Suricata

Two questions:

Why did you move all the pcre logic to detect-engine-payload.c?

What is "punt_matching"?

What is "punt_matching"?

Assuming we have 2 content based keywords which are relative, where the first one is either a pcre or content, and the second one is a pcre.

Let's assume the first keyword gives a match and we start with the second keyword now, relative to the first match. If the second keyword fails to give a match and it isn't negated, we return a 0. Now the previous keyword would start iterations for finding new matches now from it's match_offset + 1, but the fact is if I don't get a match with pcre, we'll never get a match get a match anywhere else, in which I just set a punt_matching = 1, to avoid any further iterations for new matches by the older keywords.

Two questions:

Why did you move all the pcre logic to detect-engine-payload.c?

I need to pass not just ov¹, but ov⁰ as well, from a pcre match. Also I would have to recreate the if/else logic from the payload_function again in the payload.c file, to set the punt_matching flag.