Threshold flow/v7

[victorjulien]

SV_BRANCH=https://github.com/OISF/suricata-verify/pull/1788

Replaces https://github.com/OISF/suricata/pull/10632

• rebase
• ticket link for minor todo (https://redmine.openinfosecfoundation.org/issues/6855)
• add support for detection_filter as well

https://redmine.openinfosecfoundation.org/issues/6822

[codecov[bot]]

Codecov Report

Attention: Patch coverage is 94.93671% with 4 lines in your changes are missing coverage. Please review.

Project coverage is 83.06%. Comparing base (2b4e102) to head (c74f901). Report is 101 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #10910      +/-   ##
==========================================
+ Coverage   77.64%   83.06%   +5.42%     
==========================================
  Files         922      924       +2     
  Lines      247806   263260   +15454     
==========================================
+ Hits       192400   218670   +26270     
+ Misses      55406    44590   -10816     

Flag	Coverage Δ
fuzzcorpus	64.68% <24.28%> (?)
suricata-verify	62.45% <91.30%> (+0.02%)	:arrow_up:
unittests	62.76% <39.24%> (+0.55%)	:arrow_up:

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 20169

[catenacyber]

What is the relationship with #10925 ?

They look like conflicting at least for src/detect-engine-threshold.c

So, which one should get first ?

[victorjulien]

What is the relationship with #10925 ?

They look like conflicting at least for src/detect-engine-threshold.c

So, which one should get first ?

Doesn't matter, I'll have to rebase the other one first. But will wait for a proper review regardless.

[catenacyber]

Ok, will pick one for review next time

[victorjulien]

Btw I see no conflict here or locally.

[catenacyber]

I get a conflict when merging both PRs

[victorjulien]

I get a conflict when merging both PRs

They are independent, I'll deconflict them after one gets merged.

[victorjulien]

replaced by #11029