[Bro-Dev] #26: case insensitive regular expressions
Bro Tracker
bro-dev at bro-ids.org
Mon Nov 15 21:42:35 PST 2010
#26: case insensitive regular expressions
------------------------------+---------------------------------------------
Reporter: vern | Owner:
Type: Feature Request | Status: seen
Priority: Normal | Milestone:
Component: Bro | Version:
Resolution: | Keywords:
------------------------------+---------------------------------------------
Comment (by seth):
The existing partial implementation of this is available in the topic/seth
/case-insensitive-patterns branch in the git repository. Case
insensitivity is enabled with an "i" flag at the end of the pattern. For
example:
{{{
global my_pattern = /abcdef/i;
}}}
would match "ABCDEF". The problem with it comes when you do a disjunction
between patterns in your Bro script. Pattern disjunctions in Bro are
currently done by extracting the text of the pattern and OR-ing them
together as text then recreating the DFAs and NFAs but my current
implementation of case insensitive patterns does the case insensitivity
during construction of the NFAs. Apparently the disjunction can't
properly be done with the NFAs alone because of issues with anchored
patterns. (something Vern said, but I may have misunderstood it)
--
Ticket URL: <http://tracker.icir.org/bro/ticket/26#comment:3>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list