` function mirrors ``is_valid_ip()``, for subnets.
Changed Functionality Changed Functionality
--------------------- ---------------------

View file

@ -353,6 +353,7 @@ static std::unordered_map<std::string, unsigned int> func_attrs = {
{"is_v6_addr", ATTR_FOLDABLE}, {"is_v6_addr", ATTR_FOLDABLE},
{"is_v6_subnet", ATTR_FOLDABLE}, {"is_v6_subnet", ATTR_FOLDABLE},
{"is_valid_ip", ATTR_FOLDABLE}, {"is_valid_ip", ATTR_FOLDABLE},
{"is_valid_subnet", ATTR_FOLDABLE},
{"join_string_set", ATTR_FOLDABLE}, {"join_string_set", ATTR_FOLDABLE},
{"join_string_vec", ATTR_FOLDABLE}, {"join_string_vec", ATTR_FOLDABLE},
{"levenshtein_distance", ATTR_FOLDABLE}, {"levenshtein_distance", ATTR_FOLDABLE},

View file

@ -2831,10 +2831,17 @@ function to_addr%(ip: string%): addr
## Returns: T if the string is a valid IPv4 or IPv6 address format. ## Returns: T if the string is a valid IPv4 or IPv6 address format.
function is_valid_ip%(ip: string%): bool function is_valid_ip%(ip: string%): bool
%{ %{
char* s = ip->AsString()->Render(); return zeek::val_mgr->Bool(zeek::IPAddr::IsValid(ip->ToStdString().c_str()));
auto rval = zeek::IPAddr::IsValid(s); %}
delete [] s;
return zeek::val_mgr->Bool(rval); ## Checks if a string is a valid IPv4 or IPv6 subnet.
##
## cidr: the string to check for valid subnet formatting.
##
## Returns: T if the string is a valid IPv4 or IPv6 subnet format.
function is_valid_subnet%(cidr: string%): bool
%{
return zeek::val_mgr->Bool(zeek::IPPrefix::IsValid(cidr->ToStdString().c_str()));
%} %}
## Converts a :zeek:type:`string` to a :zeek:type:`subnet`. ## Converts a :zeek:type:`string` to a :zeek:type:`subnet`.

View file

@ -1,2 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
556 seen BiFs, 0 unseen BiFs (), 0 new BiFs () 557 seen BiFs, 0 unseen BiFs (), 0 new BiFs ()

View file

@ -48,6 +48,16 @@ F
F F
F F
F F
============ test is_valid_subnet()
T
T
T
T
F
F
F
F
F
============ test extract_ip_addresses() ============ test extract_ip_addresses()
[1.1.1.1, 2.2.2.2, 3.3.3.3] [1.1.1.1, 2.2.2.2, 3.3.3.3]
[1.1.1.1, 0:0:0:0:0:0:0:0, 3.3.3.3] [1.1.1.1, 0:0:0:0:0:0:0:0, 3.3.3.3]

View file

@ -386,6 +386,7 @@ global known_BiFs = set(
"is_v6_addr", "is_v6_addr",
"is_v6_subnet", "is_v6_subnet",
"is_valid_ip", "is_valid_ip",
"is_valid_subnet",
"join_string_set", "join_string_set",
"join_string_vec", "join_string_vec",
"levenshtein_distance", "levenshtein_distance",

View file

@ -132,6 +132,17 @@ event zeek_init()
print is_valid_ip("6:1:2::3:4:5:6:7"); print is_valid_ip("6:1:2::3:4:5:6:7");
print is_valid_ip("6:1:2::3:4:5:6:7:8"); print is_valid_ip("6:1:2::3:4:5:6:7:8");
print "============ test is_valid_subnet()";
print is_valid_subnet("10.0.0.0/0"); # T!
print is_valid_subnet("10.0.0.0/8");
print is_valid_subnet("10.0.0.0/32");
print is_valid_subnet("fe80::/64");
print is_valid_subnet("10.0.0.0/64"); # F
print is_valid_subnet("256.256.256.256/32"); # F
print is_valid_subnet("10.0.0.0"); # F
print is_valid_subnet("[fe80::]/64"); # F
print is_valid_subnet("10/8"); # F
print "============ test extract_ip_addresses()"; print "============ test extract_ip_addresses()";
print extract_ip_addresses("this is 1.1.1.1 a test 2.2.2.2 string with ip addresses 3.3.3.3"); print extract_ip_addresses("this is 1.1.1.1 a test 2.2.2.2 string with ip addresses 3.3.3.3");
print extract_ip_addresses("this is 1.1.1.1 a test 0:0:0:0:0:0:0:0 string with ip addresses 3.3.3.3"); print extract_ip_addresses("this is 1.1.1.1 a test 0:0:0:0:0:0:0:0 string with ip addresses 3.3.3.3");