remove support for skipping reinspecting fast pattern contents once again during packet payload inspection. Also make some changes to our detection engine

src/detect-engine-payload.c

@@ -96,18 +96,16 @@ static int DoInspectPacketPayload(DetectEngineCtx *de_ctx,
             /* we might have already have this content matched by the mpm.
              * (if there is any other reason why we'd want to avoid checking
              *  it here, please fill it in) */
-            if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET) {
+            //if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET) {
-                if (cd->flags & DETECT_CONTENT_PACKET_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) {
+            //    if (cd->flags & DETECT_CONTENT_PACKET_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) {
-                    /* we will remove this check in the end */
+            //        /* we will remove this check in the end */
-                    if (!DETECT_CONTENT_IS_SINGLE(cd))
+            //        if (!DETECT_CONTENT_IS_SINGLE(cd))
-                        abort();
+            //            abort();
-                    //goto match;
+            //        //goto match;
-                }
+            //    }
-            } else if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM) {
+            //} else if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM) {
+            if (det_ctx->flags & DETECT_ENGINE_THREAD_CTX_INSPECTING_STREAM) {
                 if (cd->flags & DETECT_CONTENT_STREAM_MPM && !(cd->flags & DETECT_CONTENT_NEGATED)) {
-                    /* we will remove this check in the end */
-                    if (!DETECT_CONTENT_IS_SINGLE(cd))
-                        abort();
                     goto match;
                 }
             }
@@ -391,10 +389,10 @@ int DetectEngineInspectPacketPayload(DetectEngineCtx *de_ctx,
     det_ctx->payload_offset = 0;
     det_ctx->discontinue_matching = 0;
     det_ctx->inspection_recursion_counter = 0;
-    det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET;
+    //det_ctx->flags |= DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET;
 
     r = DoInspectPacketPayload(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_PMATCH], p, f, p->payload, p->payload_len);
-    det_ctx->flags &= ~DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET;
+    //det_ctx->flags &= ~DETECT_ENGINE_THREAD_CTX_INSPECTING_PACKET;
     if (r == 1) {
         SCReturnInt(1);
     }

src/detect.c

@@ -1132,14 +1132,36 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
                 if (pmatch == 0) {
                     SCLogDebug("no match in smsg, fall back to packet payload");
 
+                    if (sms_runflags & SMS_USED_PM) {
+                        if (s->flags & SIG_FLAG_MPM_PACKET && !(s->flags & SIG_FLAG_MPM_PACKET_NEG) &&
+                            !(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] &
+                              s->mpm_pattern_id_mod_8)) {
+                            goto next;
+                        }
+                        if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) {
+                            goto next;
+                        }
+                    } else {
                         if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1)
                             goto next;
                     }
+                }
+            } else {
+                if (sms_runflags & SMS_USED_PM) {
+                    if (s->flags & SIG_FLAG_MPM_PACKET && !(s->flags & SIG_FLAG_MPM_PACKET_NEG) &&
+                        !(det_ctx->pmq.pattern_id_bitarray[(s->mpm_pattern_id_div_8)] &
+                          s->mpm_pattern_id_mod_8)) {
+                        goto next;
+                    }
+                    if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1) {
+                        goto next;
+                    }
                 } else {
                     if (DetectEngineInspectPacketPayload(de_ctx, det_ctx, s, p->flow, flags, alstate, p) != 1)
                         goto next;
                 }
             }
+        }
 
         SCLogDebug("s->sm_lists[DETECT_SM_LIST_AMATCH] %p, s->sm_lists[DETECT_SM_LIST_UMATCH] %p, s->sm_lists[DETECT_SM_LIST_DMATCH] %p",
                 s->sm_lists[DETECT_SM_LIST_AMATCH], s->sm_lists[DETECT_SM_LIST_UMATCH], s->sm_lists[DETECT_SM_LIST_DMATCH]);