inliniac/suricata — pull request #350 by poona (2013-05-09 04:06:57+00:00)
Title: 1. Fix assignment of signums, which affected how we used read

sigs(priority wise) inside staging.

Previously we would assign signums before sig ordering, and hence the
order didn't actually reflect the order of the sig in the
sig_list(assuming sig reordering changed the sig_list). Staging would
use the old sig_nums to decide the priority of sigs.
2. Fix sig ordering for flowvar, flowbits, flowint, pktvar sigs. We have
introduced a new priority to treat sigs which (set + read) these above
vars as lower priority compared to set only sigs.
3. Fix faulty unittest DetectPcreFlowvarCapture02.

There was a bug in sig numbering and staging, which despite the sigordering, the newly ordered sigs would be still read in the same order as before ordering. This was because SigInit() would assign a signum before sigordering, and sigordering would re-order the sigs, but the signums are unchanged and hence don't actually reflect the new position of the sig in the sig_list. But staging now reads the sigs from the list, based on the signum.

The right change would be to delete the signum allocation inside SigInitHelper() and update it after SigOrdering, which I'm doing currently in SigGroupBuild(), except that I have retained the old signum assignment in SigInitHelper(to keep unittests running fine), and I just overwrite them in SigGroupBuild().

I have also fixed what I think is a faulty unittest. Have tested this patch with your tx redesign FN rules + pcap, and it alerts now.