Baris

I guess [this](https://github.com/OISF/suricata/blob/master/src/detect-tls-sni.c) could be taken as an inspiration to how this parsing could be implemented. As far as I can say, looking at the code, the tls.sni parsing take...

* number 1 That's why suricata uses 2 step checking: a quick filtering step (mpm) and then a precise matching step. * The points 2 and 3 point to considerations...