yara icon indicating copy to clipboard operation
yara copied to clipboard

Feature: Network module including "ipv4" and "ipv6" keywords

Open malvidin opened this issue 4 years ago • 0 comments

A network module with ipv4 and ipv6 keywords to decode ascii/wide IP addresses. This would simplify matches and comparisons of IP addresses extracted, including comparisons to an IP address external variables.

( ipv4("10.0.0.0") >> 24 ) == ( ipv4("1\x000\x00.\x001\x00.\x002.\x003\x00") >>24 ) ( ipv4(0x310030002e0030002e0030002e003000) >> 24 ) == ( ipv4("10.1.2.3") >>24 )

( ipv6("2001:0DB8:1:2::/64") >> 96 ) == ( ipv6("2001:db8:1:2:020c:29ff:fe0c:47d5") >> 96 )

IP address matching can be done already for binary addresses, but comparisons are difficult to understand without comments. ( 0x0a0a0a0a >> 24 ) == ( 0x0a000000 >> 24 ) ( 0x0a0a0a0a && 0x0a000000 == 0x0a000000 ) ( 0x0a0a0a0a ^ 0x0a000000 <= 0xFFFFFF )

This feature request is for condition definitions, not string matching like #741.

malvidin avatar Oct 31 '19 18:10 malvidin