Ancient pcre version?<br>/pcretest -C<br>PCRE version 8.30 2012-02-04<br>Compiled with<br> 8-bit support only<br> UTF-8 support<br> Unicode properties support<br> Just-in-time compiler support: x86 64bit (little endian + unaligned)<br>
Newline sequence is LF<br> \R matches all Unicode newlines<br> Internal link size = 2<br> POSIX malloc threshold = 10<br> Default match limit = 10000000<br> Default recursion depth limit = 10000000<br> Match recursion uses stack<br>
<br><br><div class="gmail_quote">On Wed, Jul 11, 2012 at 1:49 PM, Brandon Ganem <span dir="ltr"><<a href="mailto:brandonganem+oisf@gmail.com" target="_blank">brandonganem+oisf@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Kay,<div>I've got a bunch of signatures doing this. For example:</div><div><div class="im"><div>[18575] 11/7/2012 -- 13:22:40 - (detect-pcre.c:949) <Error> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - pcre study failed : unknown or incorrect option bit(s) set</div>
</div><div>[18575] 11/7/2012 -- 13:22:40 - (detect.c:547) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Internet Explorer SameID Use-After-Free "; flow:established,from_server; content:"<DIV id="; nocase; content:"<img id="; nocase; distance:0; content:".innerHTML"; distance:0; pcre:"/<DIV\s*?id[\s\r\n]*?\x3d[\s\r\n]*?(?P<divid>[^>]+).+?<img\s*id=\s*?\x22(?P<imgid>[^\x22]+).+?\<a\s*?href=\x22javascript\x3a(?P<firstfunction>[^\x28]+)\(\).+?\>.*?\<div[^\>]+?id=\x22(?P=imgid)\x22[^>]+?on[A-Za-z]+?\s*?=\s*?\x22(?P<secondfunction>[^\x28]+)\(\)\x3b\s*?\x22.+?function[\s\r\n]*?(?P=firstfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?(?P=divid)\x2einnerHTML\s*?\x3d\s*?(?P=divid)\x2einnerHTML[\s\r\n]*?\x3b.*?\x7d.*?function[\s\r\n]*?(?P=secondfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?\x28\x22(?P=imgid)\x22\x29\x2esrc\s*?\x3d/si"; reference:cve,CVE-2012-1875; classtype:attempted-user; sid:2014911; rev:10;)" from file /etc/suricata/rules/etpro/web_client.rules at line 1916</div>
<div><a href="http://doc.emergingthreats.net/bin/view/Main/2014911" target="_blank">http://doc.emergingthreats.net/bin/view/Main/2014911</a>
</div><div><br></div><div>It doesn't seem to be related to the pcre options. I created a sig without any options:</div><div>alert tcp any any -> any any (msg:"test .jar sig"; content:".jar"; nocase; http_uri; pcre: "/\d{5}\.jar/"; classtype:trojan-activity; sid:2055555555555500349; rev:1;)</div>
<div><br></div><div>regardless of the pcre options it blows up. However if I get ride of the pcre statement it works fine.</div><div><br></div><div>Thanks!</div><div><div class="h5"><br><div class="gmail_quote">On Wed, Jul 11, 2012 at 2:33 PM, kay <span dir="ltr"><<a href="mailto:kay.diam@gmail.com" target="_blank">kay.diam@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks for info, now I know more about it. But it is a custom suricata<br>
modifier. I would suggest the author to try start suricata without<br>
this modifier.<br>
<br>
2012/7/11 Chris Wakelin <<a href="mailto:c.d.wakelin@reading.ac.uk" target="_blank">c.d.wakelin@reading.ac.uk</a>>:<br>
<div>> On 11/07/2012 19:06, kay wrote:<br>
>> I have noticed /H modifier. I've never heard about such modifier.<br>
>><br>
>> "/Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H"<br>
><br>
> From<br>
> <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTTP-keywords</a><br>
> :-<br>
>> H Makes pcre match on the HTTP-header. H can be combined with /R. Note that R is relative to the<br>
>> previous match so both matches have to be in the HTTP-header body.<br>
><br>
> plus several others!<br>
><br>
> Best Wishes,<br>
> Chris<br>
><br>
</div><div><div>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div><br></div></div></div>
<br>_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br></blockquote></div><br>