/src/suricata/rust/src/detect/float.rs

Source
/* Copyright (C) 2025 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

use nom8::{
    branch::alt,
    bytes::complete::{is_a, tag, tag_no_case, take_while},
    character::complete::{char, digit1},
    combinator::{all_consuming, map, map_opt, opt, recognize, value, verify},
    error::{make_error, ErrorKind},
    Err, IResult, Parser,
};

use num::traits::float::FloatCore;
use num::traits::{FromPrimitive, ToPrimitive};
use num::Bounded;

use std::ffi::CStr;

#[derive(PartialEq, Eq, Clone, Debug)]
#[repr(u8)]
pub enum DetectFloatMode {
    DetectFloatModeEqual,
    DetectFloatModeLt,
    DetectFloatModeLte,
    DetectFloatModeGt,
    DetectFloatModeGte,
    DetectFloatModeRange,
    DetectFloatModeNe,
    DetectFloatModeNegRg,
}

#[derive(Debug, PartialEq)]
#[repr(C)]
pub struct DetectFloatData<T> {
    pub arg1: T,
    pub arg2: T,
    pub mode: DetectFloatMode,
}

impl<T: Default> Default for DetectFloatData<T> {
    fn default() -> Self {
        Self {
            arg1: T::default(),
            arg2: T::default(),
            mode: DetectFloatMode::DetectFloatModeEqual,
        }
    }
}

pub trait DetectFloatType:
    FromPrimitive + ToPrimitive + std::str::FromStr + Bounded + PartialOrd + FloatCore + Sized
{
    fn from_str(s: &str) -> Option<Self>;
}

impl<T> DetectFloatType for T
where
    T: FromPrimitive + ToPrimitive + std::str::FromStr + Bounded + PartialOrd + FloatCore,
{
    fn from_str(s: &str) -> Option<Self> {
        s.parse().ok()
    }
}

pub fn parse_float_value<T: DetectFloatType>(input: &str) -> IResult<&str, T> {
    alt((
        // Handle special cases first
        map(tag_no_case("NaN"), |_| {
            <T as DetectFloatType>::from_str("NaN").unwrap()
        }),
        map(tag_no_case("+inf"), |_| {
            <T as DetectFloatType>::from_str("inf").unwrap()
        }),
        map(tag_no_case("inf"), |_| {
            <T as DetectFloatType>::from_str("inf").unwrap()
        }),
        map(tag_no_case("-inf"), |_| {
            <T as DetectFloatType>::from_str("-inf").unwrap()
        }),
        // Handle numeric parsing, including scientific notation
        map_opt(
            recognize((
                opt(alt((tag("+"), tag("-")))), // Handle optional signs
                alt((digit1, recognize((tag("."), digit1)))), // Handle integers & `.5`
                opt((tag("."), digit1)), // Handle decimals like `5.`
                opt((
                    tag_no_case("e"),
                    opt(alt((tag("+"), tag("-")))),
                    digit1,
                )), // Handle `1e10`, `-1e-5`
            )),
            |float_str: &str| <T as DetectFloatType>::from_str(float_str),
        ),
    )).parse(input)
}
fn detect_parse_float_start_equal<T: DetectFloatType>(
    i: &str,
) -> IResult<&str, DetectFloatData<T>> {
    let (i, _) = opt(tag("=")).parse(i)?;
    let (i, _) = opt(is_a(" ")).parse(i)?;
    let (i, arg1) = parse_float_value::<T>(i)?;
    Ok((
        i,
        DetectFloatData {
            arg1,
            arg2: <T as FloatCore>::min_value(),
            mode: DetectFloatMode::DetectFloatModeEqual,
        },
    ))
}

pub fn detect_parse_float_start_interval<T: DetectFloatType>(
    i: &str,
) -> IResult<&str, DetectFloatData<T>> {
    let (i, neg) = opt(char('!')).parse(i)?;
    let (i, arg1) = parse_float_value::<T>(i)?;
    let (i, _) = opt(is_a(" ")).parse(i)?;
    let (i, _) = alt((tag("-"), tag("<>"))).parse(i)?;
    let (i, _) = opt(is_a(" ")).parse(i)?;
    let (i, arg2) = verify(parse_float_value::<T>, |x| {
        *x > arg1 && *x - arg1 > <T as FloatCore>::epsilon()
    }).parse(i)?;
    let mode = if neg.is_some() {
        DetectFloatMode::DetectFloatModeNegRg
    } else {
        DetectFloatMode::DetectFloatModeRange
    };
    Ok((i, DetectFloatData { arg1, arg2, mode }))
}

fn detect_parse_float_mode(i: &str) -> IResult<&str, DetectFloatMode> {
    let (i, mode) = alt((
        value(DetectFloatMode::DetectFloatModeGte, tag(">=")),
        value(DetectFloatMode::DetectFloatModeLte, tag("<=")),
        value(DetectFloatMode::DetectFloatModeGt, tag(">")),
        value(DetectFloatMode::DetectFloatModeLt, tag("<")),
        value(DetectFloatMode::DetectFloatModeNe, tag("!=")),
        value(DetectFloatMode::DetectFloatModeEqual, tag("=")),
    )).parse(i)?;
    Ok((i, mode))
}

fn detect_parse_float_start_symbol<T: DetectFloatType>(
    i: &str,
) -> IResult<&str, DetectFloatData<T>> {
    let (i, mode) = detect_parse_float_mode(i)?;
    let (i, _) = opt(is_a(" ")).parse(i)?;
    let (i, arg1) = parse_float_value::<T>(i)?;

    match mode {
        DetectFloatMode::DetectFloatModeNe => {}
        DetectFloatMode::DetectFloatModeLt => {
            if arg1 == <T as FloatCore>::min_value() {
                return Err(Err::Error(make_error(i, ErrorKind::Verify)));
            }
        }
        DetectFloatMode::DetectFloatModeLte => {
            if arg1 == <T as FloatCore>::max_value() {
                return Err(Err::Error(make_error(i, ErrorKind::Verify)));
            }
        }
        DetectFloatMode::DetectFloatModeGt => {
            if arg1 == <T as FloatCore>::max_value() {
                return Err(Err::Error(make_error(i, ErrorKind::Verify)));
            }
        }
        DetectFloatMode::DetectFloatModeGte => {
            if arg1 == <T as FloatCore>::min_value() {
                return Err(Err::Error(make_error(i, ErrorKind::Verify)));
            }
        }
        _ => {
            return Err(Err::Error(make_error(i, ErrorKind::MapOpt)));
        }
    }

    Ok((
        i,
        DetectFloatData {
            arg1,
            arg2: <T as FloatCore>::min_value(),
            mode,
        },
    ))
}

pub fn detect_match_float<T: DetectFloatType>(x: &DetectFloatData<T>, val: T) -> bool {
    match x.mode {
        DetectFloatMode::DetectFloatModeEqual => val == x.arg1,
        DetectFloatMode::DetectFloatModeNe => val != x.arg1,
        DetectFloatMode::DetectFloatModeLt => val < x.arg1,
        DetectFloatMode::DetectFloatModeLte => val <= x.arg1,
        DetectFloatMode::DetectFloatModeGt => val > x.arg1,
        DetectFloatMode::DetectFloatModeGte => val >= x.arg1,
        DetectFloatMode::DetectFloatModeRange => val > x.arg1 && val < x.arg2,
        DetectFloatMode::DetectFloatModeNegRg => val <= x.arg1 || val >= x.arg2,
    }
}

pub fn detect_parse_float<T: DetectFloatType>(i: &str) -> IResult<&str, DetectFloatData<T>> {
    let (i, float) = detect_parse_float_notending(i)?;
    let (i, _) = all_consuming(take_while(|c| c == ' ')).parse(i)?;
    Ok((i, float))
}

fn detect_parse_float_notending<T: DetectFloatType>(i: &str) -> IResult<&str, DetectFloatData<T>> {
    let (i, _) = opt(is_a(" ")).parse(i)?;
    let (i, float) = alt((
        detect_parse_float_start_interval,
        detect_parse_float_start_equal,
        detect_parse_float_start_symbol,
    )).parse(i)?;
    Ok((i, float))
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectF64Parse(
    ustr: *const std::os::raw::c_char,
) -> *mut DetectFloatData<f64> {
    let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
    if let Ok(s) = ft_name.to_str() {
        if let Ok((_, ctx)) = detect_parse_float::<f64>(s) {
            let boxed = Box::new(ctx);
            return Box::into_raw(boxed) as *mut _;
        }
    }
    return std::ptr::null_mut();
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectF64Match(
    arg: f64, ctx: &DetectFloatData<f64>,
) -> std::os::raw::c_int {
    if detect_match_float::<f64>(ctx, arg) {
        return 1;
    }
    return 0;
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectF64Free(ctx: &mut DetectFloatData<f64>) {
    // Just unbox...
    std::mem::drop(Box::from_raw(ctx));
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectParseF64(
    ustr: *const std::os::raw::c_char,
) -> *mut DetectFloatData<f64> {
    let ft_name: &CStr = CStr::from_ptr(ustr);
    if let Ok(s) = ft_name.to_str() {
        if let Ok((_, ctx)) = detect_parse_float::<f64>(s) {
            let boxed = Box::new(ctx);
            return Box::into_raw(boxed);
        }
    }
    std::ptr::null_mut()
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectMatchF64(
    arg: f64, ctx: &DetectFloatData<f64>,
) -> std::os::raw::c_int {
    if detect_match_float(ctx, arg) {
        1
    } else {
        0
    }
}

#[no_mangle]
pub unsafe extern "C" fn SCDetectFreeF64(ctx: *mut DetectFloatData<f64>) {
    std::mem::drop(Box::from_raw(ctx));
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::ffi::CString;

