detect/parse: allow banning keywords with fw mode

Related to
Ticket #8551

src/detect-engine-register.c

@@ -337,6 +337,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("banned from firewall rules");
         prev = 1;
     }
+    if (flags & SIGMATCH_BAN_FIREWALL_MODE) {
+        if (prev == 1)
+            printf("%c", sep);
+        printf("banned from firewall mode");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);

src/detect-engine-register.h

@@ -352,6 +352,8 @@ extern int DETECT_TBLSIZE_IDX;
 #define SIGMATCH_INFO_BITFLAGS_UINT (1UL << (20))
 /** keyword cannot be used in firewall rules */
 #define SIGMATCH_BAN_FIREWALL_RULE (1UL << (21))
+/** keyword cannot be used in firewall mode */
+#define SIGMATCH_BAN_FIREWALL_MODE (1UL << (22))
 
 int SigTableList(const char *keyword);
 void SigTableCleanup(void);

src/detect-parse.c

@@ -973,6 +973,11 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
         goto error;
     }
 
+    if (EngineModeIsFirewall() && (st->flags & SIGMATCH_BAN_FIREWALL_MODE) != 0) {
+        SCLogError("keyword \'%s\' is not allowed in firewall mode", optname);
+        goto error;
+    }
+
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */