From 87411594e2bffe4b349f2a7454b2a35dd6f881e5 Mon Sep 17 00:00:00 2001 From: William Metcalf Date: Sat, 2 Aug 2008 14:43:27 -0500 Subject: [PATCH] groups fixed for pcre < 7 --- src/detect-pcre.c | 2 +- src/detect.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/detect-pcre.c b/src/detect-pcre.c index 728390e554..33e9c77593 100644 --- a/src/detect-pcre.c +++ b/src/detect-pcre.c @@ -11,7 +11,7 @@ #include "detect-mpm.h" -#define PARSE_CAPTURE_REGEX "\\(\\?\\<([A-z0-9_]+)\\>" +#define PARSE_CAPTURE_REGEX "\\(\\?P\\<([A-z0-9_]+)\\>" #define PARSE_REGEX "(? any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; recursive; sid:1;)"); + sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; recursive; sid:1;)"); if (sig_list == NULL) { result = 0; goto end; @@ -967,7 +967,7 @@ int SigTest06 (void) { SigParsePrepare(); - sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; recursive; sid:1;)"); + sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; recursive; sid:1;)"); if (sig_list == NULL) { result = 0; goto end; @@ -1012,7 +1012,7 @@ int SigTest07 (void) { SigParsePrepare(); - sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; recursive; sid:1;)"); + sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/\\d\\.\\d\\r\\n/G\"; recursive; sid:1;)"); if (sig_list == NULL) { result = 0; goto end; @@ -1059,7 +1059,7 @@ int SigTest08 (void) { SigParsePrepare(); - sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)"); + sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)"); if (sig_list == NULL) { result = 0; goto end; @@ -1104,7 +1104,7 @@ int SigTest09 (void) { SigParsePrepare(); - sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)"); + sig_list = SigInit("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"GET \"; depth:4; pcre:\"/GET (?P.*) HTTP\\/1\\.0\\r\\n/G\"; sid:1;)"); if (sig_list == NULL) { result = 0; goto end;