void TGielda::Refresh_data_onet()
{
/* FIXME: jesli spolka, umarla ( jej cena to --- ) to nie zostanie
* to sparsowane poprawnie i pominieta zostanie kolejna spolka
* now blad - onet chyba teraz pokazuje cene w "[]", trzeba poprawic regexp
*/
char* bufor = NULL;
pcre* re;
const char* error = NULL;
int erroffset;
int index = 0;
int rc;
const int OVECCOUNT = 30;
int ovector[OVECCOUNT];
char* pozycja;
bufor = Download_file(curl, "http://gielda.onet.pl/indeksy-i-akcje,18633,100,0,notowania-gpw-start");
my_companies.clear();
my_companies.reserve(512);
do
{
re = pcre_compile("<div class=\"name2\"><a.*?>(.*?)<.*?raitings.*?>\\s*?\\[?([-0-9, ]+)\\]?\\s*?<.*?raitings.*?>\\s*?\\[?([-0-9,]+)\\]?\\s*?<",
PCRE_DOTALL, &error, &erroffset, NULL);
rc = pcre_exec(re, NULL, bufor + index, strlen(bufor + index), 0, 0, ovector,
OVECCOUNT);
if (rc == PCRE_ERROR_NOMATCH)
break;
if (rc < 0)
break;
if (rc == 0)
puts("za malo miejsca w buforze");
char* name;
char* price;
char* day_delta;
pcre_get_substring(bufor + index, ovector, rc, 1, (const char** )&name);
pcre_get_substring(bufor + index, ovector, rc, 2, (const char** )&price);
pcre_get_substring(bufor + index, ovector, rc, 3, (const char** )&day_delta);
if ((pozycja = strchr(day_delta, ',')))
*pozycja = '.';
if ((pozycja = strchr(price, ',')))
*pozycja = '.';
char* price_replaced = Replace_all(price, " ", "");
TSpolka spolka(name,
price_replaced ? price_replaced : price,
day_delta, "", "", "", "", "");
my_companies.push_back(spolka);
pcre_free_substring(name);
pcre_free_substring(price);
pcre_free_substring(day_delta);
index += ovector[1];
}
while (true);
my_last_update = time(NULL);
delete[] bufor;
}
static int DetectPayloadLenFieldParse(DetectPayloadLenFieldData *dt, const char * sig) {
char *args[3] = {NULL,NULL,NULL};
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
dt->offset = 0;
ret = pcre_exec(parse_regex, parse_regex_study, sig, strlen(sig), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 3) goto error;
const char *str_ptr;
pcre_get_substring(sig, ov, MAX_SUBSTRINGS, 1, &str_ptr);
if (strlen(str_ptr)) {
dt->offset = atoi(str_ptr);
}
pcre_get_substring(sig, ov, MAX_SUBSTRINGS, 2, &str_ptr);
if (strlen(str_ptr)) {
dt->len = atoi(str_ptr);
}
return 1;
error:
return -1;
}
void TGielda::Refresh_data()
{
char* bufor = NULL;
pcre* re;
const char* error = NULL;
int erroffset;
int index = 0;
int rc;
const int OVECCOUNT = 30;
int ovector[OVECCOUNT];
char* pozycja;
bufor = Download_file(curl, "http://www.parkiet.com/temat/63.html");
if (!bufor)
return;
my_companies.clear();
my_companies.reserve(512);
do
{
re = pcre_compile("<tr.*?<td class=\"nazwa\"><a.*?>(.*?)<.*?<td class=\"c\">(.*?)<.*?<td class=\"zmiana.*?>(.*?)<",
PCRE_DOTALL, &error, &erroffset, NULL);
rc = pcre_exec(re, NULL, bufor + index, strlen(bufor + index), 0, 0, ovector,
OVECCOUNT);
if (rc == PCRE_ERROR_NOMATCH)
break;
if (rc < 0)
break;
if (rc == 0)
puts("za malo miejsca w buforze");
char* name;
char* price;
char* day_delta;
pcre_get_substring(bufor + index, ovector, rc, 1, (const char** )&name);
pcre_get_substring(bufor + index, ovector, rc, 2, (const char** )&price);
pcre_get_substring(bufor + index, ovector, rc, 3, (const char** )&day_delta);
if ((pozycja = strchr(day_delta, ',')))
*pozycja = '.';
TSpolka spolka(name, price, day_delta, "", "", "", "", "");
my_companies.push_back(spolka);
pcre_free_substring(name);
pcre_free_substring(price);
pcre_free_substring(day_delta);
