Detect negated content absent buffer 2224 v12

[catenacyber]

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/2224 https://redmine.openinfosecfoundation.org/issues/6629 https://redmine.openinfosecfoundation.org/issues/6575

Describe changes:

• detect: negated content matches on absent buffer
• detect: adds absent keyword to match on absent buffer
• detect: unify multi-buffer code

SV_BRANCH=pr/1535

https://github.com/OISF/suricata-verify/pull/1535

#10140 for all sticky buffers

@jasonish what do you think about the template commit ?

[catenacyber]

Should I first make a PR with only the following commits ?

• detect: unify functions for multi-buffer
• detect/template: make template use DetectEngineInspectBufferGeneric

[suricata-qa]

ERROR:

ERROR: QA failed on ASAN_TLPR1_cfg.

Pipeline 18248

[catenacyber]

CI seems unhappy with my hack about functions cast...

Should I then update InspectionBufferGetDataPtr and all its users to add a new argument ?

[catenacyber]

Draft needing rebase on latest master, fixing compiler warning, and answer to the questions above

[catenacyber]

Status, to be rebased after #10462 is merged

[Koen1999]

Although I am not in depth on the technical implementation of Suricata, great work! This feature will be an amazing addition to improve the rule writing experience and allow us to write new rules that were not possible or insanely complicated before!

[catenacyber]

Although I am not in depth on the technical implementation of Suricata, great work! This feature will be an amazing addition to improve the rule writing experience and allow us to write new rules that were not possible or insanely complicated before!

Thanks @Koen1999 I appreciate your comment :-)

[suricata-qa]

ERROR:

ERROR: QA failed on ASAN_TLPR1_cfg.

Pipeline 18248

[catenacyber]

Rebased in https://github.com/OISF/suricata/pull/11159