Subpatterns - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Appendix B Regular Expression Reference
matches abc and aBc and no other strings (assuming PCRE_CASELESS is not used). By this means,
options can be made to have different settings in different parts of the pattern. Any changes made in one
alternative do carry on into subsequent branches within the same subpattern. For example,
matches "ab", "aB", "c", and "C", even though when matching "C" the first branch is abandoned before
the option setting. This is because the effects of option settings happen at compile time. There would be
some very weird behaviour otherwise.
The PCRE-specific options PCRE_UNGREEDY and PCRE_EXTRA can be changed in the same way
as the Perl-compatible options by using the characters U and X respectively. The (?X) flag setting is
special in that it must always occur earlier in the pattern than any of the additional features it turns on,
even when it is at top level. It is best to put it at the start.

Subpatterns

Subpatterns are delimited by parentheses (round brackets), which can be nested. Turning part of a pattern
into a subpattern does two things:
Step 1 It localizes a set of alternatives. For example, the pattern :
matches one of the words "cat", "cataract", or "caterpillar". Without the parentheses, it would match
"cataract", "erpillar" or the empty string.
It sets up the subpattern as a capturing subpattern. This means that, when the whole pattern matches, that
Step 2
portion of the subject string that matched the subpattern is passed back to the caller via the ovector
argument of pcre_exec(). Opening parentheses are counted from left to right (starting from 1) to obtain
numbers for the capturing subpatterns.
For example, if the string "the red king" is matched against the pattern
the captured substrings are "red king", "red", and "king", and are numbered 1, 2, and 3, respectively.
The fact that plain parentheses fulfil two functions is not always helpful. There are often times when a
grouping subpattern is required without a capturing requirement. If an opening parenthesis is followed
by a question mark and a colon, the subpattern does not do any capturing, and is not counted when
computing the number of any subsequent capturing subpatterns. For example, if the string "the white
queen" is matched against the pattern
the captured substrings are "white queen" and "queen", and are numbered 1 and 2. The maximum number
of capturing subpatterns is 65535, and the maximum depth of nesting of all subpatterns, both capturing
and non-capturing, is 200.
As a convenient shorthand, if any option settings are required at the start of a non-capturing subpattern,
the option letters may appear between the "?" and the ":". Thus the two patterns
78-17020-01
(a(?i)b|c)
cat(aract|erpillar|)
the ((red|white) (king|queen))
the ((?:red|white) (king|queen))
(?i:saturday|sunday)
(?:(?i)saturday|sunday)
User Guide for Cisco Security MARS Local Controller
Subpatterns
B-11