rules can use special ip values ipv4 and ipv6

SCS-Labs · Sep 26, 2020 · 259c588 · 259c588
1 parent e2fce2f
commit 259c588
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/CHANGELOG b/CHANGELOG
@@ -37,6 +37,7 @@ NOTICE: Restart wiseService before capture when upgrading
   - db - new reindex command
   - capture - http2 header fields were not always indexed correctly
   - capture - fix g_hash_table_contains warning
+  - capture - rules can use special ip values ipv4 and ipv6 now
   - moloch_update_geo.sh - fix possible security issue
 
 

diff --git a/capture/rules.c b/capture/rules.c
@@ -297,7 +297,13 @@ void moloch_rules_load_add_field(MolochRule_t *rule, int pos, char *key)
             loading.fieldsTree6[pos] = New_Patricia(128);
         }
 
-        if (strchr(key, '.') != 0) {
+        if (strcmp(key, "ipv4") == 0) {
+            make_and_lookup(rule->tree4[pos], "0.0.0.0/0");
+            node = make_and_lookup(loading.fieldsTree4[pos], "0.0.0.0/0");
+        } else if (strcmp(key, "ipv6") == 0) {
+            make_and_lookup(rule->tree6[pos], "::/0");
+            node = make_and_lookup(loading.fieldsTree6[pos], "::/0");
+        } else if (strchr(key, '.') != 0) {
             make_and_lookup(rule->tree4[pos], key);
             node = make_and_lookup(loading.fieldsTree4[pos], key);
         } else {