net primitive does to accept dotted quads

[eugeneia]

PFlua's net primitive does not support dotted quads as described in in the pcap-filter manpage:

dst net net

True if the IPv4/v6 destination address of the packet has a network number of net. Net may be either a name from the networks database (/etc/networks, etc.) or a network number. An IPv4 network number can be written as a dotted quad (e.g., 192.168.1.0), dotted triple (e.g., 192.168.1), dotted pair (e.g, 172.16), or single number (e.g., 10); the netmask is 255.255.255.255 for a dotted quad (which means that it’s really a host match), 255.255.255.0 for a dotted triple, 255.255.0.0 for a dotted pair, or 255.0.0.0 for a single number. An IPv6 network number must be written out fully; the netmask is ff:ff:ff:ff:ff:ff:ff:ff, so IPv6 "network" matches are really always host matches, and a network match requires a netmask length.

To reproduce:

pf.compile_filter("src net 109.145.29.1")

Result:

Error in pflua/src/pf/expand.lua:540: attempt to index a number value

Expected result: A compiled filter that matches only packets from 109.145.29.1.

[kbara]

Thanks for reporting this, @eugeneia ; it definitely needs to be fixed. As a workaround in the meanwhile, "src net 109.145.29.1/32" appears to work.

[eugeneia]

@kbara Yeah I know :) A tip: Write a generator for the packet-filter grammar and fuzz PFLua with it. That will weed out these kinds of bugs quickly (checking that the compiled behavior is actually correct is another issue though).

[kbara]

@eugeneia Yeah, I've written a partial generator, and mean to expand it - and to run it through AFL, cross-checking with whether libpcap accepts various expressions, to make sure I miss less corner cases. I'm still learning about all sorts of interesting edge cases ( #157 and #82 cover a subset). This one, admittedly, is not in that category; it should Just Work, and I apologize that it doesn't.
Edit: as to whether compiled behavior is correct, the property-based tests I've written check the bpflua and pure-lua pipelines against each other on randomly selected packets. It's not exhaustive, but it has found several bugs, most of which are fixed; I need to extend it to run against a pure-libpcap pipeline, admittedly.

[dpino]

The error is due to wrong expansion of "src net ". It could be possible to use a mask length or not, and that should be checked to know what's the right offset that contains the IP address.

About improving the syntax of IPv4 addresses, @kbarone created #161 .