Project

General

Profile

Actions
Copy link

Bug #40

closed

pcre rule parsing issue

Added by Victor Julien over 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
0.8.1
Affected Versions:
Effort:
Difficulty:
Label:

Description

After small testing, I have a small question with this signature:
alert tcp any any > any any (msg:"test"; pcre:!"/MODE/m"; sid:987654321; rev:1;)
If I start suricata:
./suricata080beta -c suricata.yaml -r test.pcap --init-errors-fatal
...
[14876] 2/1/2010 - 18:52:58 - (detect.c:327) <Info> (SigLoadSignatures) -- Loading rule file: /home/test/snort/rules/chat2.rules
DetectPcreParse: unknown regex modifier '/'
[14876] 2/1/2010 -- 18:52:58 - (detect-parse.c:811) <Error> (SigInitReal)
-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(19)] - Signature init failed "alert tcp any any -> any any (msg:"test"; pcre:!"/MODE/m"; sid:987654321; rev:1;)

I have same pb with signature variant:
alert tcp any any -> any any (msg:"test"; pcre:!"/MODE/i"; sid:987654321; rev:1;)

Files

0001-supply-pcre_get_substring-with-the-proper-start-of-t.patch (1.28 KB) 0001-supply-pcre_get_substring-with-the-proper-start-of-t.patch Jason Ish, 02/12/2010 04:57 PM
Actions
Copy link

Also available in: Atom PDF