You annoy me... :)<br><br>Regards,<br><br>Will<br><br><div class="gmail_quote">On Wed, Jul 11, 2012 at 4:34 PM, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">8.31 is also out already :)<br>
<div class="im"><br>
On 07/11/2012 11:22 PM, Will Metcalf wrote:<br>
> Ancient pcre version?<br>
> /pcretest -C<br>
> PCRE version 8.30 2012-02-04<br>
> Compiled with<br>
> 8-bit support only<br>
> UTF-8 support<br>
> Unicode properties support<br>
> Just-in-time compiler support: x86 64bit (little endian + unaligned)<br>
> Newline sequence is LF<br>
> \R matches all Unicode newlines<br>
> Internal link size = 2<br>
> POSIX malloc threshold = 10<br>
> Default match limit = 10000000<br>
> Default recursion depth limit = 10000000<br>
> Match recursion uses stack<br>
><br>
><br>
> On Wed, Jul 11, 2012 at 1:49 PM, Brandon Ganem<br>
</div><div><div class="h5">> <<a href="mailto:brandonganem%2Boisf@gmail.com">brandonganem+oisf@gmail.com</a> <mailto:<a href="mailto:brandonganem%2Boisf@gmail.com">brandonganem+oisf@gmail.com</a>>> wrote:<br>
><br>
> Kay,<br>
> I've got a bunch of signatures doing this. For example:<br>
> [18575] 11/7/2012 -- 13:22:40 - (detect-pcre.c:949) <Error><br>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - pcre study<br>
> failed : unknown or incorrect option bit(s) set<br>
> [18575] 11/7/2012 -- 13:22:40 - (detect.c:547) <Error><br>
> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] -<br>
> error parsing signature "alert http $EXTERNAL_NET any -> $HOME_NET<br>
> any (msg:"ET WEB_CLIENT Microsoft Internet Explorer SameID<br>
> Use-After-Free "; flow:established,from_server; content:"<DIV id=";<br>
> nocase; content:"<img id="; nocase; distance:0;<br>
> content:".innerHTML"; distance:0;<br>
> pcre:"/<DIV\s*?id[\s\r\n]*?\x3d[\s\r\n]*?(?P<divid>[^>]+).+?<img\s*id=\s*?\x22(?P<imgid>[^\x22]+).+?\<a\s*?href=\x22javascript\x3a(?P<firstfunction>[^\x28]+)\(\).+?\>.*?\<div[^\>]+?id=\x22(?P=imgid)\x22[^>]+?on[A-Za-z]+?\s*?=\s*?\x22(?P<secondfunction>[^\x28]+)\(\)\x3b\s*?\x22.+?function[\s\r\n]*?(?P=firstfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?(?P=divid)\x2einnerHTML\s*?\x3d\s*?(?P=divid)\x2einnerHTML[\s\r\n]*?\x3b.*?\x7d.*?function[\s\r\n]*?(?P=secondfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?\x28\x22(?P=imgid)\x22\x29\x2esrc\s*?\x3d/si";<br>
> reference:cve,CVE-2012-1875; classtype:attempted-user; sid:2014911;<br>
> rev:10;)" from file /etc/suricata/rules/etpro/web_client.rules at<br>
> line 1916<br>
> <a href="http://doc.emergingthreats.net/bin/view/Main/2014911" target="_blank">http://doc.emergingthreats.net/bin/view/Main/2014911</a><br>
><br>
> It doesn't seem to be related to the pcre options. I created a sig<br>
> without any options:<br>
> alert tcp any any -> any any (msg:"test .jar sig"; content:".jar";<br>
> nocase; http_uri; pcre: "/\d{5}\.jar/"; classtype:trojan-activity;<br>
> sid:2055555555555500349; rev:1;)<br>
><br>
> regardless of the pcre options it blows up. However if I get ride of<br>
> the pcre statement it works fine.<br>
><br>
> Thanks!<br>
><br>
> On Wed, Jul 11, 2012 at 2:33 PM, kay <<a href="mailto:kay.diam@gmail.com">kay.diam@gmail.com</a><br>
</div></div><div class="im">> <mailto:<a href="mailto:kay.diam@gmail.com">kay.diam@gmail.com</a>>> wrote:<br>
><br>
> Thanks for info, now I know more about it. But it is a custom<br>
> suricata<br>
> modifier. I would suggest the author to try start suricata without<br>
> this modifier.<br>
><br>
> 2012/7/11 Chris Wakelin <<a href="mailto:c.d.wakelin@reading.ac.uk">c.d.wakelin@reading.ac.uk</a><br>
</div>> <mailto:<a href="mailto:c.d.wakelin@reading.ac.uk">c.d.wakelin@reading.ac.uk</a>>>:<br>
<div class="im">> > On 11/07/2012 19:06, kay wrote:<br>
> >> I have noticed /H modifier. I've never heard about such modifier.<br>
> >><br>
> >> "/Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H"<br>
> ><br>
> > From<br>
> ><br>
> <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords</a><br>
> > :-<br>
> >> H Makes pcre match on the HTTP-header. H can be<br>
> combined with /R. Note that R is relative to the<br>
> >> previous match so both matches have to be in the<br>
> HTTP-header body.<br>
> ><br>
> > plus several others!<br>
> ><br>
> > Best Wishes,<br>
> > Chris<br>
> ><br>
> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
</div>> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>><br>
<div class="im">> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
</div>> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>><br>
<div class="im HOEnZb">> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
><br>
<br>
<br>
</div><div class="im HOEnZb">--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
<br>
<br>
</div><div class="HOEnZb"><div class="h5">_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br>