{"action":"created","issue":{"url":"https://api.github.com/repos/vast-io/vast/issues/135","repository_url":"https://api.github.com/repos/vast-io/vast","labels_url":"https://api.github.com/repos/vast-io/vast/issues/135/labels{/name}","comments_url":"https://api.github.com/repos/vast-io/vast/issues/135/comments","events_url":"https://api.github.com/repos/vast-io/vast/issues/135/events","html_url":"https://github.com/vast-io/vast/issues/135","id":243663075,"number":135,"title":"Queries for \":subnet in prefix\" not terminating","user":{"login":"MarcinNaw","id":21240278,"avatar_url":"https://avatars2.githubusercontent.com/u/21240278?v=4","gravatar_id":"","url":"https://api.github.com/users/MarcinNaw","html_url":"https://github.com/MarcinNaw","followers_url":"https://api.github.com/users/MarcinNaw/followers","following_url":"https://api.github.com/users/MarcinNaw/following{/other_user}","gists_url":"https://api.github.com/users/MarcinNaw/gists{/gist_id}","starred_url":"https://api.github.com/users/MarcinNaw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarcinNaw/subscriptions","organizations_url":"https://api.github.com/users/MarcinNaw/orgs","repos_url":"https://api.github.com/users/MarcinNaw/repos","events_url":"https://api.github.com/users/MarcinNaw/events{/privacy}","received_events_url":"https://api.github.com/users/MarcinNaw/received_events","type":"User","site_admin":false},"labels":[{"id":10662844,"url":"https://api.github.com/repos/vast-io/vast/labels/bug","name":"bug","color":"e10c02","default":true},{"id":175887069,"url":"https://api.github.com/repos/vast-io/vast/labels/in%20progress","name":"in progress","color":"d7e102","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2017-07-18T10:00:50Z","updated_at":"2017-07-20T12:55:47Z","closed_at":null,"body":"[Bug report]\r\n\r\nConsider the following queries:\r\n\r\n1. `vast export ascii \":subnet == 103.16.124.0/22\"`\r\n2. `vast export ascii \":subnet in 103.16.124.0/22\"`\r\n\r\nQuery 1) works as expected, however query 2) retrieves no data and does not terminate. The VAST backend accepts the query, but does not find any matching indexes.\r\n\r\n**Use case for query 2):** \r\n\r\nLets say my prefix is 103.16.124.0/22 and I have imported a bunch of BGP data (RIPE RIS, Routeviews etc). I want to check for hijacks by searching for announcements that involve more specific prefixes, hence prefixes that are \"in\" the prefix.\r\n"},"comment":{"url":"https://api.github.com/repos/vast-io/vast/issues/comments/316694270","html_url":"https://github.com/vast-io/vast/issues/135#issuecomment-316694270","issue_url":"https://api.github.com/repos/vast-io/vast/issues/135","id":316694270,"user":{"login":"josephnoir","id":2156518,"avatar_url":"https://avatars3.githubusercontent.com/u/2156518?v=4","gravatar_id":"","url":"https://api.github.com/users/josephnoir","html_url":"https://github.com/josephnoir","followers_url":"https://api.github.com/users/josephnoir/followers","following_url":"https://api.github.com/users/josephnoir/following{/other_user}","gists_url":"https://api.github.com/users/josephnoir/gists{/gist_id}","starred_url":"https://api.github.com/users/josephnoir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josephnoir/subscriptions","organizations_url":"https://api.github.com/users/josephnoir/orgs","repos_url":"https://api.github.com/users/josephnoir/repos","events_url":"https://api.github.com/users/josephnoir/events{/privacy}","received_events_url":"https://api.github.com/users/josephnoir/received_events","type":"User","site_admin":false},"created_at":"2017-07-20T12:55:47Z","updated_at":"2017-07-20T12:55:47Z","body":"The query is now accepted by VAST, but the `exporter ignores false positive[s]` that should not actually false. For example, for the query `:subnet in 218.88.0.0/14`, the importer ignores the following entry.\r\n```\r\nbro::bgpupdates [1000661|+1499937568000000000ns] [\"route-views.saopaulo\", +1499937568000000000ns, \"A\", 23650, 218.90.232.0/24]\r\n```\r\nThe last value is the subnet `218.90.232.0/24`. Since this is less specific, I'd expect the query to return the result and not discard it.\r\n```\r\n218.88.../14: 1101 1010 0101 1000\r\n218.90.../24: 1101 1010 0101 1010\r\n                              ^\r\n```"}}
{"actor":{"display_login":"josephnoir"}}