Rules - How to capture matched text

[Andrew Brosnan <an...@broscom.com>]

Hello,

In perl you can use $&, parens $1, $2, etc. to capture the text that
matched a regex; but how do you do it in sa?

Thank you
Andrew

Re: Rules - How to capture matched text

["John D. Hardin" <jh...@impsec.org>]

On Mon, 18 Dec 2006, Theo Van Dinter wrote:

> I can save you the time and tell you not to bother.  It's "subject
> of the day".  FWIW, we used to have a username in subject rule,
> but it fp'ed so much that it wasn't useful and got removed.

Hrm. That prompts a thought: how about some useful state information 
available as variables to use in rule REs? For example (off the top 
of my head):

  header I_WROTE Subject ~= /${USERNAME} wrote:/i

Would that even work? I haven't tried variable substitutions in 
rules...

--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
  does quite what I want. I wish Christopher Robin was here."
				           -- Peter da Silva in a.s.r
-----------------------------------------------------------------------
 7 days until Christmas

Re: Rules - How to capture matched text

[Theo Van Dinter <fe...@apache.org>]

On Mon, Dec 18, 2006 at 04:01:05PM -0500, Andrew Brosnan wrote:
> I'd like the rule to catch when the first name in from: is also the
> subject:.

I can save you the time and tell you not to bother.  It's "subject of the
day".  FWIW, we used to have a username in subject rule, but it fp'ed so much
that it wasn't useful and got removed.  You can look at old code to see how it
was done, but I really would suggest not bothering.

-- 
Randomly Selected Tagline:
"We are born naked, wet, and hungry. Then things get worse." - Zen Musings

Re: Rules - How to capture matched text

[Andrew Brosnan <an...@broscom.com>]

On 12/18/06 at 3:41 PM, felicity@apache.org (Theo Van Dinter) wrote:

> On Mon, Dec 18, 2006 at 02:39:13PM -0500, Andrew Brosnan wrote:
> > In perl you can use $&, parens $1, $2, etc. to capture the text 
> > that matched a regex; but how do you do it in sa?
> 
> It depends what you're trying to do.  If you want to do matching 
> between different rules, you can't do it, short of writing a plugin 
> to do what you want.  If you want to match within the same regex, 
> it's like any other regex:
> 
> /([a-z]+) foo bar \1/
> 
> generally speaking, capturing increases resource usage, so don't do 
> it unless necessary (hence the large amount of (?:...) instead of 
> (...) in the rules).


Thanks Theo,

I'd like the rule to catch when the first name in from: is also the
subject:.

I was going to capture the name in from: and compare it to subject:.

I'll have to give some thought to how I can do that without capturing
text. :-)

Regards,
Andrew

Re: Rules - How to capture matched text

[Theo Van Dinter <fe...@apache.org>]

On Mon, Dec 18, 2006 at 02:39:13PM -0500, Andrew Brosnan wrote:
> In perl you can use $&, parens $1, $2, etc. to capture the text that
> matched a regex; but how do you do it in sa?

It depends what you're trying to do.  If you want to do matching between
different rules, you can't do it, short of writing a plugin to do what you
want.  If you want to match within the same regex, it's like any other regex:

/([a-z]+) foo bar \1/

generally speaking, capturing increases resource usage, so don't do it unless
necessary (hence the large amount of (?:...) instead of (...) in the rules).

-- 
Randomly Selected Tagline:
The main problem I have with cats is, they're not dogs.
 		-- Kevin Cowherd