# IPv6 literal addr constants **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [March 9, 2012, 5:01pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260 "2012-03-09T17:01:39Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [March 9, 2012, 5:01pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/1 "2012-03-09T17:01:39Z")
Representing compressed-hex IPv6 addresses (replacing consecutive fields of zeros with :🙂 in scripts as literal constants can be ambiguous with identifiers that use "::" as a namespace resolver. For example, the lexer will treat "aaaa::bbbb" as the "bbbb" identifier in the "aaaa" namespace/module. Specifically, this is the case where someone tries to write an address that uses only the first and last 16-bit fields and the first nibble of both fields is a letter. I think this would be uncommon, but also maybe not obvious to figure out when someone actually runs into it, though it's easy to workaround once you know what's going on. Any ideas for fixing the ambiguity or does it seem reasonable to just have it documented? +Jon ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [March 9, 2012, 5:27pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/2 "2012-03-09T17:27:52Z")
The example that I found yesterday was a607:f8b0::/32 (I get an error message from bro, "unknown identifier a607"). If I write it as a607:f8b0::0:0:0:0:0/32, then I still get the same error message. Writing it without a double colon a607:f8b0:0:0:0:0:0:0/32 seems to work. If the first digit is in the range 0-9 (and not in the range a-f), then bro does not complain (such as 2607:f8b0::/32). -Daniel ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [March 9, 2012, 5:44pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/3 "2012-03-09T17:44:28Z")
> The example that I found yesterday was a607:f8b0::/32 (I get an error message from bro, "unknown identifier a607"). If I write it > as a607:f8b0::0:0:0:0:0/32, then I still get the same > error message. Writing it without a double colon > a607:f8b0:0:0:0:0:0:0/32 seems to work. > > If the first digit is in the range 0-9 (and not in > the range a-f), then bro does not complain (such > as 2607:f8b0::/32). Right, the current rule in scan.l for compressed hex notation looks for the first nibble to be a digit and not a letter. That's fixable, but as I was testing more potential address formats I ran into the ambiguity I mentioned before which doesn't look like it's so easy to work around. +Jon ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [March 11, 2012, 12:39am UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/4 "2012-03-11T00:39:46Z")
> Right, the current rule in scan.l for compressed hex notation looks for > the first nibble to be a digit and not a letter. That's fixable ... I don't recall the genesis of this rule (which I probably added a long time ago), but it could be that starting with a digit is intentional, because otherwise examples like the one given earlier of aaaa::bbbb are fully ambiguous. With the rule, you can write 0aaaa::bbbb and it will (should!) parse correctly. Maybe that's too ugly. I'm not sure there's a better fix, however.     Vern ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [March 11, 2012, 2:02am UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/5 "2012-03-11T02:02:26Z")
Could we just disallow module names that could be interpreted as addresses?   .Seth ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [March 11, 2012, 5:05am UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/6 "2012-03-11T05:05:22Z")
> Could we just disallow module names that could be interpreted as addresses? Yeee-uck! "Identifiers begin with a letter followed by zero or more digits or letters. However, they must include at least one letter in the range g-z."     Vern ---
**Author:** ![leres](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/leres/32/607_2.png) [@leres](https://community.zeek.org/u/leres)\ **Post date:** [March 11, 2012, 10:52pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/7 "2012-03-11T22:52:21Z")
How about enclosing IPv6 literals in brackets, e.g. [aaaa::bbbb]? As with URLs this would also allow IPv6 addresses with ports, e.g. [2620:83:8000:102::c9]:22.     Craig ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 12, 2012, 4:00pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/8 "2012-03-12T16:00:57Z")
I think the right fix would be not having the lexer make the decision, but do it later when we can say whether there's an identifier with that name. But that's not easy to do. ☹ Robin ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 12, 2012, 4:01pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/9 "2012-03-12T16:01:34Z")
I like that, that's a well defined standard syntax. Robin ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [March 12, 2012, 4:09pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/10 "2012-03-12T16:09:29Z")
I like it too, but won't it be yet another problem for differentiating between record definition, tuple definition, and now IPv6 definition?   .Seth ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [March 12, 2012, 5:31pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/11 "2012-03-12T17:31:46Z")
Me too. ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [March 12, 2012, 6:37pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/12 "2012-03-12T18:37:26Z")
That's a bad idea as well. if you have a typo in your identifier, bro won't complain anymore and assume it's an IPv6 literal. cu gregor ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [March 12, 2012, 6:38pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/13 "2012-03-12T18:38:55Z")
+1 ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 13, 2012, 4:30am UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/14 "2012-03-13T04:30:41Z")
That is a good point. I'm not fully sure but I believe it should be less of a problem than with the current syntax. Most of the other usages have some characters in there that aren't valid inside an address (or the other way round: the address' ':' and '::' aren't valid in them). But the trick is to define the lexer so that it picks the addresses but leaves the other ones alones ... Robin ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [March 13, 2012, 5:09pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/15 "2012-03-13T17:09:43Z")
> That is a good point. I'm not fully sure but I believe it should be > less of a problem than with the current syntax. Most of the other > usages have some characters in there that aren't valid inside an > address (or the other way round: the address' ':' and '::' aren't > valid in them). But the trick is to define the lexer so that it picks > the addresses but leaves the other ones alones ... Yeah, I think the patterns for bracketed IPv6 literals are going to be specific enough to not be ambiguous with the other uses of brackets. Sounds like enough people like that syntax so I I'll add it, but what to do with the old syntax for IPv6 literals? Should it be removed at this time, deprecated until 2.2, or kept indefinitely? +Jon ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [March 13, 2012, 5:23pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/16 "2012-03-13T17:23:03Z")
I vote for just removing. Now is the one time where we can break IPv6 stuff to make it better. Robin ---
**Author:** ![Gregor\_Maier2](https://avatars.discourse-cdn.com/v4/letter/g/b38774/32.png) [@Gregor\_Maier2](https://community.zeek.org/u/Gregor_Maier2)\ **Post date:** [March 14, 2012, 8:27pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/17 "2012-03-14T20:27:21Z")
ACK. let's break it now! ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/ipv6-literal-addr-constants/2260/18 "2022-05-06T15:40:15Z")