index += ovector[1];
}
while (true);
my_last_update = time(NULL);
delete[] bufor;
}
static char *
ccze_squid_cache_log_process (const char *str, int *offsets, int match)
{
char *date, *other;
pcre_get_substring (str, offsets, match, 1, (const char **)&date);
pcre_get_substring (str, offsets, match, 3, (const char **)&other);
ccze_addstr (CCZE_COLOR_DATE, date);
ccze_space();
free (date);
return other;
}
static int DetectPrioritySetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr)
{
const char *prio_str = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(regex, regex_study, rawstr, strlen(rawstr), 0, 0, ov, 30);
if (ret < 0) {
SCLogError(SC_ERR_PCRE_MATCH, "Invalid Priority in Signature "
"- %s", rawstr);
return -1;
}
ret = pcre_get_substring((char *)rawstr, ov, 30, 1, &prio_str);
if (ret < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
return -1;
}
/* if we have reached here, we have had a valid priority. Assign it */
s->prio = atoi(prio_str);
return 0;
}
// < 0 for error. >= 0 for len of extracted string
int extractHTTPClientHeaderVal(const u_int8_t *buf, u_int32_t size, int pcreidx, int substringnum, char *valuebuf, int valuelen) {
int result;
int ovector[9];
int ovecsize = 9;
const char *tmpstring;
// printf("Searching for pcre %d (%s)\n", pcreidx, http_pcre_strings[pcreidx]);
result = pcre_exec(http_pcre_structs[pcreidx].re, http_pcre_structs[pcreidx].pe,
(const char *)buf, size, 0, 0, ovector, ovecsize);
if(result < 0 || result == PCRE_ERROR_NOMATCH) {
// printf("pcre not found\n");
return(-1); // We need to find the URL or this isn't a valid request
}
if(valuebuf) {
result = pcre_get_substring((const char *)buf, ovector, result, substringnum, &tmpstring);
if(result < 0) {
// printf("unable to extract substring\n");
return(-2);
}
strncpy(valuebuf, tmpstring, valuelen);
valuebuf[valuelen-1] = '\0';
pcre_free_substring(tmpstring);
return(strlen(valuebuf));
}
return(0);
}
char *Regexp_Get_Substring_From_Buffer(pcre *regexp, char *buffer, int substring)
{
char *file;
int rc, ovector[30];
char *viewstate;
if (regexp == NULL)
return NULL;
if (buffer == NULL)
return NULL;
rc = pcre_exec(regexp, NULL, buffer, strlen(file), 0, 0, ovector, 30);
if (rc != -1)
{
rc = pcre_get_substring(buffer, ovector, 30, substring, (const char **)&viewstate);
if (rc != -1)
{
return viewstate;
}
else
printf("Get_Regexp_From_File: could not get substring.\n");
}
else
printf("Get_Regexp_From_File: regexp didnt match.\n");
return NULL;
}
std::string Pattern::group (int groupNumber)
{
const char * stringPtr;
int rc = pcre_get_substring (
_subject.substr (_offset[0]).c_str(),
_ovector,
_count,
groupNumber,
&stringPtr);
if (rc < 0) {
switch (rc) {
case PCRE_ERROR_NOSUBSTRING:
throw std::out_of_range ("Invalid group reference.");
case PCRE_ERROR_NOMEMORY:
throw match_error ("Memory exhausted.");
default:
throw match_error ("Failed to get named substring.");
}
}
std::string matchedStr (stringPtr);
pcre_free_substring (stringPtr);
return matchedStr;
}
static uint32_t nvmRegExpCoproTestPattern (uint16_t pattern_id, uint8_t *haystack, uint32_t haylen,
uint32_t start_offset, nvmRegExpCoproInternalData *redata) {
nvmRegExpCoproPattern *rcp;
int ovector[OVECTSIZE], m = 0, matchoffset = 0; //, matchlen = 0;
#ifdef COPRO_REGEXP_DEBUG
const char *tmp;
#endif
redata -> matched = 0;
/* Do the actual search */
if (pattern_id < redata -> patterns_no) {
rcp = &(redata -> patterns[pattern_id]);
redebug ("Looking for RegExp: \"%s\"\n", rcp -> pattern);
