Fix/workaround a strange detection issue.

src/decode.h

@@ -186,7 +186,8 @@ typedef uint16_t Port;
 /* structure to store the sids/gids/etc the detection engine
  * found in this packet */
 typedef struct PacketAlert_ {
-    uint16_t num; /* Internal num, used for sorting */
+    SigIntId num; /* Internal num, used for sorting */
+    SigIntId order_id; /* Internal num, used for sorting */
     uint8_t action; /* Internal num, used for sorting */
     uint32_t  gid;
     uint32_t sid;

src/detect-engine-address.c

@@ -1492,6 +1492,7 @@ void DetectAddressPrint(DetectAddress *gr)
         inet_ntop(AF_INET, &in, mask, sizeof(mask));
 
         SCLogDebug("%s/%s", ip, mask);
+//        printf("%s/%s", ip, mask);
     } else if (gr->family == AF_INET6) {
         struct in6_addr in6;
         char ip[66], mask[66];
@@ -1502,6 +1503,7 @@ void DetectAddressPrint(DetectAddress *gr)
         inet_ntop(AF_INET6, &in6, mask, sizeof(mask));
 
         SCLogDebug("%s/%s", ip, mask);
+//        printf("%s/%s", ip, mask);
     }
 
     return;

src/detect-engine-alert.c

@@ -59,14 +59,15 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p)
 
     /* It should be usually the last, so check it before iterating */
     if (p->alerts.cnt == 0 || (p->alerts.cnt > 0 &&
-                               p->alerts.alerts[p->alerts.cnt - 1].num < s->num)) {
+                               p->alerts.alerts[p->alerts.cnt - 1].order_id < s->order_id)) {
         /* We just add it */
         if (s->gid > 1)
             p->alerts.alerts[p->alerts.cnt].gid = s->gid;
         else
             p->alerts.alerts[p->alerts.cnt].gid = 1;
 
-        p->alerts.alerts[p->alerts.cnt].num= s->num;
+        p->alerts.alerts[p->alerts.cnt].num = s->num;
+        p->alerts.alerts[p->alerts.cnt].order_id = s->order_id;
         p->alerts.alerts[p->alerts.cnt].action = s->action;
         p->alerts.alerts[p->alerts.cnt].sid = s->id;
         p->alerts.alerts[p->alerts.cnt].rev = s->rev;
@@ -77,7 +78,7 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p)
     } else {
         /* We need to make room for this s->num
          (a bit ugly with mamcpy but we are planning changes here)*/
-        for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].num > s->num; i--) {
+        for (i = p->alerts.cnt - 1; i >= 0 && p->alerts.alerts[i].order_id > s->order_id; i--) {
             memcpy(&p->alerts.alerts[i + 1], &p->alerts.alerts[i], sizeof(PacketAlert));
         }
 
@@ -88,7 +89,8 @@ int PacketAlertAppend(DetectEngineThreadCtx *det_ctx, Signature *s, Packet *p)
         else
             p->alerts.alerts[i].gid = 1;
 
-        p->alerts.alerts[i].num= s->num;
+        p->alerts.alerts[i].num = s->num;
+        p->alerts.alerts[i].order_id = s->order_id;
         p->alerts.alerts[i].action = s->action;
         p->alerts.alerts[i].sid = s->id;
         p->alerts.alerts[i].rev = s->rev;

src/detect-engine-mpm.c

@@ -479,7 +479,6 @@ static int PatternMatchPreprarePopulateMpm(DetectEngineCtx *de_ctx, SigGroupHead
     /* now determine which one to add to the mpm phase */
     for (sig = 0; sig < sgh->sig_cnt; sig++) {
         uint32_t num = sgh->match_array[sig];
-
         Signature *s = de_ctx->sig_array[num];
         if (s == NULL)
             continue;

src/detect-engine-port.c

@@ -830,8 +830,10 @@ void DetectPortPrint(DetectPort *dp) {
 
     if (dp->flags & PORT_FLAG_ANY) {
         SCLogDebug("=> port %p: ANY", dp);
+        //printf("ANY");
     } else {
         SCLogDebug("=> port %p %" PRIu32 "-%" PRIu32 "", dp, dp->port, dp->port2);
+        //printf("%" PRIu32 "-%" PRIu32 "", dp->port, dp->port2);
     }
 }
 

src/detect.c

@@ -392,14 +392,13 @@ int SigLoadSignatures (DetectEngineCtx *de_ctx, char *sig_file)
 
     Signature *s = de_ctx->sig_list;
 
-    /* Assign the unique id of signatures after sorting,
+    /* Assign the unique order id of signatures after sorting,
      * so the IP Only engine process them in order too */
-    uint16_t sig_id = 0;
+    SigIntId sig_id = 0;
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
-    de_ctx->signum = sig_id;
 
