Flow bytes pkts syntax/v3

[inashivb]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/5646

SV_BRANCH=OISF/suricata-verify#2079

1. Syntax comparisons:

master	This PR
flow.pkts_toclient	flow.pkts:toclient
flow.pkts_toserver	flow.pkts:toserver
flow.bytes_toserver	flow.bytes:toserver
flow.bytes_toclient	flow.bytes:toclient
-	flow.pkts:either
-	flow.bytes:either

2. Code advantages shared in the commit message of ac9c5d2

Previous PR: #11653
Changes since v1:

• rebased and made PR description clearer so difference is easy to see as asked

Known issues:

1. Doc update hasn't been done yet.
2. Prefilter fn has not been updated yet so it may not work as intended.
3. Tests for the parsing of arguments need to be done.

[codecov]

Codecov Report

Attention: Patch coverage is 82.40000% with 22 lines in your changes missing coverage. Please review.

Project coverage is 82.60%. Comparing base (3f0512e) to head (e68868b).
Report is 5 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11889      +/-   ##
==========================================
- Coverage   82.61%   82.60%   -0.01%     
==========================================
  Files         912      912              
  Lines      249354   249375      +21     
==========================================
+ Hits       205992   206008      +16     
- Misses      43362    43367       +5     

Flag	Coverage Δ
fuzzcorpus	60.59% <12.80%> (-0.04%)	⬇️
livemode	18.83% <12.80%> (-0.02%)	⬇️
pcap	44.05% <12.80%> (-0.04%)	⬇️
suricata-verify	62.02% <82.40%> (+0.02%)	⬆️
unittests	58.92% <12.80%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 23002

[victorjulien]

detect-flow-pkts.c:44:17: warning: The left operand of '==' is a garbage value [core.UndefinedBinaryOperatorResult]
   44 |     if (df->dir == DETECT_FLOW_TO_SERVER) {
      |         ~~~~~~~ ^
1 warning generated.

[victorjulien]

The existing keywords map 1:1 to the flow.bytes_toclient and friends fields from the eve record. Wonder if we should keep them as is.

[inashivb]

The existing keywords map 1:1 to the flow.bytes_toclient and friends fields from the eve record. Wonder if we should keep them as is.

Do you mean keep the rule language as-is? Sure! I just need a verdict on this so I can implement the either option as is better suited. :)