Suricata

You changed several spots but you left "SC_ERR_PCRE_GET_SUBSTRING" for SCLogError, is this intended?

I also saw the discussion at https://github.com/inliniac/suricata/pull/900 so is there any usecase where we have some sort of advantage when we still use pcre_get_substring?

Andreas Herz wrote:

You changed several spots but you left "SC_ERR_PCRE_GET_SUBSTRING" for SCLogError, is this intended?

I didn't really care about being that specific, but feel free to add one for copy as well (append to enum to keep existing values the contant)

I also saw the discussion at https://github.com/inliniac/suricata/pull/900 so is there any usecase where we have some sort of advantage when we still use pcre_get_substring?

Yeah if you need a new allocation of what the regex captures then _get_substring would be OK.

These files are left:

detect-base64-decode.c
detect-bytetest.c
detect-dce-opnum.c
detect-detection-filter.c
detect-fast-pattern.c
detect-filesize.c
detect-filestore.c
detect-flags.c
detect-flowint.c
detect-flowvar.c
detect-fragbits.c
detect-fragoffset.c
detect-icmp-id.c
detect-icmp-seq.c
detect-icode.c
detect-ipproto.c
detect-iprep.c
detect-isdataat.c
detect-itype.c
detect-mark.c
detect-modbus.c
detect-pcre.c
detect-pktvar.c
detect-reference.c
detect-rpc.c
detect-ssh-proto-version.c
detect-ssh-software-version.c
detect-ssl-state.c
detect-ssl-version.c
detect-stream_size.c
detect-tag.c
detect-target.c
detect-template2.c
detect-threshold.c
detect-tls.c
detect-tls-version.c
detect-urilen.c
util-host-info.c
util-threshold-config.c

Of these, threshold, tag, urilen, reference, isdataat, bytetest and flags are the most commonly used.