Merge pull request #1732 in SNORT/snort3 from ~RUCOMBS/snort3:rule_statez to master
Squashed commit of the following:
commit
8f66afffc52f4eecc0436d23359f2eccd3ff18f2
Author: russ <rucombs@cisco.com>
Date: Wed Sep 4 17:53:18 2019 -0400
doc: add bullets for $var parameter names and maxXX limits.
commit
ff4bca6a07a6b5446332ce0d41272b9299f08998
Author: russ <rucombs@cisco.com>
Date: Wed Sep 4 16:59:12 2019 -0400
rule_state: switch from regex parameter names to simpler parsing
Performance when loading large rule sets (20K+ rules) with regex is unacceptable.
Switch from regex to $var parameter names with name matching delegated to module.
In this case, $gid_sid is used for rule_state["1:23456"] type configurations. As
you might have guessed, $ indicates parameters with variable names.