detect/replace: support DPDK IPS mode

The replace keyword was only enabled in the NFQ and IPFW runmodes, so in
DPDK IPS mode rules with replace only alerted without modifying
packets. DPDK packets point directly to the mbuf data, so the modified
payload and the recalculated checksums are forwarded as they are.

Enable replace for the DPDK runmode when the engine runs in IPS mode.

doc/userguide/rules/payload-keywords.rst

@@ -898,7 +898,8 @@ Example of the rpc keyword in a rule:
 replace
 -------
 
-The replace content modifier can only be used in IPS. It adjusts
+The replace content modifier can only be used in IPS. It is supported
+with NFQ, IPFW and DPDK (``copy-mode: ips``). It adjusts
 network traffic.  It changes the content it follows ('abc') into
 another ('def'), see example:
 

src/detect-replace.c

@@ -27,6 +27,7 @@
  */
 
 #include "suricata-common.h"
+#include "suricata.h"
 
 #include "runmodes.h"
 
@@ -94,6 +95,11 @@ int DetectReplaceSetup(DetectEngineCtx *de_ctx, Signature *s, const char *replac
         case RUNMODE_NFQ:
         case RUNMODE_IPFW:
             break;
+        case RUNMODE_DPDK:
+            if (EngineModeIsIPS()) {
+                break;
+            }
+            // fall through
         default:
             SCLogWarning("Can't use 'replace' keyword in non IPS mode: %s", s->sig_str);
             /* this is a success, having the alert is interesting */