    #[test]
    fn test_parse_float_value() {
        assert!(parse_float_value::<f64>("NaN").is_ok());
        assert!(parse_float_value::<f64>("-inf").is_ok());
        assert!(parse_float_value::<f64>("inf").is_ok());
        assert!(parse_float_value::<f64>("+inf").is_ok());
        assert!(parse_float_value::<f64>("123.45").is_ok());
        assert!(parse_float_value::<f64>("-0.001").is_ok());
        assert!(parse_float_value::<f64>("1e10").is_ok());
        assert!(parse_float_value::<f64>("-1e-10").is_ok());
        assert!(parse_float_value::<f64>("0.5").is_ok());
        assert!(parse_float_value::<f64>("5.").is_ok());
        assert!(parse_float_value::<f64>("0+").is_ok());
        assert!(parse_float_value::<f64>("0-").is_ok());
        assert!(parse_float_value::<f32>("NaN").is_ok());
        assert!(parse_float_value::<f32>("-inf").is_ok());
        assert!(parse_float_value::<f32>("inf").is_ok());
        assert!(parse_float_value::<f32>("+inf").is_ok());
        assert!(parse_float_value::<f32>("123.45").is_ok());
        assert!(parse_float_value::<f32>("-0.001").is_ok());
        assert!(parse_float_value::<f32>("1e10").is_ok());
        assert!(parse_float_value::<f32>("-1e-10").is_ok());
        assert!(parse_float_value::<f32>("0.5").is_ok());
        assert!(parse_float_value::<f32>("5.").is_ok());
        assert!(parse_float_value::<f32>("0+").is_ok());
        assert!(parse_float_value::<f32>("0-").is_ok());

        assert!(parse_float_value::<f32>(".e10").is_err());
    }
    #[test]
    fn test_detect_parse_valid() {
        let _ = do_parse("1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
        let _ = do_parse(">1.0", 1.0, DetectFloatMode::DetectFloatModeGt);
        let _ = do_parse(">=1.0", 1.0, DetectFloatMode::DetectFloatModeGte);
        let _ = do_parse("<1.0", 1.0, DetectFloatMode::DetectFloatModeLt);
        let _ = do_parse("<=1.0", 1.0, DetectFloatMode::DetectFloatModeLte);
        let _ = do_parse("=1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
        let _ = do_parse("!=1.0", 1.0, DetectFloatMode::DetectFloatModeNe);
        let _ = do_parse_mult_args(
            "37.0-42.0",
            37.0,
            42.0,
            DetectFloatMode::DetectFloatModeRange,
        );
    }

    #[test]
    fn test_detect_parse_invalid() {
        assert!(detect_parse_float::<f64>("suricata").is_err());

        // range should be <lower-val> - <higher-val>
        assert!(detect_parse_float::<f64>("42-37").is_err());

        assert!(detect_parse_float::<f64>("< suricata").is_err());
        assert!(detect_parse_float::<f64>("<= suricata").is_err());
        assert!(detect_parse_float::<f64>("= suricata").is_err());
        assert!(detect_parse_float::<f64>("> suricata").is_err());
        assert!(detect_parse_float::<f64>(">= suricata").is_err());
        assert!(detect_parse_float::<f64>("! suricata").is_err());
        assert!(detect_parse_float::<f64>("!= suricata").is_err());
    }

    fn do_parse<T: DetectFloatType + std::fmt::Display>(
        val: &str, fval: T, mode: DetectFloatMode,
    ) -> DetectFloatData<T> {
        let str_val = format!("{:.3}", fval);
        let (_, val) = detect_parse_float::<T>(val).unwrap();
        let str_arg1 = format!("{:.3}", val.arg1);
        assert_eq!(str_arg1, str_val);
        assert_eq!(val.mode, mode);
        val
    }

    fn do_parse_mult_args<T: DetectFloatType + std::fmt::Display>(
        val: &str, fval1: T, fval2: T, mode: DetectFloatMode,
    ) -> DetectFloatData<T> {
        let str_val = format!("{:.3}", fval1);
        let (_, val) = detect_parse_float::<T>(val).unwrap();
        let str_arg = format!("{:.3}", val.arg1);
        assert_eq!(str_arg, str_val);
        let str_val = format!("{:.3}", fval2);
        let str_arg = format!("{:.3}", val.arg2);
        assert_eq!(str_arg, str_val);
        assert_eq!(val.mode, mode);
        val
    }

    #[test]
    fn test_detect_match_valid() {
        let val = do_parse("= 1.264", 1.264, DetectFloatMode::DetectFloatModeEqual);
        assert!(detect_match_float(&val, 1.264));

        let val = do_parse("> 1.0", 1.0, DetectFloatMode::DetectFloatModeGt);
        assert!(detect_match_float(&val, 1.1));
        assert!(!detect_match_float(&val, 1.0));

        let val = do_parse(">= 1.0", 1.0, DetectFloatMode::DetectFloatModeGte);
        assert!(detect_match_float(&val, 1.0));
        assert!(detect_match_float(&val, 1.5));
        assert!(!detect_match_float(&val, 0.5));

        let val = do_parse("<= 1.0", 1.0, DetectFloatMode::DetectFloatModeLte);
        assert!(detect_match_float(&val, 1.0));
        assert!(detect_match_float(&val, 0.5));
        assert!(!detect_match_float(&val, 1.5));

        let val = do_parse("< 1.0", 1.0, DetectFloatMode::DetectFloatModeLt);
        assert!(detect_match_float(&val, 0.9));
        assert!(!detect_match_float(&val, 1.0));

        let val = do_parse("= 1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
        assert!(detect_match_float(&val, 1.0));
        assert!(!detect_match_float(&val, 0.9));
        assert!(!detect_match_float(&val, 1.1));

        let val = do_parse("!= 1.0", 1.0, DetectFloatMode::DetectFloatModeNe);
        assert!(detect_match_float(&val, 0.9));
        assert!(detect_match_float(&val, 1.1));
        assert!(!detect_match_float(&val, 1.0));