m = pcre_exec (rcp -> re, rcp -> re_extra, (char*) haystack + start_offset, haylen, 0, 0, ovector, OVECTSIZE);
if (m > 0) {
(redata -> match).rcp = rcp;
(redata -> match).offset = matchoffset = ovector[0];
(redata -> match).len = ovector[1] - ovector[0];
redata -> matched = 1;
#ifdef COPRO_REGEXP_DEBUG
pcre_get_substring (haystack + start_offset, ovector, m, 0, &tmp);
redebug ("RegExp match at offset %d, len = %d: \"%s\"\n", matchoffset, (redata -> match).len, tmp);
pcre_free_substring (tmp);
#endif
}
} else {
printf ("RegExp coprocessor: tried to use inexistent pattern: %u\n", pattern_id);
}
return (redata -> matched);
}
char *execute_regex(char *pattern, char *subject, int desired_match)
{
pcre *re;
const char *einfo;
int eoffset;
int stringcount = 0;
int ovector[desired_match * 3];
int match_len;
const char *match;
char *match_returned;
re = pcre_compile(pattern, 0, &einfo, &eoffset, NULL);
if (!re) {
fprintf(stderr, "%s\n", einfo);
return NULL;
}
stringcount = pcre_exec(re, NULL, subject, strlen(subject),
0, 0, ovector, 30);
match_len = pcre_get_substring(subject, ovector,
stringcount, desired_match, &match);
if (match_len <= 0) {
return NULL;
}
match_returned = (char *) malloc(match_len);
strncpy(match_returned, match, match_len);
pcre_free_substring(match);
return match_returned;
}
/** Funkcja pobiera pierwszy czlon adresu email - tytulowy adresat w tresci maila
@param email - adres email z którego pobrany zostanie człon adresu przed znakiem '@'
@param out_recipient - nazwa konta email pobrana z adresu - wartość zwracana przez funkcję
@retval 0 - ok
@retval -1 - bład wywołania funkcji pcre_compile
@retval -2 - bład wywołania funkcji pcre_exec
*/
long get_einvoice_recipient(char *email,char **out_recipient)
{
pcre *rc = NULL;
long re = 0;
const char *error = NULL;
int erroroffset = 0;
int ovector[6];
long len = 0;
memset(ovector,0,6);
rc=pcre_compile(EINVOICE_RECP_REGEXP,0,&error, &erroroffset,NULL);
if(rc==NULL)
{
PRINT_DEBUG("LIBBMDMAILERR Error. Error=%i\n",-1);
return -1;
}
re = pcre_exec(rc,NULL,email,(int)strlen(email),0,0,ovector,6);
if(re<0)
{
PRINT_DEBUG("LIBBMDMAILERR Error. Error=%i\n",-2);
return -2;
}
len=pcre_get_substring(email,ovector,re,1,(const char **)out_recipient);
pcre_free(rc);
rc=NULL;
return 0;
}
/**
* \brief This function is used to parse icmp_seq option passed via icmp_seq: keyword
*
* \param icmpseqstr Pointer to the user provided icmp_seq options
*
* \retval iseq pointer to DetectIcmpSeqData on success
* \retval NULL on failure
*/
DetectIcmpSeqData *DetectIcmpSeqParse (char *icmpseqstr) {
DetectIcmpSeqData *iseq = NULL;
char *substr[3] = {NULL, NULL, NULL};
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
int i;
const char *str_ptr;
ret = pcre_exec(parse_regex, parse_regex_study, icmpseqstr, strlen(icmpseqstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 1 || ret > 4) {
SCLogError(SC_ERR_PCRE_MATCH,"Parse error %s", icmpseqstr);
goto error;
}
for (i = 1; i < ret; i++) {
res = pcre_get_substring((char *)icmpseqstr, ov, MAX_SUBSTRINGS, i, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed");
goto error;
}
substr[i-1] = (char *)str_ptr;
}
iseq = SCMalloc(sizeof(DetectIcmpSeqData));
if (iseq == NULL)
goto error;
iseq->seq = 0;
if (substr[0] != NULL && strlen(substr[0]) != 0) {
if (substr[2] == NULL) {
SCLogError(SC_ERR_MISSING_QUOTE,"Missing quote in input");
goto error;
}
} else {
if (substr[2] != NULL) {
