Bug #40: pcre rule parsing issue - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #40

closed

pcre rule parsing issue

Added by Victor Julien almost 15 years ago. Updated over 14 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

0.8.1

Affected Versions:

Effort:

Difficulty:

Label:

Description

After small testing, I have a small question with this signature:
alert tcp any any > any any (msg:"test"; pcre:!"/MODE/m"; sid:987654321; rev:1;)
If I start suricata:
./suricata080beta -c suricata.yaml -r test.pcap --init-errors-fatal
...
[14876] 2/1/2010 - 18:52:58 - (detect.c:327) <Info> (SigLoadSignatures) -- Loading rule file: /home/test/snort/rules/chat2.rules
DetectPcreParse: unknown regex modifier '/'
[14876] 2/1/2010 -- 18:52:58 - (detect-parse.c:811) <Error> (SigInitReal)
-- [ERRCODE: SC_ERR_INVALID_SIGNATURE(19)] - Signature init failed "alert tcp any any -> any any (msg:"test"; pcre:!"/MODE/m"; sid:987654321; rev:1;)

I have same pb with signature variant:
alert tcp any any -> any any (msg:"test"; pcre:!"/MODE/i"; sid:987654321; rev:1;)

Files

0001-supply-pcre_get_substring-with-the-proper-start-of-t.patch (1.28 KB) 0001-supply-pcre_get_substring-with-the-proper-start-of-t.patch

Jason Ish, 02/12/2010 04:57 PM