Re: /smi at the end of pcre statements

[Stephen Mullins <steve.mullins.work () gmail com>]

Thanks, that will come in handy, especially the Snort specific portion.

The "/smi" question is still stumping me and some of my colleagues.

On Mon, Mar 16, 2009 at 12:56 PM, Matt Olney <molney () sourcefire com> wrote:
> From some code I have stashed away for reference:
>
>      switch(*opts) {
>       case 'i':  compile_flags |= PCRE_CASELESS;            break;
>       case 's':  compile_flags |= PCRE_DOTALL;              break;
>       case 'm':  compile_flags |= PCRE_MULTILINE;           break;
>       case 'x':  compile_flags |= PCRE_EXTENDED;            break;
>
>           /*
>            * these are pcre specific... don't work with perl
>            */
>       case 'A':  compile_flags |= PCRE_ANCHORED;            break;
>       case 'E':  compile_flags |= PCRE_DOLLAR_ENDONLY;      break;
>       case 'G':  compile_flags |= PCRE_UNGREEDY;            break;
>
>           /*
>            * these are snort specific don't work with pcre or perl
>            */
>       case 'R':  pcre_data->options |= SNORT_PCRE_RELATIVE; break;
>       case 'U':  pcre_data->options |= SNORT_PCRE_HTTP_URI; break;
>       case 'B':  pcre_data->options |= SNORT_PCRE_RAWBYTES; break;
>       case 'P':  pcre_data->options |= SNORT_PCRE_HTTP_BODY;  break;
>       case 'O':  pcre_data->options |= SNORT_OVERRIDE_MATCH_LIMIT; break;
>       case 'H':  pcre_data->options |= SNORT_PCRE_HTTP_HEADER;  break;
>       case 'M':  pcre_data->options |= SNORT_PCRE_HTTP_METHOD;  break;
>       case 'C':  pcre_data->options |= SNORT_PCRE_HTTP_COOKIE;  break;
>
> On Mon, Mar 16, 2009 at 12:32 PM, Stephen Mullins
> <steve.mullins.work () gmail com> wrote:
> > All,
> >
> > What does the /smi portion of a pcre statement signify?
> >
> > Any information anyone can provide would be appreciated.
> >
> > Thanks,
> >
> > Steve Mullins
> >
> > ------------------------------------------------------------------------------
> > Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
> > powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
> > easily build your RIAs with Flex Builder, the Eclipse(TM)based development
> > software that enables intelligent coding and step-through debugging.
> > Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users

------------------------------------------------------------------------------
Apps built with the Adobe(R) Flex(R) framework and Flex Builder(TM) are
powering Web 2.0 with engaging, cross-platform capabilities. Quickly and
easily build your RIAs with Flex Builder, the Eclipse(TM)based development
software that enables intelligent coding and step-through debugging.
Download the free 60 day trial. http://p.sf.net/sfu/www-adobe-com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users