SCLogError(SC_ERR_MISSING_QUOTE,"Missing quote in input");
goto error;
}
}
uint16_t seq = 0;
ByteExtractStringUint16(&seq, 10, 0, substr[1]);
iseq->seq = htons(seq);
for (i = 0; i < 3; i++) {
if (substr[i] != NULL) SCFree(substr[i]);
}
return iseq;
error:
for (i = 0; i < 3; i++) {
if (substr[i] != NULL) SCFree(substr[i]);
}
if (iseq != NULL) DetectIcmpSeqFree(iseq);
return NULL;
}
/**
* \brief This function is used to parse icmp_id option passed via icmp_id: keyword
*
* \param icmpidstr Pointer to the user provided icmp_id options
*
* \retval iid pointer to DetectIcmpIdData on success
* \retval NULL on failure
*/
DetectIcmpIdData *DetectIcmpIdParse (char *icmpidstr) {
DetectIcmpIdData *iid = NULL;
char *substr[3] = {NULL, NULL, NULL};
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, icmpidstr, strlen(icmpidstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 1 || ret > 4) {
SCLogError(SC_ERR_PCRE_MATCH, "Parse error %s", icmpidstr);
goto error;
}
int i;
const char *str_ptr;
for (i = 1; i < ret; i++) {
res = pcre_get_substring((char *)icmpidstr, ov, MAX_SUBSTRINGS, i, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error;
}
substr[i-1] = (char *)str_ptr;
}
iid = SCMalloc(sizeof(DetectIcmpIdData));
if (iid == NULL)
goto error;
iid->id = 0;
if (substr[0]!= NULL && strlen(substr[0]) != 0) {
if (substr[2] == NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "Missing close quote in input");
goto error;
}
} else {
if (substr[2] != NULL) {
SCLogError(SC_ERR_INVALID_ARGUMENT, "Missing open quote in input");
goto error;
}
}
/** \todo can ByteExtractStringUint16 do this? */
uint16_t id = 0;
ByteExtractStringUint16(&id, 10, 0, substr[1]);
iid->id = htons(id);
for (i = 0; i < 3; i++) {
if (substr[i] != NULL) SCFree(substr[i]);
}
return iid;
error:
for (i = 0; i < 3; i++) {
if (substr[i] != NULL) SCFree(substr[i]);
}
if (iid != NULL) DetectIcmpIdFree(iid);
return NULL;
}
int
pcre_get_named_substring(const pcre *code, const pcre_char *subject, int *ovector,
int stringcount, const pcre_char *stringname, const pcre_char **stringptr)
{
int n = pcre_get_stringnumber(code, stringname);
if (n <= 0) return n;
return pcre_get_substring(subject, ovector, stringcount, n, stringptr);
}
int
pcre_get_named_substring(const pcre *code, const char *subject, int *ovector,
int stringcount, const char *stringname, const char **stringptr)
{
int n = get_first_set(code, stringname, ovector);
if (n <= 0) return n;
return pcre_get_substring(subject, ovector, stringcount, n, stringptr);
}
/** Extract a subcapture value from the request
*
* @note This is the PCRE variant of the function.
*
* @param[in] ctx To allocate subcapture buffer in.
* @param[out] out Where to write the subcapture string.
* @param[in] request to extract.
* @param[in] num Subcapture index (0 for entire match).
* @return
* - 0 on success.
* - -1 on notfound.
*/
int regex_request_to_sub(TALLOC_CTX *ctx, char **out, REQUEST *request, uint32_t num)
{
fr_regcapture_t *rc;
char const *p;
int ret;
rc = request_data_reference(request, request, REQUEST_DATA_REGEX);
if (!rc) {
RDEBUG4("No subcapture data found");
*out = NULL;
return 1;
}
ret = pcre_get_substring(rc->regmatch->subject,
(int *)rc->regmatch->match_data, (int)rc->regmatch->used, num, &p);
switch (ret) {
case PCRE_ERROR_NOMEMORY:
MEM(NULL);
/*
* We can't really fall through, but GCC 7.3 is
* too stupid to realise that we can never get
* here despite _fr_exit_now being marked as
* NEVER_RETURNS.
