specials¶
Some simple comparison expression normalization functions.
-
ipv4_addr
(comp_expr)¶ Canonicalizes a CIDR IPv4 address by zeroing out low-order bits, according to the prefix size. This affects the rhs when the “value” property of an ipv4-addr is being compared. If the prefix size is 32, the size suffix is simply dropped since it’s redundant. If the value is not a valid CIDR address, then no change is made. This also runs the address through the platform’s IPv4 address processing functions (inet_aton() and inet_ntoa()), which can adjust the format.
This side-effects the given AST.
Parameters: comp_expr – A _ComparisonExpression object whose type is ipv4-addr.
-
ipv6_addr
(comp_expr)¶ Canonicalizes a CIDR IPv6 address by zeroing out low-order bits, according to the prefix size. This affects the rhs when the “value” property of an ipv6-addr is being compared. If the prefix size is 128, the size suffix is simply dropped since it’s redundant. If the value is not a valid CIDR address, then no change is made. This also runs the address through the platform’s IPv6 address processing functions (inet_pton() and inet_ntop()), which can adjust the format.
This side-effects the given AST.
Parameters: comp_expr – A _ComparisonExpression object whose type is ipv6-addr.
-
windows_reg_key
(comp_expr)¶ Lower-cases the rhs, depending on the windows-registry-key property being compared. This enables case-insensitive comparisons between two patterns, for those values. This side-effects the given AST.
Parameters: comp_expr – A _ComparisonExpression object whose type is windows-registry-key