        let val = do_parse_mult_args(
            "37.0-42.0",
            37.0,
            42.0,
            DetectFloatMode::DetectFloatModeRange,
        );
        assert!(detect_match_float(&val, 37.1));
        assert!(detect_match_float(&val, 41.9));
        assert!(!detect_match_float(&val, 35.0));
        assert!(!detect_match_float(&val, 43.0));

        let val = do_parse_mult_args(
            "!37.0-42.0",
            37.0,
            42.0,
            DetectFloatMode::DetectFloatModeNegRg,
        );
        assert!(detect_match_float(&val, 37.0));
        assert!(detect_match_float(&val, 42.0));
        assert!(detect_match_float(&val, 35.0));
        assert!(detect_match_float(&val, 43.0));
        assert!(!detect_match_float(&val, 37.1));
        assert!(!detect_match_float(&val, 41.9));
    }

    fn do_match_test(val: &str, arg1: f64, arg1_cmp: f64, arg2: f64, mode: DetectFloatMode) {
        let c_string = CString::new(val).expect("CString::new failed");
        unsafe {
            let val = SCDetectF64Parse(c_string.as_ptr());
            let str_arg_a = format!("{:.3}", (*val).arg1);
            let str_arg_b = format!("{:.3}", arg1);
            assert_eq!(str_arg_a, str_arg_b);
            let str_arg_a = format!("{:.3}", (*val).arg2);
            let str_arg_b = format!("{:.3}", arg2);
            assert_eq!(str_arg_a, str_arg_b);

            assert_eq!((*val).mode, mode);
            assert_eq!(1, SCDetectF64Match(arg1_cmp, &*val));
        }
    }

    fn do_match_test_arg1(val: &str, arg1: f64, arg1_cmp: f64, mode: DetectFloatMode) {
        do_match_test(val, arg1, arg1_cmp, FloatCore::min_value(), mode);
    }

    fn do_parse_test(val: &str, arg1: f64, arg2: f64, mode: DetectFloatMode) {
        let c_string = CString::new(val).expect("CString::new failed");
        unsafe {
            let val = SCDetectF64Parse(c_string.as_ptr());
            let str_arg_a = format!("{:.3}", (*val).arg1);
            let str_arg_b = format!("{:.3}", arg1);
            assert_eq!(str_arg_a, str_arg_b);
            let str_arg_a = format!("{:.3}", (*val).arg2);
            let str_arg_b = format!("{:.3}", arg2);
            assert_eq!(str_arg_a, str_arg_b);

            assert_eq!((*val).mode, mode);
        }
    }

    fn do_parse_test_arg1(val: &str, arg1: f64, mode: DetectFloatMode) {
        do_parse_test(val, arg1, FloatCore::min_value(), mode);
    }

    #[test]
    fn test_ffi_detect_match_valid() {
        do_match_test_arg1("1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeEqual);
        do_match_test_arg1("> 1.0", 1.0, 1.1, DetectFloatMode::DetectFloatModeGt);
        do_match_test_arg1(">= 1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeGte);
        do_match_test_arg1("<= 1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeLte);
        do_match_test_arg1("< 1.0", 1.0, 0.9, DetectFloatMode::DetectFloatModeLt);
        do_match_test_arg1("= 1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeEqual);
        do_match_test_arg1("!= 1.0", 1.0, 1.1, DetectFloatMode::DetectFloatModeNe);
        do_match_test(
            "37.0-42.0",
            37.0,
            37.1,
            42.0,
            DetectFloatMode::DetectFloatModeRange,
        );
        do_match_test(
            "37.0-42.0",
            37.0,
            41.9,
            42.0,
            DetectFloatMode::DetectFloatModeRange,
        );
        do_match_test_arg1(
            ">= 4.15",
            4.15,
            4.150007324019584,
            DetectFloatMode::DetectFloatModeGte,
        );
        do_match_test_arg1(
            "> 4.15",
            4.15,
            4.150007324019584,
            DetectFloatMode::DetectFloatModeGt,
        );
    }

    #[test]
    fn test_ffi_detect_parse_valid() {
        do_parse_test_arg1("1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
        do_parse_test_arg1("> 1.0", 1.0, DetectFloatMode::DetectFloatModeGt);
        do_parse_test_arg1(">= 1.0", 1.0, DetectFloatMode::DetectFloatModeGte);
        do_parse_test_arg1("<= 1.0", 1.0, DetectFloatMode::DetectFloatModeLte);
        do_parse_test_arg1("< 1.0", 1.0, DetectFloatMode::DetectFloatModeLt);
        do_parse_test_arg1("= 1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
        do_parse_test_arg1("!= 1.0", 1.0, DetectFloatMode::DetectFloatModeNe);
        do_parse_test(
            "37.0-42.0",
            37.0,
            42.0,
            DetectFloatMode::DetectFloatModeRange,
        );
    }
}