*
* If we did anything else, compilers and static
* analysis tools would probably complain about
* code that could never be executed *sigh*.
*/
/* FALL-THROUGH */
/*
* Not finding a substring is fine
*/
case PCRE_ERROR_NOSUBSTRING:
RDEBUG4("%i/%zu Not found", num + 1, rc->regmatch->used);
*out = NULL;
return -1;
default:
if (ret < 0) {
*out = NULL;
return -1;
}
talloc_set_type(p, char);
p = talloc_steal(ctx, p);
RDEBUG4("%i/%zu Found: %pV (%zu)", num + 1, rc->regmatch->used,
fr_box_strvalue_buffer(p), talloc_array_length(p) - 1);
memcpy(out, &p, sizeof(*out));
break;
}
return 0;
}
/**
* \brief This function is used to parse IPV4 ip_id passed via keyword: "id"
*
* \param idstr Pointer to the user provided id option
*
* \retval id_d pointer to DetectSshVersionData on success
* \retval NULL on failure
*/
DetectSshVersionData *DetectSshVersionParse (char *str)
{
DetectSshVersionData *ssh = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0,
ov, MAX_SUBSTRINGS);
if (ret < 1 || ret > 3) {
SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.protoversion option");
goto error;
}
if (ret > 1) {
const char *str_ptr;
res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error;
}
/* We have a correct id option */
ssh = SCMalloc(sizeof(DetectSshVersionData));
if (ssh == NULL)
goto error;
memset(ssh, 0x00, sizeof(DetectSshVersionData));
/* If we expect a protocol version 2 or 1.99 (considered 2, we
* will compare it with both strings) */
if (strcmp("2_compat", str_ptr) == 0) {
ssh->flags |= SSH_FLAG_PROTOVERSION_2_COMPAT;
SCLogDebug("will look for ssh protocol version 2 (2, 2.0, 1.99 that's considered as 2");
return ssh;
}
ssh->ver = (uint8_t *)SCStrdup((char*)str_ptr);
if (ssh->ver == NULL) {
goto error;
}
ssh->len = strlen((char *) ssh->ver);
SCLogDebug("will look for ssh %s", ssh->ver);
}
return ssh;
error:
if (ssh != NULL)
DetectSshVersionFree(ssh);
return NULL;
}
int
parse_command (const char *cmd, int len, int *argc, char ***args)
{
const char *r_error;
int r_error_offset;
pcre *re;
int rc;
int r_ovector[OVECCOUNT];
int i = 0;
re = pcre_compile (
"^(?P<command>[a-zA-Z\\-]+)(?:[ ]([^ ]+))*",
0,
&r_error,
&r_error_offset,
NULL);
if (re == NULL) {
printf("PCRE compilation failed at offset %d: %s\n", r_error_offset, r_error);
return 1;
}
rc = pcre_exec (
re,
NULL,
cmd,
len,
0,
0,
r_ovector,
OVECCOUNT);
if (rc < 0)
{
switch(rc)
{
case PCRE_ERROR_NOMATCH: printf("No match\n"); break;
/*
Handle other special cases if you like
*/
default: printf("Matching error %d\n", rc); break;
}
pcre_free(re); /* Release memory used for the compiled pattern */
return 1;
}
*argc = rc;
*args = calloc(rc+1, sizeof(char *));
for (i = 1; i < rc; ++i) {
pcre_get_substring(cmd, r_ovector, rc, i, (const char **)&(*args)[i-1]);
}
pcre_free(re); /* Release memory used for the compiled pattern */
return 0;
}
DeprecatedString RegularExpression::cap(int n) const
{
const pcre_char *substring = NULL;
int substringLength = pcre_get_substring(reinterpret_cast<const uint16_t *>(d->lastMatchString.unicode()), d->lastMatchOffsets, d->lastMatchCount, n, &substring);
if (substringLength > 0) {
DeprecatedString capture(reinterpret_cast<const DeprecatedChar *>(substring), substringLength);
pcre_free_substring(substring);
return capture;
}
return DeprecatedString();
}
char *regexp_substring( char *msg, int *ovector, int stringcount,
int stringnum )
