Suricata

You may wish to refer to: Bug #2195 as this may have been the root of that problem as well -- it looks similar.

I've purposely chosen a small set of rules (see attached) to demonstrate that this is the result of similar/duplicate patterns and not the number of patterns.

I'm not convinced this is a Hyperscan issue, but I haven't dug deeply into the details. The Suricata code referenced is making a simple assertion looking dupes that fails. Is it possible there is a truncation somewhere that is making the rules which contain: "/wf/clickupn=..." (see attached) appear the same to the hash but the memory check fails?

• Enable the file with 16 rules. Suricata will abort during dupe cull.
• Enable either of the files with 8 rules. Suricata will not abort. Notice that the files with 8 rules, when combined, are exactly the same as the file with 16 rules.

This is a dupe/interaction issue.

I've tested this with Hyperscan 5.0 and 4.6.

Let me know if you need anything else.

Thanks