
    <i                     d    S r SSKrSSKJr  \" 5       r\" 5       r\" 5       rS rS r	S r
S rS rg)	z<
Some simple comparison expression normalization functions.
    N)object_path_to_raw_valuesc                 h   [        U 5      n[        U5      n[        U5      nSn [        US5      n[        US5      nUc  Uc   U$ Ub  Uc  Sn U$ U[        L a!  [	        U[
        5      (       d  US:w  a  Sn U$ O7U[        L a  [	        U[        5      (       d  Sn U$ OU[        La
  Xv:w  a  Sn U$ M  )a  
Compare an object path against a pattern.  This enables simple path
recognition based on a pattern, which is slightly more flexible than exact
equality: it supports some simple wildcards.

The path pattern must be an iterable of values: strings for key path steps,
ints or "*" for index path steps, or wildcards.  Exact matches are required
for non-wildcards in the pattern.  For the wildcards, _ANY_IDX matches any
index path step; _ANY_KEY matches any key path step, and _ANY matches any
path step.

Args:
    object_path: An ObjectPath instance
    path_pattern: An iterable giving the pattern path steps

Returns:
    True if the path matches the pattern; False if not
TNF*)	r   iternext_ANY_IDX
isinstanceint_ANY_KEYstr_ANY)object_pathpath_patternpath_values	path_iter	patt_iterresultpath_valpatt_vals           f/home/james-whalen/.local/lib/python3.13/site-packages/stix2/equivalence/pattern/transform/specials.py_path_isr      s    & ,K8K[!I\"IF
	4(	4( 0* M' !1F  M !h,,S M !h,, M - T!h&:FM7     c                     [        U 5      nSU-  nSUs=::  a  U::  d   e   eUS-  nX1-
  S-  nUS:  a
  SU-  XU-
  S& XE-   U:w  a   US-  nSU-  S-
  SU-
  -  nX==   U-  ss'   gg)z
Retain the high-order 'prefix_size' bits from ip_bytes, and zero out the
remaining low-order bits.  This side-effects ip_bytes.

Args:
    ip_bytes: A mutable byte sequence (e.g. a bytearray)
    prefix_size: An integer prefix size
   r       N   )len)ip_bytesprefix_sizeaddr_size_bytesaddr_size_bitsnum_fixed_bytesnum_zero_bytes
num_1_bitsmasks           r   _mask_bytesr&   G   s     (mO(N-~-----!Q&O$2q8N6=6N>123'?: !1_
jA%1z>:!T)! ;r   c                     [        U R                  S5      (       d"  [        U R                  S[        S45      (       a4  U R                  R                  R                  5       U R                  l        gg)a*  
Lower-cases the rhs, depending on the windows-registry-key property
being compared.  This enables case-insensitive comparisons between two
patterns, for those values.  This side-effects the given AST.

Args:
    comp_expr: A _ComparisonExpression object whose type is
        windows-registry-key
)keyvaluesnameN)r   lhsr   rhsvaluelower)	comp_exprs    r   windows_reg_keyr0   d   sR     	x((	(F'CDD'mm11779	 Er   c                 L   [        U R                  S5      (       a  U R                  R                  nUR	                  S5      nUS:  nU(       a  USU nOUn [
        R                  " U5      nU(       a   [        XS-   S 5      nUS:  d  US:  a  gU(       a  WS:X  a  [
        R                  " U5      nO=[        U5      n[        XV5        [
        R                  " U5      nUS-   [        U5      -   nXR                  l        gg! [         a     gf = f! [         a     gf = f)aJ  
Canonicalizes a CIDR IPv4 address by zeroing out low-order bits, according
to the prefix size.  This affects the rhs when the "value" property of an
ipv4-addr is being compared.  If the prefix size is 32, the size suffix is
simply dropped since it's redundant.  If the value is not a valid CIDR
address, then no change is made.  This also runs the address through the
platform's IPv4 address processing functions (inet_aton() and inet_ntoa()),
which can adjust the format.

This side-effects the given AST.

Args:
    comp_expr: A _ComparisonExpression object whose type is ipv4-addr.
r-   /r   Nr       )r   r+   r,   r-   findsocket	inet_atonOSErrorr
   
ValueError	inet_ntoa	bytearrayr&   r   r/   r-   	slash_idxis_cidrip_strr   r   s          r   	ipv4_addrr@   s   s    	z**##JJsO	q.:I&FF	''/H
 !%!"56
 Q+"2++
 $$X.E
 !*H.%%h/FSL3{#33E#W +  		  s$   D 6D 
DD
D#"D#c                    [        U R                  S5      (       Ga  U R                  R                  nUR	                  S5      nUS:  nU(       a  USU nOUn [
        R                  " [
        R                  U5      nU(       a   [        XS-   S 5      nUS:  d  US:  a  gU(       a  WS:X  a&  [
        R                  " [
        R                  U5      nOL[        U5      n[        XV5        [
        R                  " [
        R                  U5      nUS-   [        U5      -   nXR                  l        gg! [         a     gf = f! [         a     gf = f)aK  
Canonicalizes a CIDR IPv6 address by zeroing out low-order bits, according
to the prefix size.  This affects the rhs when the "value" property of an
ipv6-addr is being compared.  If the prefix size is 128, the size suffix is
simply dropped since it's redundant.  If the value is not a valid CIDR
address, then no change is made.  This also runs the address through the
platform's IPv6 address processing functions (inet_pton() and inet_ntop()),
which can adjust the format.

This side-effects the given AST.

Args:
    comp_expr: A _ComparisonExpression object whose type is ipv6-addr.
r2   r3   r   Nr      )r   r+   r,   r-   r5   r6   	inet_ptonAF_INET6r8   r
   r9   	inet_ntopr;   r&   r   r<   s          r   	ipv6_addrrF      s/    	z**##JJsO	q.:I&FF	''@H
 !%!"56
 Q+"3+,
 $$V__h?E
 !*H.%%foox@FSL3{#33E#W +  		  s$   %D4 E 4
E E
EE)__doc__r6   ,stix2.equivalence.pattern.compare.comparisonr   objectr   r   r   r   r&   r0   r@   rF    r   r   <module>rK      sF    
 88x4n*:::$z:$r   