How to get the substring when matched a rule?

[landataosong]

First, could I ask the question here?

Second, for input text "Host: www.google.com/mail", matched the rule "Host: (.*)/mail" , and I want to get the substring "www.google.com".
I think ptr + strlen("Host: ") is not a good idea, and I don't know how long for the target "www.google.com" in fact.

Thanks!

[jviiret]

Hi there,

Questions here (or on the mailing list) are fine!

What you're asking for is capturing group support, which Hyperscan does not support. Hyperscan will only provide the end-offset of a match, or both the start- and end-offsets if you use the HS_FLAG_SOM_LEFTMOST flag.

Probably the best way to do what you're trying to do with Hyperscan is to perform some further processing in the match callback when Hyperscan finds a match. Depending on how stylized your patterns are, you could use some sort of string matching (as you've suggested), or a single-regex matcher that supports capturing groups, like PCRE, to extract the sub-match data you need.