Re: netmask filter issue
Evan Rempel <[email protected]> Tue, 15 Oct 2024 00:32:37 +0000
| Newsgroups | gmane.comp.syslog-ng |
|---|---|
| Message-ID | <YT4P288MB03355F0F965988C4C22978C0B9452@YT4P288MB0335.CANP288.PROD.OUTLOOK.COM> |
--===============2428629014647996906== Content-Language: en-CA Content-Type: multipart/alternative; boundary="_000_YT4P288MB03355F0F965988C4C22978C0B9452YT4P288MB0335CANP_" --_000_YT4P288MB03355F0F965988C4C22978C0B9452YT4P288MB0335CANP_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable First off, to write a CIDR address correctly you need to use something of t= he form w.x.y.z/M Your specification is missing the ".z" prtion of the ip address. I think there is also some confusion regarding how netmasks work. The ip address 192.168.128.0 (I assume you want a .0 at the end) written in= binary is 11000000.10101000.10000000.00000000 The /17 subnet mask written in binary is 11111111.11111111.10000000.000000= 00 If we perform a binary AND of these two addresses we get 11000000.10101000= .10000000.000000 written in decimal is 192.168.128.0 This means that the FIRST address of this range is 192.168.128.0 If we perform the binary NOT of the subnet mask we get 00000000.00000000.01= 111111.11111111 When we take the binary OR of this with the IP address (w.x.y.z) we get 110= 00000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the = last address if the range. The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.168.= 255.255 I hope that helps. -- Evan ________________________________ From: syslog-ng <[email protected]> on behalf of brian hof= fman <[email protected]> Sent: October 14, 2024 11:27 AM To: [email protected] <[email protected]> Subject: [syslog-ng] netmask filter issue You don't often get email from [email protected]. Learn why this is im= portant<https://aka.ms/LearnAboutSenderIdentification> I set up a filter to send certain messages matching an IP range to a destin= ation (a simplified version of my actual config). filter f_siem { netmask(192.168.128/17) or }; For some reason this is picking up the address 192.168.63.41, even though i= t's not in the range. 192.168.63.41 (10101100.00010111.0) does not match th= e network portion of 192.168.128.0/17 (10101100.00010111.1) but for some re= ason it's still getting picked up. I know for sure that it is this particu= lar line because when I comment it out the messages are no longer forwarded= for that device. Is there something different about the way this netmask directive works in = syslog-ng that would cause it to get matched by this filter? -Brian --_000_YT4P288MB03355F0F965988C4C22978C0B9452YT4P288MB0335CANP_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> First off, to write a CIDR address correctly you need to use something of t= he form w.x.y.z/M</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> Your specification is missing the ".z" prtion of the ip address.<= /div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> I think there is also some confusion regarding how netmasks work.</div= > <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> The ip address 192.168.128.0 (I assume you want a .0 at the end) written in= binary is 11000000.10101000.10000000.00000000</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> The /17 subnet mask written in binary is 11111111.11111111.10000000.0= 0000000</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> If we perform a binary AND of these two addresses we get 11000000.101= 01000.10000000.000000 written in decimal is 192.168.128.0</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> This means that the FIRST address of this range is 192.168.128.0</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> If we perform the binary NOT of the subnet mask we get 00000000.00000000.01= 111111.11111111</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> When we take the binary OR of this with the IP address (w.x.y.z) we get 110= 00000.10101000.11111111.1111111 in decimal is 192.168.255.255 which is the = last address if the range.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> The result is that 192.168.1.0/17 means the range 192.168.128.0 -- 192.168.= 255.255</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> I hope that helps.</div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo= nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c= olor: rgb(0, 0, 0);"> <br> </div> <div id=3D"Signature" class=3D"elementToProof"> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(153, 153, 153);= "> --</div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(153, 153, 153);= "> Evan</div> </div> <div id=3D"appendonsend"></div> <div style=3D"font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, = Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <hr style=3D"display: inline-block; width: 98%;"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><span style=3D"font-family: Calibri, = sans-serif; font-size: 11pt; color: rgb(0, 0, 0);"><b>From:</b> syslog= -ng <[email protected]> on behalf of brian hoffman &= lt;[email protected]><br> <b>Sent:</b> October 14, 2024 11:27 AM<br> <b>To:</b> [email protected] <[email protected]&g= t;<br> <b>Subject:</b> [syslog-ng] netmask filter issue</span> <div> </div> </div> <table align=3D"left" style=3D"direction: ltr; text-indent: revert; line-he= ight: revert; white-space: revert; background-color: revert; display: table= ; margin: revert; width: 100%; height: revert; table-layout: fixed; color: = revert; border-collapse: collapse; border-spacing: 0px; box-sizing: border-= box;"> <tbody> <tr style=3D"background-color: revert;"> <td style=3D"direction: ltr; text-indent: revert; line-height: revert; whit= e-space: revert; border-width: revert; border-style: revert; border-color: = revert; background-color: rgb(166, 166, 166); padding: 7px 2px; word-break:= revert; color: revert; width: 0px; height: revert;"> </td> <td style=3D"direction: ltr; text-align: left; text-indent: revert; line-he= ight: revert; white-space: revert; border-width: revert; border-style: reve= rt; border-color: revert; background-color: rgb(234, 234, 234); padding: 7p= x 5px 7px 15px; word-break: revert; color: rgb(33, 33, 33); width: 100%; he= ight: revert;"> <div style=3D"direction: ltr; text-align: left; text-indent: revert; line-h= eight: revert; white-space: revert; font-family: wf_segoe-ui_normal, "= Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; color: rev= ert;"> <span style=3D"letter-spacing: revert; background-color: revert; line-heigh= t: revert;">You don't often get email from [email protected]. <a href=3D"https://aka.ms/LearnAboutSenderIdentification" data-auth=3D"NotA= pplicable" style=3D"color: revert; display: revert; background-color: rever= t;" id=3D"OWAdc785467-8ffd-05ec-48b8-9f3b271561ae" class=3D"OWAAutoLink"> Learn why this is important</a></span></div> </td> <td align=3D"left" style=3D"direction: ltr; text-indent: revert; line-heigh= t: revert; white-space: revert; border-width: revert; border-style: revert;= border-color: revert; background-color: rgb(234, 234, 234); padding: 7px 5= px; word-break: revert; color: rgb(33, 33, 33); width: 75px; height: revert= ;"> </td> </tr> </tbody> </table> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> I set up a filter to send certain messages matching an IP range to a destin= ation (a simplified version of my actual config).</div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> filter f_siem {</div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> netmask(192.168.128/17) or</div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> };</div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> <br> </div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> <span style=3D"color: rgb(0, 0, 0);">For some reason this is picking up the= address 192.168.63.41, even though it's not in the range. </span>192.168.63.41 (10101100.00010111.0) does not match the network porti= on of 192.168.128.0/17 (10101100.00010111.1) but for some reason it's still= getting picked up. I know for sure that it is this particular line b= ecause when I comment it out the messages are no longer forwarded for that device.</div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> <br> </div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> Is there something different about the way this netmask directive works in = syslog-ng that would cause it to get matched by this filter?</div> <div style=3D"direction: ltr; font-family: "Helvetica Neue", Helv= etica, Arial, sans-serif; font-size: 18px;"> -Brian</div> </body> </html> --_000_YT4P288MB03355F0F965988C4C22978C0B9452YT4P288MB0335CANP_-- --===============2428629014647996906== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq --===============2428629014647996906==--