Maintain CIDR formatting

[grigorescu]

CIDR notation gets extra spaces around the slash:

-global my_subnets = { 1.2.3.4/19, 5.6.7.8/21 };
+global my_subnets = {
+       1.2.3.4 / 19,
+       5.6.7.8 / 21
+};

[bbannier]

There are multiple issue here:

• zeekscript currently has no dedicated formatter for networks
• zeek/tree-sitter-zeek detects this as a division, so the special handling for address and / in the grammar triggers incorrectly:

  $ zeek-script parse foo.zeek
  source_file (0.0,1.0) 'global my_subnets = { 1.2.3.4 / 19, 5.6.7.8 / 21 };\n'
    decl (0.0,0.51) 'global my_subnets = { 1.2.3.4 / 19, 5.6.7.8 / 21 };'
        global_decl (0.0,0.51) 'global my_subnets = { 1.2.3.4 / 19, 5.6.7.8 / 21 };'
            global (0.0,0.6)
            id (0.7,0.17) 'my_subnets'
            initializer (0.18,0.50) '= { 1.2.3.4 / 19, 5.6.7.8 / 21 }'
                init_class (0.18,0.19) '='
                    = (0.18,0.19)
                expr (0.20,0.50) '{ 1.2.3.4 / 19, 5.6.7.8 / 21 }'
                    { (0.20,0.21)
                    expr_list (0.22,0.48) '1.2.3.4 / 19, 5.6.7.8 / 21'
                        expr (0.22,0.34) '1.2.3.4 / 19'
                            expr (0.22,0.29) '1.2.3.4'
                                constant (0.22,0.29) '1.2.3.4'
                                    ipv4 (0.22,0.29) '1.2.3.4'
                            / (0.30,0.31)
                            expr (0.32,0.34) '19'
                                constant (0.32,0.34) '19'
                                    integer (0.32,0.34) '19'
                        , (0.34,0.35)
                        expr (0.36,0.48) '5.6.7.8 / 21'
                            expr (0.36,0.43) '5.6.7.8'
                                constant (0.36,0.43) '5.6.7.8'
                                    ipv4 (0.36,0.43) '5.6.7.8'
                            / (0.44,0.45)
                            expr (0.46,0.48) '21'
                                constant (0.46,0.48) '21'
                                    integer (0.46,0.48) '21'
                    } (0.49,0.50)
            ; (0.50,0.51)
  

[keithjjones]

+1 on this issue.

[keithjjones]

There could be an issue with spaces in ipv6 addresses too?

% cat bug.zeek
# Determine if either orig or resp fall in the multicast addr range
function is_multicast(cid: conn_id): bool
	{
	local ipv4_multicast = 224.0.0.0/4;
	local ipv6_multicast = [ff00::]/8;

	if ( is_v4_addr(cid$orig_h) && cid$orig_h in ipv4_multicast )
		return T;

	if ( is_v4_addr(cid$resp_h) && cid$resp_h in ipv4_multicast )
		return T;

	if ( is_v6_addr(cid$orig_h) && cid$orig_h in ipv6_multicast )
		return T;

	if ( is_v6_addr(cid$resp_h) && cid$resp_h in ipv6_multicast )
		return T;

	return F;
	}

event zeek_done()
	{
	print is_multicast([$orig_h=10.1.1.1, $orig_p=123/udp, $resp_h=10.1.1.2, $resp_p=123/udp]);
	}%

% zeek bug.zeek
F

% zeek-format bug.zeek > bug-formatted.zeek

% cat bug-formatted.zeek
# Determine if either orig or resp fall in the multicast addr range
function is_multicast(cid: conn_id): bool
	{
	local ipv4_multicast = 224.0.0.0 / 4;
	local ipv6_multicast = [ ff00:: ] / 8;

	if ( is_v4_addr(cid$orig_h) && cid$orig_h in ipv4_multicast )
		return T;

	if ( is_v4_addr(cid$resp_h) && cid$resp_h in ipv4_multicast )
		return T;

	if ( is_v6_addr(cid$orig_h) && cid$orig_h in ipv6_multicast )
		return T;

	if ( is_v6_addr(cid$resp_h) && cid$resp_h in ipv6_multicast )
		return T;

	return F;
	}

event zeek_done()
	{
	print is_multicast([ $orig_h=10.1.1.1, $orig_p=123/udp, $resp_h=10.1.1.2,
	    $resp_p=123/udp ]);
	}

% zeek bug-formatted.zeek
error in ./bug-formatted.zeek, line 5: unknown identifier ff00, at or near "ff00"

[bbannier]

There could be an issue with spaces in ipv6 addresses too?

This is a separate issue, I just filed #70.