Builtin fast pattern matching algorithms are implemented here.

* MPSE = multi-pattern search engine
* DFA = deterministic finite automaton
* NFA = non-DFA
* HFA = hybrid FA

This code has has evolved through 4 major versions:

1.  acsmx.cc:  ac_std
2.  acsmx2.cc:  ac_full, ac_sparse, ac_banded, ac_sparse_bands
3.  bnfa_search.cc:  ac_bnfa
4.  hyperscan.cc:  support of regex fast patterns

Check the comments at the start of the above files for details on the
implementation.

NFAs require much less memory than DFAs, but DFAs are faster.  Version 1 is
a DFA.  Version 2 is either NFA or DFA and supports multiple storage
formats.  Version 3 is NFA.  Version 2 also had a TRIE based implementation
which was moved to extras.

The version 2 storage formats try to reduce memory for transition storage
by various schemes:

* full - an array of 256 transitions for each state indexed by event (byte)
* sparse - a list of valid transitions (which must be searched)
* banded - like full except that the leading and trailing invalid
  transitions are not stored
* sparse bands - a list of bands

Version 4 entails a number of refactoring changes to support regex fast
patterns using hyperscan, an HFA.  A key change is to return the offset of
the end of match the way hyperscan does to support relative matches to fast
pattern only contents and regexes.

Version 4 also includes refactoring the match queues.  The *_q flavors were
deleted as this aspect is orthogonal to the algorithm.  Instead a match
queue is always used to defer rule tree evaluation until after the full
buffer is searched in order to keep the cache warm.  This is a development
decision based on overall performance.

Note that hyperscan essentially results in single branch detection option
trees because from a client view each match state is unique - one per rule.
This is a potential negative impact on performance but does not yet seem
significant.  Furthermore, regex based fast patterns may obviate the need
for the tree.  However, the tree remains as it is essential for other
algorithms.

SearchTool makes it easy to use ac_bnfa.  This is used by http, pop, imap,
and smtp.

See "Optimizing Pattern Matching for Intrusion Detection" by Marc Norton.
Available on https://snort.org/documents/.

Reference - Efficient String matching: An Aid to Bibliographic Search
Alfred V Aho and Margaret J Corasick, Bell Laboratories
Copyright (C) 1975 Association for Computing Machinery,Inc

