# Plugin regex issue

**URL:** <https://community.zeek.org/t/plugin-regex-issue/3925>\
**Category:** Zeek\
**Created:** [December 1, 2015, 8:38pm UTC](https://community.zeek.org/t/plugin-regex-issue/3925 "2015-12-01T20:38:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [December 1, 2015, 8:38pm UTC](https://community.zeek.org/t/plugin-regex-issue/3925/1 "2015-12-01T20:38:28Z")

</div>

Hi all,

I have a quick question regarding Bro’s plugin structure. I’m working on a protocol analyzer plugin that works well, except for one thing— I can’t use Binpac’s RE primitive type in my protocol.pac file. My suspicion is that regex may need to be explicitly loaded for the plugin. I’ve tested the same code by compiling it into Bro and it works there, just not as a plugin.

Is anyone (perhaps the Bro team, Robin?) aware of an issue using RE primitives in plugins? Every other primitive type I’ve tested works.

The analyzer is a very early work in progress, but you can find and test the issue if you want: [https://github.com/jshlbrd/bro-analyzers/tree/master/stun-protocol-plugin](https://github.com/jshlbrd/bro-analyzers/tree/master/stun-protocol-plugin)

Further details below …

type STUN\_UDP\_MAGIC\_PDU(is\_orig: bool) = record {  
message\_type: uint16;  
message\_len: uint16;  
magic\_cookie: RE/\x21\x12\xa4\x42/;  
trans\_id: bytestring &length=12;  
#attributes: STUN\_ATTRIBUTE[] &until($input.length() == 0);  
} &byteorder=bigendian &length=message\_len+20;

In the record above, when used as a plugin, the magic\_cookie is skipped. When compiled, it works as expected.

Thanks!

Josh

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [December 5, 2015, 1:51am UTC](https://community.zeek.org/t/plugin-regex-issue/3925/2 "2015-12-05T01:51:00Z")

</div>

Turns out it's a problem with the order in which the BinPAC system is  
initialized. I just pushed a fix for Bro to git, that seems to solve  
it. Give it a try.

Robin

---

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [December 5, 2015, 3:52pm UTC](https://community.zeek.org/t/plugin-regex-issue/3925/3 "2015-12-05T15:52:00Z")

</div>

Thanks Robin, it looks like it fixed the issue I was having with this analyzer. I have another analyzer that primarily uses regex for the protocol parsing, so I’ll try that later and verify it works as well.

Will the fix you pushed to git be available in the Bro 2.5 release, or will it be packaged and available sooner than that?

Thanks!  
Josh

---

<div class="post-metadata">

**Author:** ![Josh\_Liburdi](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@Josh\_Liburdi](https://community.zeek.org/u/Josh_Liburdi)\
**Post date:** [December 5, 2015, 3:59pm UTC](https://community.zeek.org/t/plugin-regex-issue/3925/4 "2015-12-05T15:59:42Z")

</div>

Well, later turned out to come a lot sooner than I thought. I tested it with my second analyzer plugin and all is well. Thanks again!

Josh

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/plugin-regex-issue/3925/5 "2022-05-06T15:43:15Z")

</div>