topic Re: Negative lookahead regular expression not working in General Topics

Negative lookahead regular expression not working

BenLassila — Fri, 11 Mar 2011 12:14:53 GMT

Bit of an advanced regex feature, but I would like to set up a custom vulnerability signature to detect browsers (user-agent) that are not Internet Explorer. True, one could detect Firefox specifically, but there are so many different browsers in the wild that it is impossible to match them all.

The regex I'm attempting therefore is: User-Agent: (?!.*MSIE).*

The regular expression would match if any browser type (user-agent) is not MS Internet Explorer, which is what I need.

However, PANOS 4.0.0 doesn't seem to like this syntax and returns an error:-

Operation Failed:

-> signature > standard > Firefox -> and-condition -> And Condition 1 -> or-condition-> Or Condition 1 -> operator -> pattern-match -> pattern "User-Agent: (?!.*MSIE).* is invalid. syntax error at ?

Is there any other way to achieve the detection of non-MSIE browsers?

Thanks

Kind regards, Ben

Re: Negative lookahead regular expression not working

fredallee — Tue, 15 Mar 2011 07:55:43 GMT

Hi Ben,

As you've figured out, the answer to your question is no we don't support negative lookahead regex. I think it's doable, but it may not be supported in regex. Instead we could expose a negative flag that you can associate with a pattern in the signature. So you would first look for User-Agent, then MSIE with a negative flag, which would trigger if MSIE was not found after the User-Agent trigger. This will require some software and engine work. If this works for you, can you have your SE log a feature request and we will see where we can get it scheduled in.

Thanks,

Alfred

Re: Negative lookahead regular expression not working

alexis_janin — Wed, 03 Aug 2011 11:46:05 GMT

Hi,

As i have the same problem and that currently, the PAN OS 4.0.3 still doesn't support negative regexp, i would know if there is a fix coming or not?

Thanks for answers,

Alexis

Re: Negative lookahead regular expression not working

HMarch — Tue, 29 May 2012 21:05:21 GMT

I would be *very* interested in this feature as well: any news on implementation?

Re: Negative lookahead regular expression not working

BenLassila — Wed, 30 May 2012 07:58:13 GMT

No, PA said implementation would have negative impact on performance.