0

While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all throughly yet).

Two examples with the parts in question highlighted.

From sid:17166  
pcre:"/(?P<var>\w+)\x2Ereplace\x28\s*(?P=var)\s*\x2C\s*(?P=var)\s*\x29/";
:      ^^^^^^^^^^^^                  ^^^^^^^^

From sid:29503  
pcre:"/removeChild\((?<element>\w{1,20})\).*(?P=element)\.getCharNumAtPosition/smi";
:                   ^^^^^^^^^^^^^^^^^^^^    ^^^^^^^^^^^^

It looks like the "? " part is connected with the latter use of the name as "?P=name". But, it is not consistent (as seen in the two cases above).

References.
sid:17166; reference:bugtraq,36343; reference:cve,2009-3075;
sid:29503; reference:bugtraq,49213; reference:cve,2011-0084; reference:url,osvdb.org/show/osvdb/74581;

2 Answers 2

2

(?P<var>\w+)

How to read this expression:

'('        = Open matching group.
'?P<var>'  = call this matching group "var"
'\w+'      = one or more alphanumeric/underscore characters
')'        = close matching group.

Next part is simply asking for the named backreference:

(?P=var)

For the next piece of syntax:

(?<element>\w{1,20})

'('          = open matching group.
'?<element>' = Name this matching group "element"
'\w{1,20}'   = match any alphanumeric or underscore a minimum of once, and a maximum of 20 times.
')'          = close matching group
5
  • Thanks for the expansion. I am still trying to understand the difference between the two syntax examples. Particularly, the missing 'P' in the second case for back-reference. I'd love to see a SNORT reference describing it like the regex reference @Anorov gave does.
    – nik
    Jun 9, 2014 at 15:25
  • 1
    @Anorov's link provides the history. Python gave us the syntax (?P<name>group) first, and then later C# gave us (?<name>group). Perl adopted both syntaxes in version 5.10. Generally, as far as "standards" go, if a product is "PCRE" compliant, it usually means it works in Perl 5.10. (Which isn't really a standard...)
    – avgvstvs
    Jun 9, 2014 at 17:01
  • 2
    @nik It's just an inconsistency in how different languages decided to design their regex syntax. They're equivalent; you just have to remember which languages support which, and which support both.
    – Anorov
    Jun 10, 2014 at 1:09
  • Thanks for your updates @Anorov and avgvstvs. The language of interest to me at this time is the one SNORT accepts. And I see rules using both forms. Will assimilate these details further. For I accept this answer.
    – nik
    Jun 10, 2014 at 5:20
  • Did a little bit of digging. seclists.org/focus-ids/2006/Jan/95 <--Says that snort uses the PCRE lib --> pcre.org
    – avgvstvs
    Jun 10, 2014 at 12:18
1

To my knowledge, Snort follows the general PCRE standard. You can read more details here: http://www.regular-expressions.info/named.html

1
  • Thanks for throwing the reference at me :-). I have no good reason for having missed to look up there.
    – nik
    Jun 9, 2014 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .