pcre2: document the behavioral changes

diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
index e36ed2b18401c88b96b6f16725a53e5a3b8a5ec8..422ea44c8b4735d2495d36573c133e0eb3e56dac 100644 (file)
--- a/doc/userguide/rules/payload-keywords.rst
+++ b/doc/userguide/rules/payload-keywords.rst
@@ -757,3 +757,22 @@ Suricata has its own specific pcre modifiers. These are:
   relative to the previous match so both matches have to be in the
   HTTP-Host buffer.
 
+.. _pcre-update-v1-to-v2:
+
+Changes from PCRE1 to PCRE2
+===========================
+
+The upgrade from PCRE1 to PCRE2 changes the behavior for some
+PCRE expressions.
+
+- ``\I`` is a valid pcre in PCRE1, with a useless escape, so
+  equivalent to ``I``, but it is no longer the case in PCRE2.
+  There are other characters than I exhibiting this pattern
+- ``[\d-a]`` is a valid pcre in PCRE1, with either a digit,
+  a dash or the character ``a``, but the dash must now be escaped
+  with PCRE2 as ``[\d\-a]`` to get the same behavior
+- ``pcre2_substring_copy_bynumber`` now returns an error
+  ``PCRE2_ERROR_UNSET`` instead of ``pcre_copy_substring`` returning
+  no error and giving an empty string. If the behavior of some use
+  case is no longer the expected one, please let us know.
+

diff --git a/doc/userguide/upgrade.rst b/doc/userguide/upgrade.rst
index 84f522b1dc7bb7280bdad771c1cd0920417f26c0..96b8f0518ada6fd6c2185085d34bcb3ba130806f 100644 (file)
--- a/doc/userguide/upgrade.rst
+++ b/doc/userguide/upgrade.rst
@@ -35,6 +35,7 @@ Upgrading 6.0 to 7.0
 
 Major changes
 ~~~~~~~~~~~~~
+- Upgrade of PCRE1 to PCRE2. See :ref:`pcre-update-v1-to-v2` for more details.
 
 Removals
 ~~~~~~~~