Some context: <div><div>root@xxx:/opt/pcre-8.31# ldd /usr/local/bin/suricata</div><div> linux-vdso.so.1 => (0x00007fffb01d6000)</div><div> libhtp-0.2.so.1 => /usr/local/lib/libhtp-0.2.so.1 (0x00007fc935eb9000)</div>
<div> libmagic.so.1 => /usr/lib/libmagic.so.1 (0x00007fc935c9c000)</div><div> libcap-ng.so.0 => /usr/lib/libcap-ng.so.0 (0x00007fc935a96000)</div><div> libpcap.so.0.8 => /usr/lib/libpcap.so.0.8 (0x00007fc93585f000)</div>
<div> libpfring.so => /usr/local/lib/libpfring.so (0x00007fc935641000)</div><div> libnet.so.1 => /usr/lib/libnet.so.1 (0x00007fc935427000)</div><div> libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007fc935209000)</div>
<div> libyaml-0.so.2 => /usr/lib/libyaml-0.so.2 (0x00007fc934fe9000)</div><div> libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fc934dac000)</div><div> libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fc934a17000)</div>
<div> libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007fc9347ff000)</div><div> /lib64/ld-linux-x86-64.so.2 (0x00007fc9360d9000)</div><br><div class="gmail_quote">On Thu, Jul 12, 2012 at 2:37 PM, Brandon Ganem <span dir="ltr"><<a href="mailto:brandonganem+oisf@gmail.com" target="_blank">brandonganem+oisf@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Victor, it looks like your right. I have multiple libpcre.so files in my ldconfig.<div><br></div><div>I guess i'm just not sure how to fix the problem. I tried apt-get remove libpcre3-devel but it doesn't seem to make a difference.</div>
<div><br></div><div>Thanks!<br><br><div class="gmail_quote"><div class="im">On Wed, Jul 11, 2012 at 5:34 PM, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br>
</div><div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>On 07/11/2012 07:56 PM, Brandon Ganem wrote:<br>
> Hi all,<br>
> I'm trying to use signatures with PCRE in them. Looking at my<br>
> suricata.log file I see many entries with the following:<br>
><br>
><br>
> [18575] 11/7/2012 -- 13:22:40 - (detect-pcre.c:949) <Error><br>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - pcre study failed<br>
> : unknown or incorrect option bit(s) set<br>
> [18575] 11/7/2012 -- 13:22:40 - (detect.c:547) <Error><br>
> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error<br>
> parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS<br>
> (msg:"ET WORM AirOS .css Worm Outbound Propagation Sweep";<br>
> flow:established,to_server; content:"/admin.cgi/.gif"; http_uri;<br>
> pcre:"/Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H";<br>
> reference:url,<a href="http://seclists.org/fulldisclosure/2011/Dec/419" target="_blank">seclists.org/fulldisclosure/2011/Dec/419</a><br>
</div>> <<a href="http://seclists.org/fulldisclosure/2011/Dec/419" target="_blank">http://seclists.org/fulldisclosure/2011/Dec/419</a>>;<br>
> reference:url,<a href="http://www.root.cz/clanky/virus-v-bezdratovych-routerech-skynet/" target="_blank">www.root.cz/clanky/virus-v-bezdratovych-routerech-skynet/</a><br>
> <<a href="http://www.root.cz/clanky/virus-v-bezdratovych-routerech-skynet/" target="_blank">http://www.root.cz/clanky/virus-v-bezdratovych-routerech-skynet/</a>>;<br>
<div>> classtype:trojan-activity; sid:2014041; rev:5;)" from file<br>
> /etc/suricata/rules/worm.rules at line 152<br>
><br>
> I've installed pcre with jit enabled as<br>
> per: <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PCRE-JIT" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PCRE-JIT</a><br>
> I<br>
> also referenced: <a href="http://blog.inliniac.net/2011/10/12/suricata-and-pcre-performance/" target="_blank">http://blog.inliniac.net/2011/10/12/suricata-and-pcre-performance/</a><br>
><br>
> Note, As far as I can tell this happens on every sig with PCRE in it.<br>
> Hard to tell. Am I just doing something wrong?<br>
> I'm on the latest GIT, along with pcre 8.31 (I was on 8.20 RC1 as per<br>
> the guide, but I upgraded in an attempt to fix this)<br>
<br>
</div>Seen this error before. It turned out I used headers from 8.31, but<br>
linked against the distro libpcre.<br>
<br>
I'm pretty sure you have either a typo in your --with-libpcre-* or you<br>
have multiple libpcre.so's of different versions in your ld path.<br>
<span><font color="#888888"><br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
</font></span><div><div><br>
<br>
<br>
_______________________________________________<br>
Oisf-users mailing list<br>
<a href="mailto:Oisf-users@openinfosecfoundation.org" target="_blank">Oisf-users@openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
</div></div></blockquote></div></div></div><br></div>
</blockquote></div><br></div>