{
char *string;
if( pcre_get_substring( msg, ovector, stringcount, stringnum,
(const char **)&string ) < 0 ) {
return( NULL );
} else {
return( string );
}
}
int matcher_append(char * str) {
int str_sz = strlen(str), exec_res;
int groups[60], max_group = 60;
if (str_sz > MBUF) {
return -1;
}
if (str_sz + buff_offset >= MBUF) {
strcpy(buff, str);
buff_offset = 0;
} else {
strcpy(buff + buff_offset, str);
}
//printf("matcher: appending [%s]\n\n\n", str);
exec_res = pcre_exec(regex, regex_opti, buff, buff_offset + str_sz, last_match, 0, groups, max_group);
if (exec_res == PCRE_ERROR_NOMATCH) {
puts(buff);
}
/*switch(exec_res) {
case PCRE_ERROR_NOMATCH : printf("String did not match the pattern\n"); break;
case PCRE_ERROR_NULL : printf("Something was null\n"); break;
case PCRE_ERROR_BADOPTION : printf("A bad option was passed\n"); break;
case PCRE_ERROR_BADMAGIC : printf("Magic number bad (compiled re corrupt?)\n"); break;
case PCRE_ERROR_UNKNOWN_NODE : printf("Something kooky in the compiled re\n"); break;
case PCRE_ERROR_NOMEMORY : printf("Ran out of memory\n"); break;
default : printf("Unknown error\n"); break;
}*/
if (exec_res >= 0) {
int c;
const char * match;
exec_res = exec_res ? exec_res : max_group / 3;
for (c = 0; c < exec_res; c += 2) {
//if (c == 0 || c % 3 == 0) continue;
pcre_get_substring(buff/* + offset ?*/, groups, exec_res, c, &match);
//printf("Match(%2d/%2d): (%2d,%2d): '%s'\n", c, exec_res-1, groups[c*2], groups[c*2+1], match);
callback(match);
pcre_free_substring(match);
last_match = c * 2 + 1;
}
} else {
last_match = buff_offset;
}
//puts(buff);
//printf("matcher: buff [%s]\n\n", buff);
buff_offset = (buff_offset + str_sz) - last_match;
memmove(buff, buff + last_match, buff_offset);
buff[buff_offset] = '\0';
return 0;
}
static char *
ccze_exim_process (const char *str, int *offsets, int match)
{
char *date, *msg=NULL, *action=NULL, *uniqn=NULL, *msgfull;
int match2, offsets2[99];
ccze_color_t color = CCZE_COLOR_UNKNOWN;
pcre_get_substring (str, offsets, match, 1, (const char **)&date);
pcre_get_substring (str, offsets, match, 2, (const char **)&msgfull);
if ((match2 = pcre_exec (reg_exim_actiontype, NULL, msgfull,
strlen (msgfull), 0, 0, offsets2, 99)) >= 0)
{
pcre_get_substring (msgfull, offsets2, match2, 1,
(const char **)&uniqn);
pcre_get_substring (msgfull, offsets2, match2, 2,
(const char **)&action);
pcre_get_substring (msgfull, offsets2, match2, 3,
(const char **)&msg);
if (action[0] == '<')
color = CCZE_COLOR_INCOMING;
else if (action[1] == '>')
color = CCZE_COLOR_OUTGOING;
else if (action[0] == '=' || action[0] == '*')
color = CCZE_COLOR_ERROR;
}
else if ((match2 = pcre_exec (reg_exim_uniqn, NULL, msgfull,
strlen (msgfull), 0, 0, offsets2, 99)) >= 0)
{
pcre_get_substring (msgfull, offsets2, match2, 1,
(const char **)&uniqn);
pcre_get_substring (msgfull, offsets2, match2, 2,
(const char **)&msg);
}
else
msg = strdup (msgfull);
ccze_print_date (date);
ccze_space ();
if (uniqn && uniqn[0])
{
ccze_addstr (CCZE_COLOR_UNIQN, uniqn);
ccze_space();
}
if (action && action[0])
{
ccze_addstr (color, action);
ccze_space();
}
return msg;
}
/**
* \brief This function is used to parse decoder events options passed via decode-event: keyword
*
* \param rawstr Pointer to the user provided decode-event options
*
* \retval de pointer to DetectFlowData on success
* \retval NULL on failure