Coverage Report

Created: 2026-02-14 06:42

Line	Count	Source
1		/* Copyright (C) 2025 Open Information Security Foundation
2		*
3		* You can copy, redistribute or modify this Program under the terms of
4		* the GNU General Public License version 2 as published by the Free
5		* Software Foundation.
6		*
7		* This program is distributed in the hope that it will be useful,
8		* but WITHOUT ANY WARRANTY; without even the implied warranty of
9		* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10		* GNU General Public License for more details.
11		*
12		* You should have received a copy of the GNU General Public License
13		* version 2 along with this program; if not, write to the Free Software
14		* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15		* 02110-1301, USA.
16		*/
17
18		use nom8::{
19		branch::alt,
20		bytes::complete::{is_a, tag, tag_no_case, take_while},
21		character::complete::{char, digit1},
22		combinator::{all_consuming, map, map_opt, opt, recognize, value, verify},
23		error::{make_error, ErrorKind},
24		Err, IResult, Parser,
25		};
26
27		use num::traits::float::FloatCore;
28		use num::traits::{FromPrimitive, ToPrimitive};
29		use num::Bounded;
30
31		use std::ffi::CStr;
32
33		#[derive(PartialEq, Eq, Clone, Debug)]
34		#[repr(u8)]
35		pub enum DetectFloatMode {
36		DetectFloatModeEqual,
37		DetectFloatModeLt,
38		DetectFloatModeLte,
39		DetectFloatModeGt,
40		DetectFloatModeGte,
41		DetectFloatModeRange,
42		DetectFloatModeNe,
43		DetectFloatModeNegRg,
44		}
45
46		#[derive(Debug, PartialEq)]
47		#[repr(C)]
48		pub struct DetectFloatData<T> {
49		pub arg1: T,
50		pub arg2: T,
51		pub mode: DetectFloatMode,
52		}
53
54		impl<T: Default> Default for DetectFloatData<T> {
55	1.94k	fn default() -> Self {
56	1.94k	Self {
57	1.94k	arg1: T::default(),
58	1.94k	arg2: T::default(),
59	1.94k	mode: DetectFloatMode::DetectFloatModeEqual,
60	1.94k	}
61	1.94k	}
62		}
63
64		pub trait DetectFloatType:
65		FromPrimitive + ToPrimitive + std::str::FromStr + Bounded + PartialOrd + FloatCore + Sized
66		{
67		fn from_str(s: &str) -> Option<Self>;
68		}
69
70		impl<T> DetectFloatType for T
71		where
72		T: FromPrimitive + ToPrimitive + std::str::FromStr + Bounded + PartialOrd + FloatCore,
73		{
74	3.73k	fn from_str(s: &str) -> Option<Self> {
75	3.73k	s.parse().ok()
76	3.73k	}
77		}
78
79	3.90k	pub fn parse_float_value<T: DetectFloatType>(input: &str) -> IResult<&str, T> {
80	3.90k	alt((
81		// Handle special cases first
82	3.90k	map(tag_no_case("NaN"), \|_\| {
83	4	<T as DetectFloatType>::from_str("NaN").unwrap()
84	4	}),
85	3.90k	map(tag_no_case("+inf"), \|_\| {
86	9	<T as DetectFloatType>::from_str("inf").unwrap()
87	9	}),
88	3.90k	map(tag_no_case("inf"), \|_\| {
89	18	<T as DetectFloatType>::from_str("inf").unwrap()
90	18	}),
91	3.90k	map(tag_no_case("-inf"), \|_\| {
92	7	<T as DetectFloatType>::from_str("-inf").unwrap()
93	7	}),
94		// Handle numeric parsing, including scientific notation
95	3.90k	map_opt(
96	3.90k	recognize((
97	3.90k	opt(alt((tag("+"), tag("-")))), // Handle optional signs
98	3.90k	alt((digit1, recognize((tag("."), digit1)))), // Handle integers & `.5`
99	3.90k	opt((tag("."), digit1)), // Handle decimals like `5.`
100	3.90k	opt((
101	3.90k	tag_no_case("e"),
102	3.90k	opt(alt((tag("+"), tag("-")))),
103	3.90k	digit1,
104	3.90k	)), // Handle `1e10`, `-1e-5`
105	3.90k	)),
106	3.70k	\|float_str: &str\| <T as DetectFloatType>::from_str(float_str),
107		),
108	3.90k	)).parse(input)
109	3.90k	}
110	739	fn detect_parse_float_start_equal<T: DetectFloatType>(
111	739	i: &str,
112	739	) -> IResult<&str, DetectFloatData<T>> {
113	739	let (i, _) = opt(tag("=")).parse(i)?;
114	739	let (i, _) = opt(is_a(" ")).parse(i)?;
115	739	let (i, arg1) = parse_float_value::<T>(i)?;
116	663	Ok((
117	663	i,
118	663	DetectFloatData {
119	663	arg1,
120	663	arg2: <T as FloatCore>::min_value(),
121	663	mode: DetectFloatMode::DetectFloatModeEqual,
122	663	},
123	663	))
124	739	}
125
126	1.91k	pub fn detect_parse_float_start_interval<T: DetectFloatType>(
127	1.91k	i: &str,
128	1.91k	) -> IResult<&str, DetectFloatData<T>> {
129	1.91k	let (i, neg) = opt(char('!')).parse(i)?;
130	1.91k	let (i, arg1) = parse_float_value::<T>(i)?;
131	1.84k	let (i, _) = opt(is_a(" ")).parse(i)?;
132	1.84k	let (i, _) = alt((tag("-"), tag("<>"))).parse(i)?;
133	1.19k	let (i, _) = opt(is_a(" ")).parse(i)?;
134	1.19k	let (i, arg2) = verify(parse_float_value::<T>, \|x\| {
135	1.18k	x > arg1 && x - arg1 > <T as FloatCore>::epsilon()
136	1.19k	}).parse(i)?;
137	1.17k	let mode = if neg.is_some() {
138	12	DetectFloatMode::DetectFloatModeNegRg
139		} else {
140	1.16k	DetectFloatMode::DetectFloatModeRange
141		};
142	1.17k	Ok((i, DetectFloatData { arg1, arg2, mode }))
143	1.91k	}
144
145	76	fn detect_parse_float_mode(i: &str) -> IResult<&str, DetectFloatMode> {
146	76	let (i, mode) = alt((
147	76	value(DetectFloatMode::DetectFloatModeGte, tag(">=")),
148	76	value(DetectFloatMode::DetectFloatModeLte, tag("<=")),
149	76	value(DetectFloatMode::DetectFloatModeGt, tag(">")),
150	76	value(DetectFloatMode::DetectFloatModeLt, tag("<")),
151	76	value(DetectFloatMode::DetectFloatModeNe, tag("!=")),
152	76	value(DetectFloatMode::DetectFloatModeEqual, tag("=")),
153	76	)).parse(i)?;
154	57	Ok((i, mode))
155	76	}
156
157	76	fn detect_parse_float_start_symbol<T: DetectFloatType>(
158	76	i: &str,
159	76	) -> IResult<&str, DetectFloatData<T>> {
160	76	let (i, mode) = detect_parse_float_mode(i)?;
161	57	let (i, _) = opt(is_a(" ")).parse(i)?;
162	57	let (i, arg1) = parse_float_value::<T>(i)?;
163
164	47	match mode {
165	3	DetectFloatMode::DetectFloatModeNe => {}
166		DetectFloatMode::DetectFloatModeLt => {
167	8	if arg1 == <T as FloatCore>::min_value() {
168	0	return Err(Err::Error(make_error(i, ErrorKind::Verify)));
169	8	}
170		}
171		DetectFloatMode::DetectFloatModeLte => {
172	3	if arg1 == <T as FloatCore>::max_value() {
173	0	return Err(Err::Error(make_error(i, ErrorKind::Verify)));
174	3	}
175		}
176		DetectFloatMode::DetectFloatModeGt => {
177	16	if arg1 == <T as FloatCore>::max_value() {
178	0	return Err(Err::Error(make_error(i, ErrorKind::Verify)));
179	16	}
180		}
181		DetectFloatMode::DetectFloatModeGte => {
182	17	if arg1 == <T as FloatCore>::min_value() {
183	0	return Err(Err::Error(make_error(i, ErrorKind::Verify)));
184	17	}
185		}
186		_ => {
187	0	return Err(Err::Error(make_error(i, ErrorKind::MapOpt)));
188		}
189		}
190
191	47	Ok((
192	47	i,
193	47	DetectFloatData {
194	47	arg1,
195	47	arg2: <T as FloatCore>::min_value(),
196	47	mode,
197	47	},
198	47	))
199	76	}
200
201	856	pub fn detect_match_float<T: DetectFloatType>(x: &DetectFloatData<T>, val: T) -> bool {
202	856	match x.mode {
203	1	DetectFloatMode::DetectFloatModeEqual => val == x.arg1,
204	1	DetectFloatMode::DetectFloatModeNe => val != x.arg1,
205	1	DetectFloatMode::DetectFloatModeLt => val < x.arg1,
206	0	DetectFloatMode::DetectFloatModeLte => val <= x.arg1,
207	3	DetectFloatMode::DetectFloatModeGt => val > x.arg1,
208	848	DetectFloatMode::DetectFloatModeGte => val >= x.arg1,
209	1	DetectFloatMode::DetectFloatModeRange => val > x.arg1 && val < x.arg2,
210	1	DetectFloatMode::DetectFloatModeNegRg => val <= x.arg1 \|\| val >= x.arg2,
211		}
212	856	}
213
214	1.91k	pub fn detect_parse_float<T: DetectFloatType>(i: &str) -> IResult<&str, DetectFloatData<T>> {
215	1.91k	let (i, float) = detect_parse_float_notending(i)?;
216	1.88k	let (i, _) = all_consuming(take_while(\|c\| c == ' ')).parse(i)?;
217	1.82k	Ok((i, float))
218	1.91k	}
219
220	1.91k	fn detect_parse_float_notending<T: DetectFloatType>(i: &str) -> IResult<&str, DetectFloatData<T>> {
221	1.91k	let (i, _) = opt(is_a(" ")).parse(i)?;
222	1.91k	let (i, float) = alt((
223	1.91k	detect_parse_float_start_interval,
224	1.91k	detect_parse_float_start_equal,
225	1.91k	detect_parse_float_start_symbol,
226	1.91k	)).parse(i)?;
227	1.88k	Ok((i, float))
228	1.91k	}
229
230		#[no_mangle]
231	0	pub unsafe extern "C" fn SCDetectF64Parse(
232	0	ustr: *const std::os::raw::c_char,
233	0	) -> *mut DetectFloatData<f64> {
234	0	let ft_name: &CStr = CStr::from_ptr(ustr); //unsafe
235	0	if let Ok(s) = ft_name.to_str() {
236	0	if let Ok((_, ctx)) = detect_parse_float::<f64>(s) {
237	0	let boxed = Box::new(ctx);
