pfSense » pfSense Packages

I don't believe this is a bug in the Snort package source code. I think it is instead a problem with your search term defined in your SID management configuration file.

The actual line of code in the Snort package is simply applying what it read from the SID management configuration file token to the text of the rule.

Can you post which particular SID management configuration you are using? I suspect it is a quoting/escaping issue in your search string.

I think you're correct. This isn't a bug in your code.

There are a couple of things going on.

First, my SID management config contains a number of complex PCRE operators that I copied over from a working config for suricata. Unlike the suricata package, the snort SID management code escapes these with preg_quote before passing them to preg_match. This breaks any actual use of PCRE with the pcre: operator. I haven't gotten round to creating a bug report for this yet.

As a workaround I had created a local patch for the snort package to remove the preg_quote operation. The suricata package doesn't do this escape, so this seemed harmless and allowed the pcre operators to work.

However, my config included this malformed regex:

pcre:metadata:.*deployment\s+(Datacenter/Internal).*signature_severity\s+(Critical|Major)

The wayward '/' in this pattern results in 'Internal' being interpreted as a pattern modifier, resulting in this error.

This particular issue can be closed since the behavior I reported is self-induced. I'm not sure why this didn't throw an error in 2.4.4-p3, however.