Hi Arturo, >> BTW, It hasn't escaped our notice that there is a new >> 'hs_valid_platform()' function in Hyperscan 4.4 which checks at runtime >> whether the executing CPU has SSSE3 support. This may help to no longer >> require a Hyperscan-specific Debian package for Suricata: if Suricata >> could check at runtime whether Hyperscan can be used -- and fall back to >> the classic BM/AC matchers if not -- we can just depend on and use >> libhyperscan4 for all archs on which Hyperscan is available by default. >> I wonder what your thoughts are? > > That sounds more elegant than our current implementation. I would go this way.
Good to hear that we agree :) >> To test this, I have started working on a proof-of-concept patch >> for Suricata to do exactly that. Upstream might be interested as well? >> > > I guess so! yes! That would be great indeed :-) I've prepared some first code [1] and will be testing it today in a QEMU VM with SSSE3 disabled. If that works I'll ping upstream, OK? Cheers Sascha [1] https://github.com/satta/suricata/commit/1c41e89a4661223c997c846fbc6e1810614cba04