*/
DetectEngineEventData *DetectEngineEventParse (char *rawstr)
{
int i;
DetectEngineEventData *de = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0, found = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, rawstr, strlen(rawstr), 0, 0, ov, MAX_SUBSTRINGS);
if (ret < 1) {
SCLogError(SC_ERR_PCRE_MATCH, "pcre_exec parse error, ret %" PRId32
", string %s", ret, rawstr);
goto error;
}
const char *str_ptr;
res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 0, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error;
}
for (i = 0; DEvents[i].event_name != NULL; i++) {
if (strcasecmp(DEvents[i].event_name,str_ptr) == 0) {
found = 1;
break;
}
}
if (found == 0) {
SCLogError(SC_ERR_UNKNOWN_DECODE_EVENT, "unknown decode event \"%s\"",
str_ptr);
goto error;
}
de = SCMalloc(sizeof(DetectEngineEventData));
if (unlikely(de == NULL))
goto error;
de->event = DEvents[i].code;
if (de->event == STREAM_REASSEMBLY_OVERLAP_DIFFERENT_DATA) {
StreamTcpReassembleConfigEnableOverlapCheck();
}
return de;
error:
if (de) SCFree(de);
return NULL;
}
PCRE_EXP_DEFN int PCRE_CALL_CONVENTION
pcre16_get_named_substring(const pcre16 *code, PCRE_SPTR16 subject,
int *ovector, int stringcount, PCRE_SPTR16 stringname,
PCRE_SPTR16 *stringptr)
#endif
{
int n = get_first_set(code, stringname, ovector);
if (n <= 0) return n;
#ifdef COMPILE_PCRE8
return pcre_get_substring(subject, ovector, stringcount, n, stringptr);
#else
return pcre16_get_substring(subject, ovector, stringcount, n, stringptr);
#endif
}
qbool Utils_RegExpGetGroup(char *regexp, char *matchstring, const char **resultstring, int *resultlength, int group)
{
int offsets[HUD_REGEXP_OFFSET_COUNT];
pcre *re = NULL;
const char *error;
int erroffset = 0;
int match = 0;
re = pcre_compile(
regexp, // The pattern.
PCRE_CASELESS, // Case insensitive.
&error, // Error message.
&erroffset, // Error offset.
NULL); // use default character tables.
if(error)
{
if(re)
{
Q_free(re);
}
return false;
}
if(re && (match = pcre_exec(re, NULL, matchstring, strlen(matchstring), 0, 0, offsets, HUD_REGEXP_OFFSET_COUNT)) >= 0)
{
int substring_length = 0;
substring_length = pcre_get_substring (matchstring, offsets, match, group, resultstring);
if (resultlength != NULL)
{
(*resultlength) = substring_length;
}
if(re)
{
Q_free(re);
}
return (substring_length != PCRE_ERROR_NOSUBSTRING && substring_length != PCRE_ERROR_NOMEMORY);
}
if(re)
{
Q_free(re);
}
return false;
}
SWITCH_DECLARE(void) switch_capture_regex(switch_regex_t *re, int match_count, const char *field_data,
int *ovector, const char *var, switch_cap_callback_t callback, void *user_data)
{
const char *replace;
int i;
for (i = 0; i < match_count; i++) {
if (pcre_get_substring(field_data, ovector, match_count, i, &replace) > 0) {
callback(var, replace, user_data);
pcre_free_substring(replace);
}
}
}
void format(char* s, const char* fmt, const char* p, int* v, int n)
{
const char* t = fmt;
while (1) {
int c = (int)strcspn(t, ESCAPE_STR);
memcpy(s, t, c);
s += c;
t += c;
if (!*t) {
break;
} else if (*t == ESCAPE_CHAR) {
if (isdigit(*++t)) { /* \N */
c = (*t-'0') * 2;
++t;
memcpy(s, p+v[c], v[c+1]-v[c]);
s += v[c+1] - v[c];
} else if (isalpha(*t) && isdigit(*(t+1))) {
/* \xN */
const char* q;
++t;
c = *t - '0';
if (pcre_get_substring(p, v, n, c, &q) <= 0) {
++t;
/* TODO: handle error */
continue;
}
if (find_translation(q, s,
