[Bro] three things

[Christian Kreibich]

On Wed, 2007-01-31 at 13:57 -0800, Christian Kreibich wrote:
> > 2)
> > While looking at (1) I found that all patterns fail with bro-1.2.1 on 
> > Fedora Core 5:
> > 
> > line 54: run-time error: error compiling pattern /^?.*(.*NCSA.*)/
> > 
> > It happens with patterns I write or any patterns in the provided .bro 
> > files.  bro-1.1d works just fine on FC5 and bro-1.2.1 works fine on RHEL4
> 
> Thanks for this. We've received another report of this problem, but it
> had us scratching our heads. It's great to know more precisely now where
> it occurs. We'll look into it.

A quick update on this: we can confirm the issue. It seems that for some
reason the generated parser code shipped with 1.2.1 breaks on at least
FC5. We're unsure as to why this is, but it is likely related to the
fact that the bison that was used to create the parser is quite old. For
the time being, the fix is to remove the generated parser files and use
a local bison installation to regenerate them.

To do so, remove the following files in src/ before doing a make (this
removes all generated parser files, not just the regex-related ones):

  $ cd src/
  $ rm bif_parse.{cc,h} parse.cc re-parse.{cc,h} rule-parse.{cc,h}

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org