detect: allow banning kw from td in firewall mode

In case a keyword should work in firewall mode, with firewall rules
only. The engine errors out if threat detection rules use the given keyword.

Part of
Ticket #9041

rust/sys/src/sys.rs

@@ -25,6 +25,7 @@ pub const SIGMATCH_STATEFUL: u32 = 8388608;
 pub const SIGMATCH_INFO_BITFLAGS_UINT: u32 = 1048576;
 pub const SIGMATCH_BAN_FIREWALL_RULE: u32 = 2097152;
 pub const SIGMATCH_BAN_FIREWALL_MODE: u32 = 4194304;
+pub const SIGMATCH_BAN_TD_FIREWALL_MODE: u32 = 16777216;
 pub type __intmax_t = ::std::os::raw::c_long;
 pub type intmax_t = __intmax_t;
 #[repr(u32)]

src/detect-engine-register.c

@@ -341,6 +341,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("not supported in firewall mode");
         prev = 1;
     }
+    if (flags & SIGMATCH_BAN_TD_FIREWALL_MODE) {
+        if (prev == 1)
+            printf("%c", sep);
+        printf("not supported in threat detection rules in firewall mode");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);

src/detect-engine-register.h

@@ -360,6 +360,8 @@ extern int DETECT_TBLSIZE_IDX;
 #define SIGMATCH_BAN_FIREWALL_RULE (1UL << (21))
 /** keyword cannot be used in firewall mode */
 #define SIGMATCH_BAN_FIREWALL_MODE (1UL << (22))
+/** keyword cannot be used in td rules with firewall mode */
+#define SIGMATCH_BAN_TD_FIREWALL_MODE (1UL << (24))
 
 int SigTableList(const char *keyword);
 void SigTableCleanup(void);

src/detect-parse.c

@@ -1015,6 +1015,13 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
         goto error;
     }
 
+    /* For non-firewall rules */
+    if (EngineModeIsFirewall() && !s->init_data->firewall_rule &&
+            (st->flags & SIGMATCH_BAN_TD_FIREWALL_MODE) != 0) {
+        SCLogError("keyword \'%s\' is not supported in threat detection rules with firewall mode",
+                optname);
+        goto error;
+    }
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */