Convert byte_extract keyword parser to Rust

rust/src/detect/error.rs

@@ -27,6 +27,7 @@ pub enum RuleParseError<I> {
     InvalidByteMath(String),
     InvalidIPRep(String),
     InvalidTransformBase64(String),
+    InvalidByteExtract(String),
 
     Nom(I, ErrorKind),
 }

rust/src/detect/mod.rs

@@ -17,15 +17,16 @@
 
 //! Module for rule parsing.
 
+pub mod byte_extract;
 pub mod byte_math;
 pub mod error;
 pub mod iprep;
 pub mod parser;
+pub mod requires;
 pub mod stream_size;
 pub mod transform_base64;
 pub mod uint;
 pub mod uri;
-pub mod requires;
 pub mod tojson;
 
 use crate::core::AppProto;
@@ -104,6 +105,44 @@ extern {
         de: *mut c_void, s: *mut c_void, kwid: c_int, ctx: *const c_void, bufid: c_int,
     ) -> *mut c_void;
 }
+#[repr(u8)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+// endian <big|little|dce>
+pub enum ByteEndian {
+    BigEndian = 1,
+    LittleEndian = 2,
+    EndianDCE = 3,
+}
+
+#[repr(u8)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq)]
+pub enum ByteBase {
+    BaseOct = 8,
+    BaseDec = 10,
+    BaseHex = 16,
+}
+
+fn get_string_value(value: &str) -> Option<ByteBase> {
+    let res = match value {
+        "hex" => Some(ByteBase::BaseHex),
+        "oct" => Some(ByteBase::BaseOct),
+        "dec" => Some(ByteBase::BaseDec),
+        _ => None,
+    };
+
+    res
+}
+
+fn get_endian_value(value: &str) -> Option<ByteEndian> {
+    let res = match value {
+        "big" => Some(ByteEndian::BigEndian),
+        "little" => Some(ByteEndian::LittleEndian),
+        "dce" => Some(ByteEndian::EndianDCE),
+        _ => None,
+    };
+
+    res
+}
 
 #[cfg(test)]
 mod test {