Actions
Bug #6177
opendetect-engine: stream match for rules is interdependent
Affected Versions:
Effort:
Difficulty:
Label:
Description
For rules mentioned in the s-v test https://github.com/OISF/suricata-verify/blob/master/tests/bug-2917/test.rules
and for the following debug statement:
diff --git a/src/detect-engine.c b/src/detect-engine.c
index 83756018c..7b317142a 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -531,6 +531,7 @@ static void AppendStreamInspectEngine(
if (unlikely(new_engine == NULL)) {
exit(EXIT_FAILURE);
}
+ SCLogNotice("mpm_sm_list: %d for sid: %d", s->init_data->mpm_sm_list, s->id);
if (s->init_data->mpm_sm_list == DETECT_SM_LIST_PMATCH) {
SCLogDebug("stream is mpm");
prepend = true;
one gets the following output:
Notice: detect: mpm_sm_list: -1 for sid: 1371257161 [AppendStreamInspectEngine:detect-engine.c:534]
Notice: detect: mpm_sm_list: -1 for sid: 1371257161 [AppendStreamInspectEngine:detect-engine.c:534]
However, if the rule with sid: 5
was removed from the test, one would get the output as follows:
Notice: detect: mpm_sm_list: -1 for sid: 2 [AppendStreamInspectEngine:detect-engine.c:534]
Notice: detect: mpm_sm_list: -1 for sid: 2 [AppendStreamInspectEngine:detect-engine.c:534]
Notice: detect: mpm_sm_list: 1 for sid: 4 [AppendStreamInspectEngine:detect-engine.c:534]
Notice: detect: mpm_sm_list: 1 for sid: 4 [AppendStreamInspectEngine:detect-engine.c:534]
Notice: detect: mpm_sm_list: -1 for sid: 1371257161 [AppendStreamInspectEngine:detect-engine.c:534]
Notice: detect: mpm_sm_list: -1 for sid: 1371257161 [AppendStreamInspectEngine:detect-engine.c:534]
It would be expected that the rules have no dependency among one another and each be dealt separately but this case shows that it is not the case.
Actions