Conditional Subpatterns - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Appendix B Regular Expression Reference
This time the first assertion looks at the preceding six characters, checking that the first three are digits,
and then the second assertion checks that the preceding three characters are not "999".
Assertions can be nested in any combination. For example,
matches an occurrence of "baz" that is preceded by "bar" which in turn is not preceded by "foo", while
is another pattern that matches "foo" preceded by three digits and any three characters that are not "999".

Conditional Subpatterns

It is possible to cause the matching process to obey a subpattern conditionally or to choose between two
alternative subpatterns, depending on the result of an assertion, or whether a previous capturing
subpattern matched or not. The two possible forms of conditional subpattern are
If the condition is satisfied, the yes-pattern is used; otherwise the no-pattern (if present) is used. If there
are more than two alternatives in the subpattern, a compile-time error occurs.
There are three kinds of condition. If the text between the parentheses consists of a sequence of digits,
the condition is satisfied if the capturing subpattern of that number has previously matched. The number
must be greater than zero. Consider the following pattern, which contains non-significant white space to
make it more readable (assume the PCRE_EXTENDED option) and to divide it into three parts for ease
of discussion:
The first part matches an optional opening parenthesis, and if that character is present, sets it as the first
captured substring. The second part matches one or more characters that are not parentheses. The third
part is a conditional subpattern that tests whether the first set of parentheses matched or not. If they did,
that is, if subject started with an opening parenthesis, the condition is true, and so the yes-pattern is
executed and a closing parenthesis is required. Otherwise, since no-pattern is not present, the subpattern
matches nothing. In other words, this pattern matches a sequence of non-parentheses, optionally
enclosed in parentheses.
If the condition is the string (R), it is satisfied if a recursive call to the pattern or subpattern has been
made. At "top level", the condition is false. This is a PCRE extension. Recursive patterns are described
in the next section.
If the condition is not a sequence of digits or (R), it must be an assertion. This may be a positive or
negative lookahead or lookbehind assertion. Consider this pattern, again containing non-significant
white space, and with the two alternatives on the second line:
78-17020-01
(?<=\d{3}...)(?<!999)foo
(?<=(?<!foo)bar)baz
(?<=\d{3}(?!999)...)foo
(?(condition)yes-pattern)
(?(condition)yes-pattern|no-pattern)
( \( )? [^()]+ (?(1) \) )
(?(?=[^a-z]*[a-z])
\d{2}-[a-z]{3}-\d{2} | \d{2}-\d{2}-\d{2} )
User Guide for Cisco Security MARS Local Controller
Conditional Subpatterns
B-19