Fix ip-only again: flowbit sigs were not handled correctly and tcp/udp sigs with ports set also were not.

src/detect-engine-iponly.c

@@ -348,6 +348,10 @@ void IPOnlyMatchPacket(DetectEngineCtx *de_ctx, DetectEngineIPOnlyCtx *io_ctx,
         if (s == NULL)
             continue;
 
+        /* check the protocol */
+        if (!(s->proto.proto[(p->proto/8)] & (1<<(p->proto%8))))
+            continue;
+
         /* check the source address */
         if (!(s->flags & SIG_FLAG_SRC_ANY)) {
             DetectAddressGroup *saddr = DetectAddressLookupGroup(&s->src,&p->src);

src/detect-engine-proto.c

@@ -55,7 +55,6 @@ int DetectProtoParse(DetectProto *dp, char *str) {
         proto = IPPROTO_ICMP;
         dp->proto[(proto/8)] |= 1<<(proto%8);
     } else if (strcasecmp(str,"ip") == 0) {
-        /* proto is set to 256, a special pseudo proto */
         dp->flags |= DETECT_PROTO_ANY;
         memset(&dp->proto,0xFF,sizeof(dp->proto));
     } else {

src/detect.c

@@ -620,6 +620,19 @@ void SigCleanSignatures()
  *
  */
 static int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) {
+    /* in the case of tcp/udp, only consider sigs that
+     * don't have ports set ip-only. */
+    if (!(s->proto.flags & DETECT_PROTO_ANY)) {
+        if (s->proto.proto[(IPPROTO_TCP/8)] & (1<<(IPPROTO_TCP%8)) ||
+            s->proto.proto[(IPPROTO_UDP/8)] & (1<<(IPPROTO_UDP%8))) {
+            if (!(s->flags & SIG_FLAG_SP_ANY))
+                return 0;
+
+            if (!(s->flags & SIG_FLAG_DP_ANY))
+                return 0;
+        }
+    }
+
     SigMatch *sm = s->match;
     if (sm == NULL)
         goto iponly;
@@ -637,6 +650,8 @@ static int SignatureIsIPOnly(DetectEngineCtx *de_ctx, Signature *s) {
             return 0;
         } else if (sm->type == DETECT_FLOWVAR) {
             return 0;
+        } else if (sm->type == DETECT_FLOWBITS) {
+            return 0;
         } else if (sm->type == DETECT_DSIZE) {
             return 0;
         }