specials

Some simple comparison expression normalization functions.

ipv4_addr(comp_expr)

Canonicalizes a CIDR IPv4 address by zeroing out low-order bits, according to the prefix size. This affects the rhs when the “value” property of an ipv4-addr is being compared. If the prefix size is 32, the size suffix is simply dropped since it’s redundant. If the value is not a valid CIDR address, then no change is made. This also runs the address through the platform’s IPv4 address processing functions (inet_aton() and inet_ntoa()), which can adjust the format.

This side-effects the given AST.

Parameters:comp_expr – A _ComparisonExpression object whose type is ipv4-addr.

ipv6_addr(comp_expr)

Canonicalizes a CIDR IPv6 address by zeroing out low-order bits, according to the prefix size. This affects the rhs when the “value” property of an ipv6-addr is being compared. If the prefix size is 128, the size suffix is simply dropped since it’s redundant. If the value is not a valid CIDR address, then no change is made. This also runs the address through the platform’s IPv6 address processing functions (inet_pton() and inet_ntop()), which can adjust the format.

This side-effects the given AST.

Parameters:comp_expr – A _ComparisonExpression object whose type is ipv6-addr.

windows_reg_key(comp_expr)

Lower-cases the rhs, depending on the windows-registry-key property being compared. This enables case-insensitive comparisons between two patterns, for those values. This side-effects the given AST.

Parameters:comp_expr – A _ComparisonExpression object whose type is windows-registry-key