base/utils/addrs.bro

Functions for parsing and manipulating IP and MAC addresses.

Source File:/scripts/base/utils/addrs.bro

Summary

Constants

ip_addr_regex: pattern
ipv4_addr_regex: pattern
ipv6_8hex_regex: pattern
ipv6_addr_regex: pattern
ipv6_compressed_hex4dec_regex: pattern
ipv6_compressed_hex_regex: pattern
ipv6_hex4dec_regex: pattern

Functions

addr_to_uri: function	Returns the string representation of an IP address suitable for inclusion in a URI.
extract_ip_addresses: function	Extracts all IP (v4 or v6) address strings from a given string.
find_ip_addresses: function &deprecated	Extracts all IP (v4 or v6) address strings from a given string.
has_valid_octets: function	Checks if all elements of a string array are a valid octet value.
is_valid_ip: function	Checks if a string appears to be a valid IPv4 or IPv6 address.
normalize_mac: function	Given a string, extracts the hex digits and returns a MAC address in the format: 00:a0:32:d7:81:8f.

Detailed Interface

Constants

ip_addr_regex

Type:pattern Default:

/^?((^?((^?((^?((^?([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})$?)|(^?(([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4})$?))$?)|(^?((([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?)::(([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?))$?))$?)|(^?((([0-9A-Fa-f]{1,4}:){6,6})([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+))$?))$?)|(^?((([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?)::(([0-9A-Fa-f]{1,4}:)*)([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+))$?))$?/

ipv4_addr_regex

Type:pattern Default:

/^?([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3})$?/

ipv6_8hex_regex

Type:pattern Default:

/^?(([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4})$?/

ipv6_addr_regex

Type:pattern Default:

/^?((^?((^?((^?(([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4})$?)|(^?((([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?)::(([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?))$?))$?)|(^?((([0-9A-Fa-f]{1,4}:){6,6})([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+))$?))$?)|(^?((([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?)::(([0-9A-Fa-f]{1,4}:)*)([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+))$?))$?/

ipv6_compressed_hex4dec_regex

Type:pattern Default:

/^?((([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?)::(([0-9A-Fa-f]{1,4}:)*)([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+))$?/

ipv6_compressed_hex_regex

Type:pattern Default:

/^?((([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?)::(([0-9A-Fa-f]{1,4}(:[0-9A-Fa-f]{1,4})*)?))$?/

ipv6_hex4dec_regex

Type:pattern Default:

/^?((([0-9A-Fa-f]{1,4}:){6,6})([0-9]+)\.([0-9]+)\.([0-9]+)\.([0-9]+))$?/

Functions

addr_to_uri

Type:function (a: addr) : string

Returns the string representation of an IP address suitable for inclusion in a URI. For IPv4, this does no special formatting, but for IPv6, the address is included in square brackets.

A:the address to make suitable for URI inclusion. Returns:the string representation of the address suitable for URI inclusion.

extract_ip_addresses

Type:function (input: string) : string_vec

Extracts all IP (v4 or v6) address strings from a given string.

Input:a string that may contain an IP address anywhere within it. Returns:an array containing all valid IP address strings found in input.

find_ip_addresses

Type:function (input: string) : string_array Attributes:&deprecated

Extracts all IP (v4 or v6) address strings from a given string.

Input:a string that may contain an IP address anywhere within it. Returns:an array containing all valid IP address strings found in input.

has_valid_octets

Type:function (octets: string_vec) : bool

Checks if all elements of a string array are a valid octet value.

Octets:an array of strings to check for valid octet values. Returns:T if every element is between 0 and 255, inclusive, else F.

is_valid_ip

Type:function (ip_str: string) : bool

Checks if a string appears to be a valid IPv4 or IPv6 address.

Ip_str:the string to check for valid IP formatting. Returns:T if the string is a valid IPv4 or IPv6 address format.

normalize_mac

Type:function (a: string) : string

Given a string, extracts the hex digits and returns a MAC address in the format: 00:a0:32:d7:81:8f. If the string doesn’t contain 12 or 16 hex digits, an empty string is returned.

A:the string to normalize. Returns:a normalized MAC address, or an empty string in the case of an error.