contains operator

core/src/filter/ast.rs

@@ -667,7 +667,7 @@ pub(super) fn is_excl_int(
             BinOp::In => return peer_to < from || peer_from > to,
             _ => {}
         },
-        BinOp::Re | BinOp::En => {}
+        BinOp::Re | BinOp::En | BinOp::Contains => {}
     }
     false
 }
@@ -802,6 +802,7 @@ pub enum BinOp {
     In,
     Re,
     En,
+    Contains,
 }
 
 impl fmt::Display for BinOp {
@@ -816,6 +817,7 @@ impl fmt::Display for BinOp {
             BinOp::In => write!(f, "in"),
             BinOp::Re => write!(f, "matches"),
             BinOp::En => write!(f, "eq"),
+            BinOp::Contains => write!(f, "contains"),
         }
     }
 }

core/src/filter/grammar.pest

@@ -53,7 +53,7 @@ not_op = { "!" | "not" | "NOT" }  // not yet supported, temp placeholder
 // Binary operators
 // ----------------------------------------------------------------------
 bin_op = {
-    eq_op | ne_op | ge_op | le_op | gt_op | lt_op | in_op | re_op | en_op
+    eq_op | ne_op | ge_op | le_op | gt_op | lt_op | in_op | re_op | en_op | contains_op
 }
 
 eq_op = { "=" }
@@ -65,6 +65,7 @@ lt_op = { "<" | "lt" }
 in_op = { "in" }
 re_op = { "~" | "matches" }
 en_op = { "eq" }
+contains_op = { "contains" }
 
 // Miscellaneous
 // ----------------------------------------------------------------------

core/src/filter/parser.rs

@@ -183,6 +183,7 @@ impl FilterParser {
             Rule::in_op => Ok(BinOp::In),
             Rule::re_op => Ok(BinOp::Re),
             Rule::en_op => Ok(BinOp::En),
+            Rule::contains_op => Ok(BinOp::Contains),
             _ => bail!(FilterError::InvalidBinOp(op_str)),
         }
     }

examples/log_ssh/src/main.rs

@@ -28,25 +28,35 @@ struct Args {
     outfile: PathBuf,
 }
 
-#[filter("ssh.software_version_ctos ~ '^OpenSSH_[0-9]+\\.[0-9].*$'")]
-fn ssh_cb(ssh: &SshHandshake) {
+#[filter("ssh.protocol_version_ctos = |32 2E 30|")]
+fn ssh_byte_match_cb(ssh: &SshHandshake) {
     if let Ok(serialized) = serde_json::to_string(&ssh) {
         let mut wtr = file.lock().unwrap();
         wtr.write_all(serialized.as_bytes()).unwrap();
         wtr.write_all(b"\n").unwrap();
     }
 }
 
-#[filter("ssh.protocol_version_ctos = |32 2E 30|")]
-fn ssh_byte_match_cb(ssh: &SshHandshake) {
+// check if contains b"OpenSSH"
+#[filter("ssh.software_version_ctos contains |4F 70 65 6E 53 53 48|")]
+fn ssh_contains_bytes_cb(ssh: &SshHandshake) {
+    if let Ok(serialized) = serde_json::to_string(&ssh) {
+        let mut wtr = file.lock().unwrap();
+        wtr.write_all(serialized.as_bytes()).unwrap();
+        wtr.write_all(b"\n").unwrap();
+    }
+}
+
+#[filter("ssh.software_version_ctos contains 'OpenSSH'")]
+fn ssh_contains_str_cb(ssh: &SshHandshake) {
     if let Ok(serialized) = serde_json::to_string(&ssh) {
         let mut wtr = file.lock().unwrap();
         wtr.write_all(serialized.as_bytes()).unwrap();
         wtr.write_all(b"\n").unwrap();
     }
 }
 
-#[retina_main(2)]
+#[retina_main(3)]
 fn main() {
     let args = Args::parse();
     let config = load_config(&args.config);

filtergen/src/lib.rs

@@ -141,16 +141,17 @@
 //! | Byte          | `|32 2E 30|`       |
 //!
 //! ## Binary comparison operators
-//! | Operator |   Alias   |         Description        | Example                         |
-//! |----------|-----------|----------------------------|---------------------------------|
-//! | `=`      |           | Equals                     | `ipv4.addr = 127.0.0.1`         |
-//! | `!=`     | `ne`      | Not equals                 | `udp.dst_port != 53`            |
-//! | `>=`     | `ge`      | Greater than or equals     | `tcp.port >= 1024`              |
-//! | `<=`     | `le`      | Less than or equals        | `tls.version <= 771`            |
-//! | `>`      | `gt`      | Greater than               | `ipv4.time_to_live > 64`        |
-//! | `<`      | `lt`      | Less than                  | `ipv6.payload_length < 500`     |
-//! | `in`     |           | In a range, or in a subnet | `ipv4.src_addr in 1.2.3.4/16`   |
-//! | `~`      | `matches` | Regular expression match   | `tls.sni ~ 'netflix\\.com$'`    |
+//! | Operator   |   Alias   |         Description            | Example                            |
+//! |------------|-----------|--------------------------------|------------------------------------|
+//! | `=`        |           | Equals                         | `ipv4.addr = 127.0.0.1`            |
+//! | `!=`       | `ne`      | Not equals                     | `udp.dst_port != 53`               |
+//! | `>=`       | `ge`      | Greater than or equals         | `tcp.port >= 1024`                 |
+//! | `<=`       | `le`      | Less than or equals            | `tls.version <= 771`               |
+//! | `>`        | `gt`      | Greater than                   | `ipv4.time_to_live > 64`           |
+//! | `<`        | `lt`      | Less than                      | `ipv6.payload_length < 500`        |
+//! | `in`       |           | In a range, or in a subnet     | `ipv4.src_addr in 1.2.3.4/16`      |
+//! | `~`        | `matches` | Regular expression match       | `tls.sni ~ 'netflix\\.com$'`       |
+//! | `contains` |           | Check if right appears in left | `tls.sni contains \|2E 63 6F 6D\|` |
 //!
 //! **Possible pitfalls involving `!=`**
 //!

filtergen/src/utils.rs

@@ -152,6 +152,12 @@ pub(crate) fn binary_to_tokens(
                     //     Regex::new(#val_lit).unwrap().is_match(#proto.#field())
                     // }
                 }
+                BinOp::Contains => {
+                    let val_lit = syn::LitStr::new(text, Span::call_site());
+                    quote! {
+                        #proto.#field().contains(#val_lit)
+                    }
+                }
                 _ => panic!("Invalid binary operation `{}` for value: `{}`.", op, value),
             }
         }
@@ -162,6 +168,13 @@ pub(crate) fn binary_to_tokens(
                     #proto.#field().as_bytes() == #bytes_lit
                 }
             }
+            BinOp::Contains => {
+                let bytes_lit = syn::LitByteStr::new(b, Span::call_site());
+                let num_bytes = bytes_lit.value().len();
+                quote! {
+                    #proto.#field().as_bytes().windows(#num_bytes).any(|w| w == #bytes_lit)
+                }
+            }
             _ => panic!("Invalid binary operation `{}` for value: `{}`.", op, value),
         },
     }