Thanks very much for the quick fix ! I tried today's snapshot and it seems to work. regards On 4/29/07, Balazs Scheidler <bazsi@balabit.hu> wrote:
On Sat, 2007-04-28 at 12:44 -0700, stucky wrote:
Baszi
Cool. I'm in the middle of building a new infrastructure and would like to use this feature. I'm not a programmer but I assume adding this feature shouldn't be very hard at all right ? If you had a rough ETA that'd help me.
attached patch implements it using perl-like syntax, e.g.:
filter f_case { match('(?i)regexp'); };
It works in all filters that use regexps (e.g. match, host, program, etc) The regexp must begin with '(?' or otherwise the flag will not be recognized.
Tomorrow's snapshot should contain it.
From 47f53555268efb72ab8db2d620d7669b8e5dc7a4 Mon Sep 17 00:00:00 2001 From: Balazs Scheidler <bazsi@balabit.hu> Date: Sun, 29 Apr 2007 18:53:46 +0200 Subject: [PATCH] added support for Perl-like regexp flags to support case-ignoring matches
2007-04-28 Balazs Scheidler <bazsi@balabit.hu>
* src/filter.c (filter_re_compile): parse '(?i)' at the beginning of regexps as an ignore-case flag, just like Perl does --- src/filter.c | 34 +++++++++++++++++++++++++++++++--- tests/unit/test_filters.c | 5 +++++ 2 files changed, 36 insertions(+), 3 deletions(-)
diff --git a/src/filter.c b/src/filter.c index 8e19440..cf7e3aa 100644 --- a/src/filter.c +++ b/src/filter.c @@ -230,11 +230,39 @@ typedef struct _FilterRE } FilterRE;
static gboolean -filter_re_compile(const char *re, regex_t *regex) +filter_re_compile(const gchar *re, regex_t *regex) { - int rc; + gint rc; + const gchar *re_comp = re; + gint flags = REG_EXTENDED;
- rc = regcomp(regex, re, REG_EXTENDED); + if (re[0] == '(' && re[1] == '?') + { + gint i; + + for (i = 2; re[i] && re[i] != ')'; i++) + { + switch (re[i]) + { + case 'i': + flags |= REG_ICASE; + break; + } + } + if (re[i]) + { + re_comp = &re[i + 1]; + } + else + { + msg_error("Invalid regexp flags", + evt_tag_str("re", re), + NULL); + return FALSE; + } + } + + rc = regcomp(regex, re_comp, flags); if (rc) { gchar buf[256]; diff --git a/tests/unit/test_filters.c b/tests/unit/test_filters.c index 58236d7..187b572 100644 --- a/tests/unit/test_filters.c +++ b/tests/unit/test_filters.c @@ -137,11 +137,16 @@ main(int argc G_GNUC_UNUSED, char *argv[] G_GNUC_UNUSED)
testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_host_new("^host$"), 1); testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_host_new("^hos$"), 0); + testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_host_new("pthread"), 0); fprintf(stderr, "One \"invalid regular expressions\" message is to be expected\n"); TEST_ASSERT(filter_host_new("((") == NULL);
+ fprintf(stderr, "One \"invalid regular expressions\" message is to be expected\n"); + TEST_ASSERT(filter_host_new("(?iana") == NULL); + testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_match_new(" PTHREAD "), 1); testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_match_new("^PTHREAD$"), 0); + testcase("<15>Oct 15 16:17:01 host openvpn[2499]: PTHREAD support initialized", 0, filter_match_new("(?i)pthread"), 1); fprintf(stderr, "One \"invalid regular expression\" message is to be expected\n"); TEST_ASSERT(filter_match_new("((") == NULL);
-- Bazsi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- stucky