[Bro-Dev] [JIRA] (BIT-1497) pattern [:space:] shortcut not matching as expected

Robin Sommer (JIRA) jira at bro-tracker.atlassian.net
Thu Oct 22 14:15:00 PDT 2015


    [ https://bro-tracker.atlassian.net/browse/BIT-1497?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22646#comment-22646 ] 

Robin Sommer commented on BIT-1497:
-----------------------------------

Ah, I see the problem: you need to write it like this: {noformat} /[[:space:]]/ {noformat} (i.e., double brackets). These work only inside a character class (which I believe is standard behavior).

> pattern [:space:] shortcut not matching as expected
> ---------------------------------------------------
>
>                 Key: BIT-1497
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1497
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: 2.4
>         Environment: Running tests using Bro 2.4.1 (precompiled from http://download.opensuse.org/repositories/network:/bro/xUbuntu_14.10/) on Ubuntu 14.10.
> Running using a simple "/opt/bro/bin/bro myscript.bro" syntax.
>            Reporter: Lloyd Brown
>              Labels: pattern
>         Attachments: patterns.space_shortcut.testcase.bro, patterns.space_shortcut.testcase.bro.output
>
>
> I'm trying to do some RegEx-like pattern matching of a data stream using Bro, and I'm finding that, at least some of the shortcuts, like '[:space:]' don't seem to act as expected.
> In short, I expected that '[:space:]' and '[ \f\n\r\t\v]' would be interchangeable, but that doesn't seem to be the case.  I have not tested any other shortcuts like '[:alpha:]', '[:digit:]', etc.  Just '[:space:]' so far.
> I will attach an example script, as well as a file containing the output I'm seeing.



--
This message was sent by Atlassian JIRA
(v7.0.0-OD-08-002#70107)


More information about the bro-dev mailing list