[Oisf-devel] PR: Hyperscan MPM integration

Viiret, Justin justin.viiret at intel.com
Wed Mar 16 23:34:18 UTC 2016

Hi Victor,

> I think I found the issue: if rules are loaded but non of them have mpm
> patterns, then I get the above. If I pass rules with mpm patterns, it works. So
> it appears the case of no mpm patterns isn't handled correctly.

Thanks -- this was a bit of a surprise. :)

We had a check in SCHSInitThreadCtx that treated the case where no patterns have been prepared (and hence no scratch space has been constructed) as fatal. I've patched this to allow this situation and tested that it operates correctly.

The updated version is in v3 of the PR: https://github.com/inliniac/suricata/pull/1945

Best regards,

More information about the Oisf-devel mailing list