[Bro-Dev] IPv6 literal addr constants

[Daniel Thayer]

On 03/09/2012 11:01 AM, Siwek, Jonathan Luke wrote:
> Representing compressed-hex IPv6 addresses (replacing consecutive fields of zeros with ::) in scripts as literal constants can be ambiguous with identifiers that use "::" as a namespace resolver.
>
> For example, the lexer will treat "aaaa::bbbb" as the "bbbb" identifier in the "aaaa" namespace/module.  Specifically, this is the case where someone tries to write an address that uses only the first and last 16-bit fields and the first nibble of both fields is a letter.
>
> I think this would be uncommon, but also maybe not obvious to figure out when someone actually runs into it, though it's easy to workaround once you know what's going on.  Any ideas for fixing the ambiguity or does it seem reasonable to just have it documented?
>
> +Jon


The example that I found yesterday was a607:f8b0::/32 (I get an error 
message from bro, "unknown identifier a607").  If I write it
as a607:f8b0::0:0:0:0:0/32, then I still get the same
error message.  Writing it without a double colon
a607:f8b0:0:0:0:0:0:0/32 seems to work.

If the first digit is in the range 0-9 (and not in
the range a-f), then bro does not complain (such
as 2607:f8b0::/32).


-Daniel