detect: opt-in keywords for firewall mode

- tls.cert_chain_len
- datarep
- dataset
- dns.opcode

Part of
Ticket #8387

rust/src/dns/detect.rs

@@ -36,7 +36,7 @@ use suricata_sys::sys::{
     SCDetectHelperBufferProgressRegister, SCDetectHelperKeywordAliasRegister,
     SCDetectHelperKeywordRegister, SCDetectHelperMultiBufferProgressMpmRegister,
     SCDetectSignatureSetAppProto, SCSigMatchAppendSMToList, SCSigTableAppLiteElmt, SigMatchCtx,
-    Signature,
+    Signature, SIGMATCH_SUPPORT_FIREWALL,
 };
 
 /// Perform the DNS opcode match.
@@ -381,7 +381,7 @@ pub unsafe extern "C" fn SCDetectDNSRegister() {
         AppLayerTxMatch: Some(dns_opcode_match),
         Setup: Some(dns_opcode_setup),
         Free: Some(dns_opcode_free),
-        flags: SIGMATCH_INFO_UINT8,
+        flags: SIGMATCH_INFO_UINT8 | SIGMATCH_SUPPORT_FIREWALL,
     };
     G_DNS_OPCODE_KW_ID = SCDetectHelperKeywordRegister(&kw);
     G_DNS_OPCODE_BUFFER_ID = SCDetectHelperBufferProgressRegister(

src/detect-datarep.c

@@ -57,6 +57,7 @@ void DetectDatarepRegister (void)
     sigmatch_table[DETECT_DATAREP].url = "/rules/datasets.html#datarep";
     sigmatch_table[DETECT_DATAREP].Setup = DetectDatarepSetup;
     sigmatch_table[DETECT_DATAREP].Free  = DetectDatarepFree;
+    sigmatch_table[DETECT_DATAREP].flags = SIGMATCH_SUPPORT_FIREWALL;
 
     DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
 }

src/detect-dataset.c

@@ -59,6 +59,7 @@ void DetectDatasetRegister (void)
     sigmatch_table[DETECT_DATASET].url = "/rules/datasets.html#dataset";
     sigmatch_table[DETECT_DATASET].Setup = DetectDatasetSetup;
     sigmatch_table[DETECT_DATASET].Free  = DetectDatasetFree;
+    sigmatch_table[DETECT_DATASET].flags = SIGMATCH_SUPPORT_FIREWALL;
 }
 
 /*

src/detect-tls-certs.c

@@ -243,7 +243,7 @@ void DetectTlsCertChainLenRegister(void)
     sigmatch_table[KEYWORD_ID].AppLayerTxMatch = DetectTLSCertChainLenMatch;
     sigmatch_table[KEYWORD_ID].Setup = DetectTLSCertChainLenSetup;
     sigmatch_table[KEYWORD_ID].Free = DetectTLSCertChainLenFree;
-    sigmatch_table[KEYWORD_ID].flags = SIGMATCH_INFO_UINT32;
+    sigmatch_table[KEYWORD_ID].flags = SIGMATCH_SUPPORT_FIREWALL | SIGMATCH_INFO_UINT32;
 
     g_tls_cert_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
 }