"Error compiling pattern"

From BroWiki

Jump to: navigation, search

If you get this type of error when starting up Bro ...

 /usr/local/bro/policy/http-request.bro, line 34: run-time error: error compiling pattern /((((((((((((((((((((^?.*(etc\/(passwd|shadow|netconfig)))|(^?.*(IFS[ \t]*=)))[...]
 /usr/local/bro/policy/http-request.bro, line 42: run-time error: error compiling pattern /((^?.*(.*\/c\+dir))|(^?.*(.*cool.dll.*)))|(^?.*(.*Admin.dll.*Admin.dll.*))/
 /usr/local/bro/policy/http-request.bro, line 48: run-time error: error compiling pattern /^?.*(\/cgi-bin\/(phf|php\.cgi|test-cgi))/
 /usr/local/bro/policy/http-request.bro, line 50: run-time error: error compiling pattern /^?.*(wwwroot|WWWROOT)/
 /usr/local/bro/policy/http-reply.bro, line 111: run-time error: error compiling pattern /^?.*(^ )/
 /usr/local/bro/policy/hot-ids.bro, line 15: run-time error: error compiling pattern /^?.*(

... then you're on a system where the pre-generated parser code that we include in the tarball does no longer work. This issue should be fixed in recent releases. Should it not work for you, please remove the parser code as follows:

 $ cd src/
 $ rm bif_parse.{cc,h} parse.cc re-parse.{cc,h} rule-parse.{cc,h}

Then run make, and the build process will generate up-to-date parser code for you.

Personal tools
User Management