Individual Entry Archive

Navigation

• Previous Post: Contrary to popular belief…
• Next Post: Blue, but not Suede, Shoe

Irregular Expressions

Well, it looks like the reason blacklist_to_modsec has been working so well for me is that I’m running Apache 2.x. mod_security uses Apache’s built-in regular expression engine, but this engine differs between Apache version 1.x and 2.x. I’ve been writing regexes to the 2.x standard, which is the same as Perl’s regular expression engine (PCRE)… but these don’t work as expected on Apache 1.x, which uses a POSIX-style regex engine. I’ve spent a few hours trying to write some sort of conversion routine to change PCRE into POSIX, but it’s very frustrating because there are some things that just don’t translate well. So if anyone knows of an easy way to get PCRE to change into POSIX, lemme know. Otherwise, proper regex support will be a ways off.

Of course, I’d rather everyone just upgrade to Apache 2.x… but that’s just a dream. Bah.

On a positive note, if I can spare some time this week, I’ll try to get out an updated version that has dumbed-down regex support, along with some other bugfixes.