238	0	return Box::into_raw(boxed) as *mut _;
239	0	}
240	0	}
241	0	return std::ptr::null_mut();
242	0	}
243
244		#[no_mangle]
245	0	pub unsafe extern "C" fn SCDetectF64Match(
246	0	arg: f64, ctx: &DetectFloatData<f64>,
247	0	) -> std::os::raw::c_int {
248	0	if detect_match_float::<f64>(ctx, arg) {
249	0	return 1;
250	0	}
251	0	return 0;
252	0	}
253
254		#[no_mangle]
255	0	pub unsafe extern "C" fn SCDetectF64Free(ctx: &mut DetectFloatData<f64>) {
256		// Just unbox...
257	0	std::mem::drop(Box::from_raw(ctx));
258	0	}
259
260		#[no_mangle]
261	0	pub unsafe extern "C" fn SCDetectParseF64(
262	0	ustr: *const std::os::raw::c_char,
263	0	) -> *mut DetectFloatData<f64> {
264	0	let ft_name: &CStr = CStr::from_ptr(ustr);
265	0	if let Ok(s) = ft_name.to_str() {
266	0	if let Ok((_, ctx)) = detect_parse_float::<f64>(s) {
267	0	let boxed = Box::new(ctx);
268	0	return Box::into_raw(boxed);
269	0	}
270	0	}
271	0	std::ptr::null_mut()
272	0	}
273
274		#[no_mangle]
275	0	pub unsafe extern "C" fn SCDetectMatchF64(
276	0	arg: f64, ctx: &DetectFloatData<f64>,
277	0	) -> std::os::raw::c_int {
278	0	if detect_match_float(ctx, arg) {
279	0	1
280		} else {
281	0	0
282		}
283	0	}
284
285		#[no_mangle]
286	0	pub unsafe extern "C" fn SCDetectFreeF64(ctx: *mut DetectFloatData<f64>) {
287	0	std::mem::drop(Box::from_raw(ctx));
288	0	}
289
290		#[cfg(test)]
291		mod tests {
292		use super::*;
293		use std::ffi::CString;
294
295		#[test]
296		fn test_parse_float_value() {
297		assert!(parse_float_value::<f64>("NaN").is_ok());
298		assert!(parse_float_value::<f64>("-inf").is_ok());
299		assert!(parse_float_value::<f64>("inf").is_ok());
300		assert!(parse_float_value::<f64>("+inf").is_ok());
301		assert!(parse_float_value::<f64>("123.45").is_ok());
302		assert!(parse_float_value::<f64>("-0.001").is_ok());
303		assert!(parse_float_value::<f64>("1e10").is_ok());
304		assert!(parse_float_value::<f64>("-1e-10").is_ok());
305		assert!(parse_float_value::<f64>("0.5").is_ok());
306		assert!(parse_float_value::<f64>("5.").is_ok());
307		assert!(parse_float_value::<f64>("0+").is_ok());
308		assert!(parse_float_value::<f64>("0-").is_ok());
309		assert!(parse_float_value::<f32>("NaN").is_ok());
310		assert!(parse_float_value::<f32>("-inf").is_ok());
311		assert!(parse_float_value::<f32>("inf").is_ok());
312		assert!(parse_float_value::<f32>("+inf").is_ok());
313		assert!(parse_float_value::<f32>("123.45").is_ok());
314		assert!(parse_float_value::<f32>("-0.001").is_ok());
315		assert!(parse_float_value::<f32>("1e10").is_ok());
316		assert!(parse_float_value::<f32>("-1e-10").is_ok());
317		assert!(parse_float_value::<f32>("0.5").is_ok());
318		assert!(parse_float_value::<f32>("5.").is_ok());
319		assert!(parse_float_value::<f32>("0+").is_ok());
320		assert!(parse_float_value::<f32>("0-").is_ok());
321
322		assert!(parse_float_value::<f32>(".e10").is_err());
323		}
324		#[test]
325		fn test_detect_parse_valid() {
326		let _ = do_parse("1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
327		let _ = do_parse(">1.0", 1.0, DetectFloatMode::DetectFloatModeGt);
328		let _ = do_parse(">=1.0", 1.0, DetectFloatMode::DetectFloatModeGte);
329		let _ = do_parse("<1.0", 1.0, DetectFloatMode::DetectFloatModeLt);
330		let _ = do_parse("<=1.0", 1.0, DetectFloatMode::DetectFloatModeLte);
331		let _ = do_parse("=1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
332		let _ = do_parse("!=1.0", 1.0, DetectFloatMode::DetectFloatModeNe);
333		let _ = do_parse_mult_args(
334		"37.0-42.0",
335		37.0,
336		42.0,
337		DetectFloatMode::DetectFloatModeRange,
338		);
339		}
340
341		#[test]
342		fn test_detect_parse_invalid() {
343		assert!(detect_parse_float::<f64>("suricata").is_err());
344
345		// range should be <lower-val> - <higher-val>
346		assert!(detect_parse_float::<f64>("42-37").is_err());
347
348		assert!(detect_parse_float::<f64>("< suricata").is_err());
349		assert!(detect_parse_float::<f64>("<= suricata").is_err());
350		assert!(detect_parse_float::<f64>("= suricata").is_err());
351		assert!(detect_parse_float::<f64>("> suricata").is_err());
