fix(userspace/libsinsp): solve issues with negate comparisons on ip a…

…nd ipnet checks Signed-off-by: Jason Dellaluce <[email protected]>
falcosecurity · Jul 11, 2024 · ad46fd6 · ad46fd6
1 parent d8b5b2e
commit ad46fd6
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 9 deletions.
diff --git a/userspace/libsinsp/filter/ast.h b/userspace/libsinsp/filter/ast.h
@@ -493,7 +493,7 @@ struct SINSP_PUBLIC unary_check_expr: expr
     bool is_equal(const expr* other) const override
     {
         auto o = dynamic_cast<const unary_check_expr*>(other);
-        return o != nullptr && left->is_equal(o->left.get());
+        return o != nullptr && left->is_equal(o->left.get()) && op == o->op;
     }
 
     std::unique_ptr<expr> left;

diff --git a/userspace/libsinsp/filter_compare.cpp b/userspace/libsinsp/filter_compare.cpp
@@ -650,41 +650,41 @@ bool flt_compare(cmpop op, ppm_param_type type, const void* operand1, const void
 	case PT_IPV4ADDR:
 		if (op2_len != sizeof(struct in_addr))
 		{
-			return false;
+			return op == CO_NE;
 		}
 		return flt_compare_ipv4addr(op, flt_cast<uint32_t, uint64_t>(operand1), flt_cast<uint32_t, uint64_t>(operand2));
 	case PT_IPV4NET:
 		if (op2_len != sizeof(ipv4net))
 		{
-			return false;
+			return op == CO_NE;
 		}
 		return flt_compare_ipv4net(op, (uint64_t)*(uint32_t*)operand1, (ipv4net*)operand2);
 	case PT_IPV6ADDR:
 		if (op2_len != sizeof(ipv6addr))
 		{
-			return false;
+			return op == CO_NE;
 		}
 		return flt_compare_ipv6addr(op, (ipv6addr *)operand1, (ipv6addr *)operand2);
 	case PT_IPV6NET:
 		if (op2_len != sizeof(ipv6net))
 		{
-			return false;
+			return op == CO_NE;
 		}
 		return flt_compare_ipv6net(op, (ipv6addr *)operand1, (ipv6net*)operand2);
 	case PT_IPADDR:
 		if(op1_len == sizeof(struct in_addr))
 		{
 			if (op2_len != sizeof(struct in_addr))
 			{
-				return false;
+				return op == CO_NE;
 			}
 			return flt_compare(op, PT_IPV4ADDR, operand1, operand2, op1_len, op2_len);
 		}
 		else if(op1_len == sizeof(struct in6_addr))
 		{
 			if (op2_len != sizeof(ipv6addr))
 			{
-				return false;
+				return op == CO_NE;
 			}
 			return flt_compare(op, PT_IPV6ADDR, operand1, operand2, op1_len, op2_len);
 		}
@@ -697,15 +697,15 @@ bool flt_compare(cmpop op, ppm_param_type type, const void* operand1, const void
 		{
 			if (op2_len != sizeof(ipv4net))
 			{
-				return false;
+				return op == CO_NE;
 			}
 			return flt_compare(op, PT_IPV4NET, operand1, operand2, op1_len, op2_len);
 		}
 		else if(op1_len == sizeof(struct in6_addr))
 		{
 			if (op2_len != sizeof(ipv6net))
 			{
-				return false;
+				return op == CO_NE;
 			}
 			return flt_compare(op, PT_IPV6NET, operand1, operand2, op1_len, op2_len);
 		}