detect/iponly: warn on threshold track by flow

IP Only rules are only evaluated once per direction per flow for a
standard rule and twice at the most for a bidirectional rule. Using
threshold or detection_filter with track by_flow does not make much
sense for higher count as the rule may never fire.

Issue a warning for this case in engine analysis mode for now.

Ticket: 9170

src/detect-engine-analyzer.c

@@ -42,6 +42,7 @@
 #include "detect-isdataat.h"
 #include "detect-flow.h"
 #include "detect-ttl.h"
+#include "detect-threshold.h"
 #include "detect-tcp-flags.h"
 #include "detect-tcp-ack.h"
 #include "detect-ipopts.h"
@@ -1783,6 +1784,7 @@ void EngineAnalysisRules(const DetectEngineCtx *de_ctx,
     uint32_t warn_non_alproto_fp_for_alproto_sig = 0;
     uint32_t warn_no_direction = 0;
     uint32_t warn_both_direction = 0;
+    uint32_t warn_threshold_by_flow_iponly = 0;
 
     EngineAnalysisItemsInit(de_ctx->ea);
 
@@ -1874,6 +1876,13 @@ void EngineAnalysisRules(const DetectEngineCtx *de_ctx,
                     rule_flags = 1;
                 }
             }
+            if (sm->type == DETECT_THRESHOLD || sm->type == DETECT_DETECTION_FILTER) {
+                if ((s->type == SIG_TYPE_IPONLY) &&
+                        ((DetectThresholdData *)sm->ctx)->track == TRACK_FLOW) {
+                    warn_threshold_by_flow_iponly = 1;
+                    rule_warning += 1;
+                }
+            }
         } /* for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) */
 
     } /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */
@@ -2139,6 +2148,10 @@ void EngineAnalysisRules(const DetectEngineCtx *de_ctx,
             fprintf(fp, "    Warning: Rule requires file-store but the output file-store is not "
                         "enabled.\n");
         }
+        if (warn_threshold_by_flow_iponly) {
+            fprintf(fp, "    Warning: Rule uses threshold by_flow with an IP Only rule which "
+                        "is ineffective for higher counts.\n");
+        }
         if (rule_warning == 0) {
             fprintf(fp, "    No warnings for this rule.\n");
         }