Snort uses PCRE to filter traffic through about 3200 regexes, about 300 of which contain backreferences and possessive quantifiers. The rest of them (2900) could run faster through the alternative DFA algorithm.
But since pcre_dfa_exec doesn't return an error when given a pcre object than uses these two unsupported features, callers have to search for them in the expression to decide which algorithm can be applied. What would be best ? A flag (PCRE_DFA_ONLY) so pcre_compile returns an error if pcre_dfa_exec would not be suitable, a pcre_is_dfa(pcre *) or an error code from pcre_dfa_exec ? Or is there already a way to determine which algorithm to use, other than reading pcrematching(3) ? Thanks! Bogdan Harjoc -- ## List details at https://lists.exim.org/mailman/listinfo/pcre-dev
