[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oisf-devel
Subject:    Re: [Oisf-devel] PR: Hyperscan MPM integration
From:       "Viiret, Justin" <justin.viiret () intel ! com>
Date:       2016-03-16 23:34:18
Message-ID: 445D4044576FBD428AECF45440B11ADB280FB04D () PGSMSX102 ! gar ! corp ! intel ! com
[Download RAW message or body]

Hi Victor,

> I think I found the issue: if rules are loaded but non of them have mpm
> patterns, then I get the above. If I pass rules with mpm patterns, it works. So
> it appears the case of no mpm patterns isn't handled correctly.

Thanks -- this was a bit of a surprise. :)

We had a check in SCHSInitThreadCtx that treated the case where no patterns have been \
prepared (and hence no scratch space has been constructed) as fatal. I've patched \
this to allow this situation and tested that it operates correctly.

The updated version is in v3 of the PR: \
https://github.com/inliniac/suricata/pull/1945

Best regards,
    Justin
_______________________________________________
Suricata IDS Devel mailing list: oisf-devel@openinfosecfoundation.org
Site: http://suricata-ids.org | Participate: http://suricata-ids.org/participate/
List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
Redmine: https://redmine.openinfosecfoundation.org/
Developer Training in Paris Sept 12-16: http://suricata-ids.org/training/


[prev in list] [next in list] [prev in thread] [next in thread]