detect/bytemath: Support out of order options #7509
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR replaces the draft pr #7484.
The intent of this PR is to support arbitrary order options for
byte_math
. During the investigation phase, it was suggested that the parser be converted to Rust for simplification. Thus, the PCRE based parser forbyte_math
was removed and replaced with a Rust based parser. @jasonish's prototype rulers parser work helped guide this PR.The C unittests were retained and many were added to the Rust based parser.
Issue: 5077
Link to redmine ticket: 5077
Describe changes:
#suricata-verify-pr:
#suricata-verify-repo:
#suricata-verify-branch:
#suricata-update-pr:
#suricata-update-repo:
#suricata-update-branch:
#libhtp-pr:
#libhtp-repo:
#libhtp-branch: