[Oisf-devel] http_raw_uri and relative offset request

[eileen donlon]

Hi,

Sorry, it still doesn't work. The error doesn't occur regardless of the
nocase/http_raw_uri order if there is no pcre. My apologies.

Thanks,
Eileen

On Fri, Jan 13, 2012 at 5:46 PM, rmkml <rmkml at yahoo.fr> wrote:

> Thx you eileen,
> can you send a modified sig work please?
> Regards
> Rmkml
>
>
>
> On Fri, 13 Jan 2012, eileen donlon wrote:
>
>  Hi,
>>
>> Confirmed. Can you please put in a ticket?
>>
>> As a workaround, it seems to load ok if you put the http_raw_uri before
>> the nocase.
>>
>> Thanks,
>> Eileen
>>
>> On Fri, Jan 13, 2012 at 5:15 PM, rmkml <rmkml at yahoo.fr> wrote:
>>      Hi,
>>      Im test suricata v1.2rc1 and I have a request please (if anyone
>> confirm of course)
>>      ok, create a sig with `content:"/test"; nocase; http_raw_uri;
>> pcre:"/^abc/Rsmi";`
>>
>>      suricata send error:
>>      [13087] 13/1/2012 -- 22:53:20 - (detect-pcre.c:1193) <Error>
>> (DetectPcreSetup) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - No preceding
>> content or uricontent or pcre option
>>
>>      but uri work with snort: GET /testabc HTTP/1.0...
>>      `http_raw_uri` are little bit special because permit relative
>> offset...
>>      (http_raw_uri are like content but pattern searching only on http
>> uri)
>>
>>      if Anyone confirm, Im create a new ticket...
>>      Regards
>>      Rmkml
>>      ______________________________**_________________
>>      Oisf-devel mailing list
>>      Oisf-devel@**openinfosecfoundation.org<Oisf-devel at openinfosecfoundation.org>
>>      http://lists.**openinfosecfoundation.org/**
>> mailman/listinfo/oisf-devel<http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel>
>>
>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20120113/cedfe325/attachment-0002.html>