diff --git before/doc/aide.conf.5 after/doc/aide.conf.5 index 0f7da37..2213db2 100644 --- before/doc/aide.conf.5 +++ after/doc/aide.conf.5 @@ -480,6 +480,12 @@ against the complete path. Special characters can be escaped using two-digit URL encoding (for example, %20 to represent a space). +Rules and file names are always treated as single byte sequences (i.e. not as +UTF strings). That means that multi byte characters aren't matched by single +dot ('.') or inside a character class. To match UTF multi byte characters, +explicitly state them in the rule either verbatim (e.g. `®` for registered +sign) or by hexadecimal escaping (e.g. '\\xC2\\xAE'). + AIDE uses a deepest-match algorithm to find the tree node to search, but a first-match algorithm inside the node. (see also \fBrule\fP log level). diff --git before/src/aide.c after/src/aide.c index 622e108..aeef53f 100644 --- before/src/aide.c +++ after/src/aide.c @@ -299,7 +299,7 @@ static void read_param(int argc,char**argv) int len = (strlen(optarg)+1) * sizeof(char); conf->limit=checked_malloc(len); strncpy(conf->limit, optarg, len); - if((conf->limit_crx=pcre2_compile((PCRE2_SPTR) conf->limit, PCRE2_ZERO_TERMINATED, PCRE2_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { + if((conf->limit_crx=pcre2_compile((PCRE2_SPTR) conf->limit, PCRE2_ZERO_TERMINATED, PCRE2_NEVER_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { PCRE2_UCHAR pcre2_error[128]; pcre2_get_error_message(pcre2_errorcode, pcre2_error, 128); char * limit_safe = stresc(conf->limit); diff --git before/src/conf_eval.c after/src/conf_eval.c index 5774ce6..e884569 100644 --- before/src/conf_eval.c +++ after/src/conf_eval.c @@ -597,7 +597,7 @@ static void include_directory(const char* dir, const char* rx, bool execute, cha PCRE2_SIZE pcre2_erroffset; pcre2_code* crx; - if((crx = pcre2_compile((PCRE2_SPTR) rx, PCRE2_ZERO_TERMINATED, PCRE2_UTF, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { + if((crx = pcre2_compile((PCRE2_SPTR) rx, PCRE2_ZERO_TERMINATED, PCRE2_NEVER_UTF, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { PCRE2_UCHAR pcre2_error[128]; pcre2_get_error_message(pcre2_errorcode, pcre2_error, 128); LOG_CONFIG_FORMAT_LINE(LOG_LEVEL_ERROR, "'%s': error in regular expression '%s' at %zu: %s", execute?"@@x_include":"@@include", rx, pcre2_erroffset, pcre2_error) diff --git before/src/seltree.c after/src/seltree.c index 912a2bc..2c623a1 100644 --- before/src/seltree.c +++ after/src/seltree.c @@ -231,7 +231,7 @@ rx_rule * add_rx_to_tree(char * rx, rx_restriction_t restriction, AIDE_RULE_TYPE int pcre2_errorcode; PCRE2_SIZE pcre2_erroffset; - if((r->crx=pcre2_compile((PCRE2_SPTR) r->rx, PCRE2_ZERO_TERMINATED, PCRE2_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { + if((r->crx=pcre2_compile((PCRE2_SPTR) r->rx, PCRE2_ZERO_TERMINATED, PCRE2_NEVER_UTF|PCRE2_ANCHORED, &pcre2_errorcode, &pcre2_erroffset, NULL)) == NULL) { PCRE2_UCHAR pcre2_error[128]; pcre2_get_error_message(pcre2_errorcode, pcre2_error, 128); log_msg(LOG_LEVEL_ERROR, "%s:%d:%zu: error in rule '%s': %s (line: '%s')", filename, linenumber, pcre2_erroffset, rx, pcre2_error, linebuf);