Re: Hyperscan and ERROR: rules/snort.rules:3208 can't compile content ''

Hello Amish,

For:
ERROR: rules/snort.rules:3208 can't compile content ''
I would expect the pattern between quotes. Did you remove it?
Otherwise, since commenting out hyperscan made it work, I would suspect hyperscan issues on this host, and rules probably OK.
See https://github.com/snort3/snort3/issues/171 for similar issue.

Beyond what is suggested there, you can try to run with gdb, break on error, and look at err. 
    if ( hs_compile((const char*)hex_pat.c_str(), flags,
        HS_MODE_BLOCK, nullptr, (hs_database_t**)&db, &err) != HS_SUCCESS )
#else
    if ( hs_compile_lit((const char*)pattern, flags, pattern_len,
        HS_MODE_BLOCK, nullptr, (hs_database_t**)&db, &err) != HS_SUCCESS )
#endif
    {
        ParseError("can't compile content '%s'", pattern);
        hs_free_compile_error(err);
        return;
    }

Adrian

-----Original Message-----
From: Snort-users <[email protected]> On Behalf Of Amish via Snort-users
Sent: Tuesday, June 20, 2023 12:21 AM
To: [email protected]
Subject: [Snort-users] Hyperscan and ERROR: rules/snort.rules:3208 can't compile content ''

Hello,

I am using Arch Linux with snort version as follows:

   ,,_     -*> Snort++ <*-
   o"  )~   Version 3.1.63.0
    ''''    By Martin Roesch & The Snort Team
            http://snort.org/contact#team
            Copyright (C) 2014-2023 Cisco and/or its affiliates. All 
rights reserved.
            Copyright (C) 1998-2013 Sourcefire, Inc., et al.
            Using DAQ version 3.0.11
            Using LuaJIT version 2.1.0-beta3
            Using OpenSSL 3.1.1 30 May 2023
            Using libpcap version 1.10.4 (with TPACKET_V3)
            Using PCRE version 8.45 2021-06-15
            Using ZLIB version 1.2.13
            Using Hyperscan version 5.4.2 2023-04-22
            Using LZMA version 5.4.3

I am running it on Intel i3-9100T CPU (Dell Optiplex 3070)

But there are hundreds of lines as follows:

ERROR: rules/snort.rules:3208 can't compile content ''

Snort crashes with following error:
Jun 20 09:36:34 foo snort[27985]: FATAL ERROR: see prior 721 errors (0 
warnings)

But this same version (with exact same package file) works fine on an 
older machine with Intel Core 2 Duo. Both machines have identical 
packages installed.

I have following line in local.lua file

-- Enable hyperscan for IPS, AppID, HTTP inspection, pcre/regex matches
search_engine = { search_method = "hyperscan" }
detection = { hyperscan_literals = true, pcre_to_regex = true }

With this line it works fine on Intel Core 2 Duo machine but not work on 
Intel i3-9100T.

If I comment above two config lines, then snort starts fine.

What could be the issue? And how can I solve this?

Thank you

Amish.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette