yara
yara copied to clipboard
Feature: Network module including "ipv4" and "ipv6" keywords
A network module with ipv4
and ipv6
keywords to decode ascii/wide IP addresses. This would simplify matches and comparisons of IP addresses extracted, including comparisons to an IP address external variables.
( ipv4("10.0.0.0") >> 24 ) == ( ipv4("1\x000\x00.\x001\x00.\x002.\x003\x00") >>24 )
( ipv4(0x310030002e0030002e0030002e003000) >> 24 ) == ( ipv4("10.1.2.3") >>24 )
( ipv6("2001:0DB8:1:2::/64") >> 96 ) == ( ipv6("2001:db8:1:2:020c:29ff:fe0c:47d5") >> 96 )
IP address matching can be done already for binary addresses, but comparisons are difficult to understand without comments.
( 0x0a0a0a0a >> 24 ) == ( 0x0a000000 >> 24 )
( 0x0a0a0a0a && 0x0a000000 == 0x0a000000 )
( 0x0a0a0a0a ^ 0x0a000000 <= 0xFFFFFF )
This feature request is for condition definitions, not string matching like #741.