I have further simplified the logic, removing some redundant code.  If we have a port range specified in the sig that isn't covered by the pp, we invalidate the sig.