support multiple ipprotos in the same sig + unittest

src/detect-ipproto.h

@@ -42,6 +42,7 @@ typedef struct DetectIPProtoData_ {
  * \brief Registration function for ip_proto keyword.
  */
 void DetectIPProtoRegister (void);
+void DetectIPProtoRemoveAllSMs(Signature *);
 
 #endif /* __DETECT_IPPROTO_H__ */
 

src/detect-parse.c

@@ -35,6 +35,7 @@
 #include "detect-content.h"
 #include "detect-uricontent.h"
 #include "detect-reference.h"
+#include "detect-ipproto.h"
 #include "detect-flow.h"
 
 #include "flow.h"
@@ -284,6 +285,22 @@ void SigMatchAppendTag(Signature *s, SigMatch *new) {
     return;
 }
 
+void SigMatchRemoveSMFromList(Signature *s, SigMatch *sm, int sm_list)
+{
+    if (sm == s->sm_lists[sm_list]) {
+        s->sm_lists[sm_list] = sm->next;
+    }
+    if (sm == s->sm_lists_tail[sm_list]) {
+        s->sm_lists_tail[sm_list] = sm->prev;
+    }
+    if (sm->prev != NULL)
+        sm->prev->next = sm->next;
+    if (sm->next != NULL)
+        sm->next->prev = sm->prev;
+
+    return;
+}
+
 /** \brief Append a sig match to the signatures non-payload match list
  *
  *  \param s signature
@@ -1046,6 +1063,8 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr, uint8_t addrs_
 
     s->sig_str = NULL;
 
+    DetectIPProtoRemoveAllSMs(s);
+
     SCReturnInt(ret);
 }
 

src/detect-parse.h

@@ -64,6 +64,7 @@ void SigMatchAppendUricontent(Signature *, SigMatch *);
 void SigMatchAppendAppLayer(Signature *, SigMatch *);
 void SigMatchAppendTag(Signature *, SigMatch *);
 void SigMatchAppendSMToList(Signature *, SigMatch *, int);
+void SigMatchRemoveSMFromList(Signature *, SigMatch *, int);
 int SigMatchListSMBelongsTo(Signature *, SigMatch *);
 
 int DetectParseDupSigHashInit(DetectEngineCtx *);