From 2e03fbb8b01379126a57149d083d4c0f23b9188a Mon Sep 17 00:00:00 2001 From: Christian Kreibich Date: Thu, 14 Nov 2024 16:30:11 -0800 Subject: [PATCH] Define ordering on Rule instances and use on sets in RuleMatcher Establishing reliable ordering fixes a test failure we're seeing on Alpine for the signatures/tcp-end-of-match btest, since discrepancies in rule match traversal could lead to discrepancies in corresponding event ordering. --- src/Rule.h | 3 +++ src/RuleMatcher.cc | 10 ++++++++-- .../btest/Baseline/signatures.tcp-end-of-match/.stdout | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/src/Rule.h b/src/Rule.h index 5481d3d57b..4cc75b0a37 100644 --- a/src/Rule.h +++ b/src/Rule.h @@ -59,6 +59,9 @@ public: void PrintDebug(); + bool operator==(const Rule& other) { return strcmp(ID(), other.ID()) == 0; } + bool operator<(const Rule& other) { return strcmp(ID(), other.ID()) < 0; } + static const char* TypeToString(Rule::PatternType type); private: diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc index d88168467c..405984d405 100644 --- a/src/RuleMatcher.cc +++ b/src/RuleMatcher.cc @@ -658,7 +658,8 @@ RuleMatcher::MIME_Matches* RuleMatcher::Match(RuleFileMagicState* state, const u } // Find rules for which patterns have matched. - set rule_matches; + auto cmp = [](Rule* a, Rule* b) { return *a < *b; }; + set rule_matches(cmp); for ( AcceptingMatchSet::const_iterator it = accepted_matches.begin(); it != accepted_matches.end(); ++it ) { auto [aidx, mpos] = *it; @@ -842,7 +843,12 @@ void RuleMatcher::Match(RuleEndpointState* state, Rule::PatternType type, const // matched patterns per connection (which is a plausible assumption). // Find rules for which patterns have matched. - set> rule_matches; + auto cmp = [](pair a, pair b) { + if ( *a.first == *b.first ) + return a.second < b.second; + return *a.first < *b.first; + }; + set, decltype(cmp)> rule_matches(cmp); for ( AcceptingMatchSet::const_iterator it = accepted_matches.begin(); it != accepted_matches.end(); ++it ) { AcceptIdx aidx = it->first; diff --git a/testing/btest/Baseline/signatures.tcp-end-of-match/.stdout b/testing/btest/Baseline/signatures.tcp-end-of-match/.stdout index e34d908ff0..4535bc3d33 100644 --- a/testing/btest/Baseline/signatures.tcp-end-of-match/.stdout +++ b/testing/btest/Baseline/signatures.tcp-end-of-match/.stdout @@ -1,7 +1,7 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -signature_match, message, 1448 -signature_match with end_of_match, message, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability portability_match with end_of_match, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability portability_match, 1448 portability_match_with_msg with end_of_match, custom message, 1448, 69, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability portability_match_with_msg, custom message, 1448 +signature_match, message, 1448 +signature_match with end_of_match, message, 1448, rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability