[Bro-Dev] #26: case insensitive regular expressions

Bro Tracker bro-dev at bro-ids.org
Mon Nov 15 21:42:35 PST 2010


#26: case insensitive regular expressions
------------------------------+---------------------------------------------
  Reporter:  vern             |       Owner:      
      Type:  Feature Request  |      Status:  seen
  Priority:  Normal           |   Milestone:      
 Component:  Bro              |     Version:      
Resolution:                   |    Keywords:      
------------------------------+---------------------------------------------

Comment (by seth):

 The existing partial implementation of this is available in the topic/seth
 /case-insensitive-patterns branch in the git repository.  Case
 insensitivity is enabled with an "i" flag at the end of the pattern.  For
 example:

 {{{
 global my_pattern = /abcdef/i;
 }}}

 would match "ABCDEF".  The problem with it comes when you do a disjunction
 between patterns in your Bro script.  Pattern disjunctions in Bro are
 currently done by extracting the text of the pattern and OR-ing them
 together as text then recreating the DFAs and NFAs but my current
 implementation of case insensitive patterns does the case insensitivity
 during construction of the NFAs.  Apparently the disjunction can't
 properly be done with the NFAs alone because of issues with anchored
 patterns. (something Vern said, but I may have misunderstood it)

-- 
Ticket URL: <http://tracker.icir.org/bro/ticket/26#comment:3>
Bro Tracker <http://tracker.icir.org/bro>
Bro Issue Tracker




More information about the bro-dev mailing list