diff --git a/src/detect-pcre.c b/src/detect-pcre.c index 2c88b8538d..edeeca50a8 100644 --- a/src/detect-pcre.c +++ b/src/detect-pcre.c @@ -67,7 +67,8 @@ #define DEFAULT_MATCH_LIMIT 10000000 #define DEFAULT_MATCH_LIMIT_RECURSION 10000000 -#define MATCH_LIMIT_DEFAULT 1500 +#define SC_MATCH_LIMIT_DEFAULT 1500 +#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500 static int pcre_match_limit = 0; static int pcre_match_limit_recursion = 0; @@ -119,20 +120,22 @@ void DetectPcreRegister (void) { intmax_t val = 0; if (!ConfGetInt("pcre.match-limit", &val)) { - pcre_match_limit = DEFAULT_MATCH_LIMIT; + pcre_match_limit = SC_MATCH_LIMIT_DEFAULT; } else { pcre_match_limit = val; } + SCLogInfo("Using PCRE match-limit setting of: %i", pcre_match_limit); val = 0; if (!ConfGetInt("pcre.match-limit-recursion", &val)) { - pcre_match_limit_recursion = DEFAULT_MATCH_LIMIT_RECURSION; + pcre_match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT; } else { pcre_match_limit_recursion = val; } + SCLogInfo("Using PCRE match-limit-recursion setting of: %i", pcre_match_limit_recursion); parse_regex = pcre_compile(PARSE_REGEX, opts, &eb, &eo, NULL); if(parse_regex == NULL) @@ -913,10 +916,10 @@ DetectPcreData *DetectPcreParse (char *regexstr) } else { - pd->sd->match_limit = MATCH_LIMIT_DEFAULT; + pd->sd->match_limit = SC_MATCH_LIMIT_DEFAULT; pd->sd->flags |= PCRE_EXTRA_MATCH_LIMIT; #ifndef NO_PCRE_MATCH_RLIMIT - pd->sd->match_limit_recursion = MATCH_LIMIT_DEFAULT; + pd->sd->match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT; pd->sd->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION; #endif /* NO_PCRE_MATCH_RLIMIT */ } diff --git a/suricata.yaml b/suricata.yaml index 957d1dc9ae..ada7a3fb93 100644 --- a/suricata.yaml +++ b/suricata.yaml @@ -168,6 +168,11 @@ engine-analysis: # enables printing reports for fast-pattern for every rule. rules-fast-pattern: yes +#recursion and match limits for PCRE where supported +pcre: + match-limit: 3500 + match-limit-recursion: 1500 + # You can specify a threshold config file by setting "threshold-file" # to the path of the threshold config file: # threshold-file: /etc/suricata/threshold.config