to_section(*(t-1)))) {
s += strlen(s);
} else {
s += pcre_copy_substring(p, v, n, c, s,
100);
/* TODO: fix the use of magic number */
}
++t;
pcre_free_substring(q);
} else {
++t;
/* do nothing */
}
} else {
printf("\nformat: impossible!\n");
system("pause");
}
}
*s = 0;
}
/**
* \brief This function is used to parse IPV4 ip_id passed via keyword: "id"
*
* \param idstr Pointer to the user provided id option
*
* \retval id_d pointer to DetectSshSoftwareVersionData on success
* \retval NULL on failure
*/
DetectSshSoftwareVersionData *DetectSshSoftwareVersionParse (char *str)
{
DetectSshSoftwareVersionData *ssh = NULL;
#define MAX_SUBSTRINGS 30
int ret = 0, res = 0;
int ov[MAX_SUBSTRINGS];
ret = pcre_exec(parse_regex, parse_regex_study, str, strlen(str), 0, 0,
ov, MAX_SUBSTRINGS);
if (ret < 1 || ret > 3) {
SCLogError(SC_ERR_PCRE_MATCH, "invalid ssh.softwareversion option");
goto error;
}
if (ret > 1) {
const char *str_ptr = NULL;
res = pcre_get_substring((char *)str, ov, MAX_SUBSTRINGS, 1, &str_ptr);
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error;
}
/* We have a correct id option */
ssh = SCMalloc(sizeof(DetectSshSoftwareVersionData));
if (unlikely(ssh == NULL))
goto error;
ssh->software_ver = (uint8_t *)SCStrdup((char *)str_ptr);
if (ssh->software_ver == NULL) {
goto error;
}
pcre_free_substring(str_ptr);
ssh->len = strlen((char *)ssh->software_ver);
SCLogDebug("will look for ssh %s", ssh->software_ver);
}
return ssh;
error:
if (ssh != NULL)
DetectSshSoftwareVersionFree(ssh);
return NULL;
}
SWITCH_DECLARE(void) switch_perform_substitution(switch_regex_t *re, int match_count, const char *data, const char *field_data,
char *substituted, switch_size_t len, int *ovector)
{
char index[10] = "";
const char *replace = NULL;
switch_size_t x, y = 0, z = 0;
int num = 0;
for (x = 0; x < (len - 1) && x < strlen(data);) {
if (data[x] == '$') {
x++;
if (!(data[x] > 47 && data[x] < 58)) {
substituted[y++] = data[x - 1];
continue;
}
while (data[x] > 47 && data[x] < 58) {
index[z++] = data[x];
x++;
}
index[z++] = '\0';
z = 0;
num = atoi(index);
if (num < 0 || num > 256) {
num = -1;
}
if (pcre_get_substring(field_data, ovector, match_count, num, &replace) > 0) {
switch_size_t r;
for (r = 0; r < strlen(replace); r++) {
substituted[y++] = replace[r];
}
pcre_free_substring(replace);
}
} else {
substituted[y++] = data[x];
x++;
}
}
substituted[y++] = '\0';
}
int check_regexp_match(const char *str, const char *pattern)
{
int options = PCRE_UTF8;
const char *error;
int erroffset;
const unsigned char *tables = pcre_maketables();
pcre *re = pcre_compile(pattern, options, &error, &erroffset, tables);
if (!re)
{
log_message(ERROR, _("Can't compile regular expression '%s'"), pattern);
return FALSE;
}
int str_len = strlen(str);
int ovector[50];
int count = pcre_exec(re, NULL, str, str_len, 0, 0, ovector, 50);
if (count <= 0 && count != PCRE_ERROR_NOMATCH)
{
log_message(ERROR, _("Can't exec regular expression '%s', eror code %d"), pattern, count);
pcre_free(re);
pcre_free((void*)tables);
return FALSE;
}
pcre_free(re);
pcre_free((void*)tables);
if (count == PCRE_ERROR_NOMATCH)
return FALSE;
const char *pcre_string = NULL;
if(pcre_get_substring(str, ovector, count, 0, &pcre_string) < 0)
return FALSE;
//log_message(TRACE, _("Match word '%s' and PERL pattern '%s'"), str, pattern);
pcre_free_substring(pcre_string);
return TRUE;
}
