regex with zero byte does not work

[jackyspy]

I've tested some rules like "^\x10.\x00\x06MQIsdp" or "^\\x10.\\x00\\x06MQIsdp" to match MQTT v3.1, but It does not work, can not match binary data as bellow:

0x000000: 10 25 00 06 4d 51 49 73 64 70 03 02 00 3c 00 17 .%..MQIsdp.

I was completely confused. Any help will be appreciated!

BTW: Can LUA engine be embeded into sslh for some completed and flexible protocol choosing?

[rdebath]

Bit of a long time but for other people too ...

The configuration library converts the \x00 into a nul byte that ends the string before it's passed to the RE library. If you use \\x00 this is passed to the RE library as \x00, however, the library is by default the standard POSIX library in 'dumb regex' mode so it doesn't understand.

I suggest you recompile your copy with PCRE support linked in and then use your second example.

Note: in an ideal world the \x00 processing of the configuration library would be disabled (and \x would passed as \x) if it's using PCRE, but that doesn't seem to be possible.

[Fashaun]

It is work for the mqtt connection "^\x10.\00\x06MQIsdp"

[yrutschle]

I assume I can close this.