43 static void DetectTransformPcrexform(
49 static void DetectTransformPcrexformId(
const uint8_t **data, uint32_t *length,
void *context)
53 *data = (
const uint8_t *)pxd->
id_data;
62 "modify buffer via PCRE before inspection";
65 DetectTransformPcrexform;
68 DetectTransformPcrexformFree;
70 DetectTransformPcrexformSetup;
82 pcre2_match_context_free(pxd->
context);
83 pcre2_code_free(pxd->
regex);
110 pxd->
context = pcre2_match_context_create(NULL);
119 pxd->
regex = pcre2_compile((PCRE2_SPTR8)regexstr, PCRE2_ZERO_TERMINATED, 0, &en, &eo, NULL);
120 if (pxd->
regex == NULL) {
121 PCRE2_UCHAR buffer[256];
122 pcre2_get_error_message(en, buffer,
sizeof(buffer));
123 SCLogError(
"pcre2 compile of \"%s\" failed at "
125 regexstr, (
int)eo, buffer);
126 pcre2_match_context_free(pxd->
context);
133 if (pcre2_pattern_info(pxd->
regex, PCRE2_INFO_CAPTURECOUNT, &nb) < 0) {
134 SCLogError(
"pcrexform failed getting info about capturecount");
135 DetectTransformPcrexformFree(
de_ctx, pxd);
139 SCLogError(
"pcrexform needs exactly one substring capture, found %" PRIu32, nb);
140 DetectTransformPcrexformFree(
de_ctx, pxd);
146 DetectTransformPcrexformFree(
de_ctx, pxd);
153 DetectTransformPcrexformFree(
de_ctx, pxd);
159 static void DetectTransformPcrexform(
162 const char *input = (
const char *)buffer->
inspect;
166 pcre2_match_data *match = pcre2_match_data_create_from_pattern(pxd->
regex, NULL);
167 int ret = pcre2_match(pxd->
regex, (PCRE2_SPTR8)input, input_len, 0, 0, match, pxd->
context);
172 ret = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&
str, &caplen);
176 pcre2_substring_free((PCRE2_UCHAR8 *)
str);
179 pcre2_match_data_free(match);