     /* Setup the signature group lookup structure and pattern matchers */
     SigGroupBuild(de_ctx);
@@ -792,6 +791,7 @@ end:
     for (i = 0; i < p->alerts.cnt; i++) {
         SCLogDebug("Sig->num: %"PRIu16, p->alerts.alerts[i].num);
         s = de_ctx->sig_array[p->alerts.alerts[i].num];
+
         int res = PacketAlertHandle(de_ctx, det_ctx, s, p, i);
         /* Thresholding might remove one alert */
         if (res == 0) {
@@ -2577,7 +2577,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
     for (ds = 0; ds < DSIZE_STATES; ds++) {
         for (f = 0; f < FLOW_STATES; f++) {
             for (proto = 0; proto < 256; proto++) {
-                if (proto != 6)
+                if (proto != 17)
                     continue;
 
                 for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv4_head; global_src_gr != NULL;
@@ -2596,6 +2596,8 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
                             global_dst_gr = global_dst_gr->next)
                     {
                         printf(" 2 Dst Addr: "); DetectAddressPrint(global_dst_gr);
+                        printf("\n");
+
                         //printf(" (sh %p) ", global_dst_gr->sh);
                         if (global_dst_gr->sh) {
                             if (global_dst_gr->sh->flags & ADDRESS_SIGGROUPHEAD_COPY) {
@@ -2612,7 +2614,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
                             DetectPort *dp = sp->dst_ph;
                             for ( ; dp != NULL; dp = dp->next) {
                                 printf("   4 Dst port(range): "); DetectPortPrint(dp);
-                                printf(" (sigs %" PRIu32 ", maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh->mpm_content_maxlen);
+                                printf(" (sigs %" PRIu32 ", sgh %p, maxlen %" PRIu32 ")", dp->sh->sig_cnt, dp->sh, dp->sh->mpm_content_maxlen);
 #ifdef PRINTSIGS
                                 printf(" - ");
                                 for (u = 0; u < dp->sh->sig_cnt; u++) {
@@ -2656,7 +2658,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
                         }
                     }
                 }
-//#if 0
+#if 0
                 for (global_src_gr = de_ctx->dsize_gh[ds].flow_gh[f].src_gh[proto]->ipv6_head; global_src_gr != NULL;
                         global_src_gr = global_src_gr->next)
                 {
@@ -2835,7 +2837,7 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) {
                         }
                     }
                 }
-//#endif
+#endif
             }
         }
     }

src/detect.h

@@ -265,6 +265,8 @@ typedef struct Signature_ {
 
     /** number of sigmatches in the match and pmatch list */
     uint16_t sm_cnt;
+
+    SigIntId order_id;
 } Signature;
 
 typedef struct DetectEngineIPOnlyThreadCtx_ {

src/util-action.c

@@ -448,7 +448,7 @@ int UtilActionTest08(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -531,7 +531,7 @@ int UtilActionTest09(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -613,7 +613,7 @@ int UtilActionTest10(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -698,7 +698,7 @@ int UtilActionTest11(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -776,7 +776,7 @@ int UtilActionTest12(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -857,7 +857,7 @@ int UtilActionTest13(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -944,7 +944,7 @@ int UtilActionTest14(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1024,7 +1024,7 @@ int UtilActionTest15(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1099,7 +1099,7 @@ int UtilActionTest16(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1174,7 +1174,7 @@ int UtilActionTest17(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1254,7 +1254,7 @@ int UtilActionTest18(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1340,7 +1340,7 @@ int UtilActionTest19(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1426,7 +1426,7 @@ int UtilActionTest20(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1506,7 +1506,7 @@ int UtilActionTest21(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1592,7 +1592,7 @@ int UtilActionTest22(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 
@@ -1678,7 +1678,7 @@ int UtilActionTest23(void)
     /* Assing the internal id after sorting, so the IP Only engine
     * process them in order too */
     while (s != NULL) {
-        s->num = sig_id++;
+        s->order_id = sig_id++;
         s = s->next;
     }
 

src/util-mpm.c

@@ -42,6 +42,7 @@
   */
 int PmqSetup(PatternMatcherQueue *pmq, uint32_t maxid) {
     SCEnter();
+    SCLogDebug("maxid %u", maxid);
 
     if (pmq == NULL) {
         SCReturnInt(-1);
@@ -94,6 +95,8 @@ MpmVerifyMatch(MpmThreadCtx *thread_ctx, PatternMatcherQueue *pmq, MpmEndMatch *
     int ret = 0;
 
     for ( ; em != NULL; em = em->next) {
+        SCLogDebug("em->sig_id %u", em->sig_id);
+
         /* check offset */
         if (offset < em->offset)
             continue;