一直找PCRE的學(xué)習(xí)資料，網(wǎng)上沒有發(fā)現(xiàn)很全面的，回過頭了仔細看了一下PCRE源碼dochtml下的資料，發(fā)現(xiàn)其實這些文檔就是非常不錯的學(xué)習(xí)材料。
今天看了一下如何使用PCRE，還沒有涉及到PCRE原理和實現(xiàn)的代碼。我們可以在http://www.pcre.org/上下載到pcre的代碼，下載到的源文件pcre-x.x.tar.bz2在linux下面很容易就可以被編譯和安裝(x86 系列cpu哦)。
./configure
make
make install
PCRE編譯安裝之后，以一個lib庫的方式提供給用戶程序進行使用，PCRE lib 提供了一組API,通過這一組API可以實現(xiàn)類似于Perl語法的正則表達式查找和匹配的功能。（PCREE library is a set of functions that implement regular expression pattern matching using the same syntax and semantics as Perl, with just a few differences.）
要想使用好PCRE，要了解很多正則表達式的內(nèi)容、同時需要對PCRE進行很多的配置，從而使其支持不同的模式和規(guī)格。在這里只是簡單的描述一下使用PCRE的方法，不涉及配置和正則表達式語法的內(nèi)容。
使用PCRE主要是使用下面的四個函數(shù)，對這四個函數(shù)有了了解，使用PCRE庫的時候就會簡單很多。
pcre_compile() /pcre_compile2()
pcre_study()
pcre_exec()
1. pcre_compile() /pcre_compile2()， 正則表達式在使用之前要經(jīng)過編譯。
pcre *pcre_compile(const char *pattern, int options, const char **errptr, int *erroffset, const unsigned char *tableptr);
pcre *pcre_compile2(const char *pattern, int options, int *errorcodeptr, const char **errptr, int *erroffset, const unsigned char *tableptr);
編譯的目的是將正則表達式的pattern轉(zhuǎn)換成PCRE引擎能夠識別的結(jié)構(gòu)（struct real_pcre）。
還沒有對編譯的過程進行分析.
2. pcre_study（），對編譯后的正則表達式結(jié)構(gòu)(struct real_pcre)進行分析和學(xué)習(xí),學(xué)習(xí)的結(jié)果是一個數(shù)據(jù)結(jié)構(gòu)(struct pcre_extra),這個數(shù)據(jù)結(jié)構(gòu)連同編譯后的規(guī)則(struct real_pcre)可以一起送給pcre_exec單元進行匹配.
If a compiled pattern is going to be used several times, it is worth spending more time analyzing it in order to speed up the time taken for matching. The function pcre_study() takes a pointer to a compiled pattern as its first argument. If studying the pattern produces additional information that will help speed up matching, pcre_study() returns a pointer to a pcre_extra block, in which the study_data field points to the results of the study.
pcre_study（）的引入主要是為了加速正則表達式匹配的速度.(為什么學(xué)習(xí)后就能加速呢?)這個還是比較有用的,可以將正則表達式編譯,學(xué)習(xí)后保存到一個文件或內(nèi)存中,這樣進行匹配的時候效率比較搞.snort中就是這樣做的.
3. pcre_exec（），根據(jù)正則表達式到指定的字符串中進行查找和匹配,并輸出匹配的結(jié)果.
The function pcre_exec() is called to match a subject string against a compiled pattern, which is passed in the code argument. If the pattern has been studied, the result of the study should be passed in the extra argument. This function is the main matching facility of the library, and it operates in a Perl-like manner.
4. Snort中如何使用PCRE呢?snort中以插件的形式調(diào)用PCRE進行正則表達式的匹配。
1）進行正則表達式的初始化。
InitializeDetection--> RegisterRules-->RegisterOneRule-->PCRESetup(Just for OPTION_TYPE_PCRE)->pcre_compile and pcre_study. All will be stored in a structure called PCREInfo in the memory.
2.) 規(guī)則的匹配。DetectionCheckRule-->ruleMatch-->ruleMatchInternal-->pcreMatch(OPTION_TYPE_PCRE)->pcre_test-->pcre_exec.
5.編譯PCRE on TILERA platform.
1) tar -xjvf pcre-7.9.tar.bz2
2) Modify config.sub to support tile architecture.
We wish to use DE>HOST=tileDE>, but the DE>tileDE> architecture is not yet standard, so may not exist in the DE>config.subDE> file. If necessary, add these lines in the alphabetical list of architectures (typically about 1,100 lines down):
tile*)
basic_machine=tile-tilera
os=-linux-gnu
;;
3) Compile PCRE on tile Linux.
** Start up TILERA card through tile-monitor.
tile-monitor --pci --mount-tile /usr \
--mount-tile /bin --mount-tile /sbin --mount-tile /etc --mount-tile /lib \
--mkdir /mnt/libs --mount /libs-compile /mnt/libs \
--mkdir /mnt/mde --mount $TILERA_ROOT /mnt/mde
* ./configure --build=tile --prefix=/usr lt_cv_sys_max_cmd_len=262144 --disable-cpp
//編譯的時候沒有使能c++的支持。
pcre-7.9 configuration summary:
pcre-7.9 configuration summary:
Install prefix .................. : /usr
C preprocessor .................. : gcc -E
C compiler ...................... : gcc
C++ preprocessor ................ : g++ -E
C++ compiler .................... : g++
Linker .......................... : /usr/bin/ld
C preprocessor flags ............ :
C compiler flags ................ : -O2
C++ compiler flags .............. : -O2
Linker flags .................... :
Extra libraries ................. :
Build C++ library ............... : no
Enable UTF-8 support ............ : no
Unicode properties .............. : no
Newline char/sequence ........... : lf
\R matches only ANYCRLF ......... : no
EBCDIC coding ................... : no
Rebuild char tables ............. : no
Use stack recursion ............. : yes
POSIX mem threshold ............. : 10
Internal link size .............. : 2
Match limit ..................... : 10000000
Match limit recursion ........... : MATCH_LIMIT
Build shared libs ............... : yes
Build static libs ............... : yes
Link pcregrep with libz ......... : no
Link pcregrep with libbz2 ....... : no
Link pcretest with libreadline .. : no
* make
* make install
4) Compile the PCRE demo code and test PCRE lib on TILERA linux. PCRE 的源文件中提供了兩個demo程序，一個是比較簡單的pcredemo.c，很容易理解；另外一個是pcretest.c，這個比較全面、完整的介紹了pcre庫的使用。這兩個demo本身就是非常好的學(xué)習(xí)材料。
# gcc -o pcredemo pcredemo.c -lpcre
# ./pcredemo 'cat|dog' 'the cat sat on the mat'
Match succeeded at offset 4
0: cat
No named substrings
# ./pcredemo -g 'cat|dog' 'the dog sat on the cat'
Match succeeded at offset 4
0: dog
No named substrings
Match succeeded again at offset 19
0: cat
No named substrings
//參考資料:
PCRE源碼文檔:pcre-7.9/doc/html