352		assert!(detect_parse_float::<f64>(">= suricata").is_err());
353		assert!(detect_parse_float::<f64>("! suricata").is_err());
354		assert!(detect_parse_float::<f64>("!= suricata").is_err());
355		}
356
357		fn do_parse<T: DetectFloatType + std::fmt::Display>(
358		val: &str, fval: T, mode: DetectFloatMode,
359		) -> DetectFloatData<T> {
360		let str_val = format!("{:.3}", fval);
361		let (_, val) = detect_parse_float::<T>(val).unwrap();
362		let str_arg1 = format!("{:.3}", val.arg1);
363		assert_eq!(str_arg1, str_val);
364		assert_eq!(val.mode, mode);
365		val
366		}
367
368		fn do_parse_mult_args<T: DetectFloatType + std::fmt::Display>(
369		val: &str, fval1: T, fval2: T, mode: DetectFloatMode,
370		) -> DetectFloatData<T> {
371		let str_val = format!("{:.3}", fval1);
372		let (_, val) = detect_parse_float::<T>(val).unwrap();
373		let str_arg = format!("{:.3}", val.arg1);
374		assert_eq!(str_arg, str_val);
375		let str_val = format!("{:.3}", fval2);
376		let str_arg = format!("{:.3}", val.arg2);
377		assert_eq!(str_arg, str_val);
378		assert_eq!(val.mode, mode);
379		val
380		}
381
382		#[test]
383		fn test_detect_match_valid() {
384		let val = do_parse("= 1.264", 1.264, DetectFloatMode::DetectFloatModeEqual);
385		assert!(detect_match_float(&val, 1.264));
386
387		let val = do_parse("> 1.0", 1.0, DetectFloatMode::DetectFloatModeGt);
388		assert!(detect_match_float(&val, 1.1));
389		assert!(!detect_match_float(&val, 1.0));
390
391		let val = do_parse(">= 1.0", 1.0, DetectFloatMode::DetectFloatModeGte);
392		assert!(detect_match_float(&val, 1.0));
393		assert!(detect_match_float(&val, 1.5));
394		assert!(!detect_match_float(&val, 0.5));
395
396		let val = do_parse("<= 1.0", 1.0, DetectFloatMode::DetectFloatModeLte);
397		assert!(detect_match_float(&val, 1.0));
398		assert!(detect_match_float(&val, 0.5));
399		assert!(!detect_match_float(&val, 1.5));
400
401		let val = do_parse("< 1.0", 1.0, DetectFloatMode::DetectFloatModeLt);
402		assert!(detect_match_float(&val, 0.9));
403		assert!(!detect_match_float(&val, 1.0));
404
405		let val = do_parse("= 1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
406		assert!(detect_match_float(&val, 1.0));
407		assert!(!detect_match_float(&val, 0.9));
408		assert!(!detect_match_float(&val, 1.1));
409
410		let val = do_parse("!= 1.0", 1.0, DetectFloatMode::DetectFloatModeNe);
411		assert!(detect_match_float(&val, 0.9));
412		assert!(detect_match_float(&val, 1.1));
413		assert!(!detect_match_float(&val, 1.0));
414
415		let val = do_parse_mult_args(
416		"37.0-42.0",
417		37.0,
418		42.0,
419		DetectFloatMode::DetectFloatModeRange,
420		);
421		assert!(detect_match_float(&val, 37.1));
422		assert!(detect_match_float(&val, 41.9));
423		assert!(!detect_match_float(&val, 35.0));
424		assert!(!detect_match_float(&val, 43.0));
425
426		let val = do_parse_mult_args(
427		"!37.0-42.0",
428		37.0,
429		42.0,
430		DetectFloatMode::DetectFloatModeNegRg,
431		);
432		assert!(detect_match_float(&val, 37.0));
433		assert!(detect_match_float(&val, 42.0));
434		assert!(detect_match_float(&val, 35.0));
435		assert!(detect_match_float(&val, 43.0));
436		assert!(!detect_match_float(&val, 37.1));
437		assert!(!detect_match_float(&val, 41.9));
438		}
439
440		fn do_match_test(val: &str, arg1: f64, arg1_cmp: f64, arg2: f64, mode: DetectFloatMode) {
441		let c_string = CString::new(val).expect("CString::new failed");
442		unsafe {
443		let val = SCDetectF64Parse(c_string.as_ptr());
444		let str_arg_a = format!("{:.3}", (*val).arg1);
445		let str_arg_b = format!("{:.3}", arg1);
446		assert_eq!(str_arg_a, str_arg_b);
447		let str_arg_a = format!("{:.3}", (*val).arg2);
448		let str_arg_b = format!("{:.3}", arg2);
449		assert_eq!(str_arg_a, str_arg_b);
450
451		assert_eq!((*val).mode, mode);
452		assert_eq!(1, SCDetectF64Match(arg1_cmp, &*val));
453		}
454		}
455
456		fn do_match_test_arg1(val: &str, arg1: f64, arg1_cmp: f64, mode: DetectFloatMode) {
457		do_match_test(val, arg1, arg1_cmp, FloatCore::min_value(), mode);
458		}
459
460		fn do_parse_test(val: &str, arg1: f64, arg2: f64, mode: DetectFloatMode) {
461		let c_string = CString::new(val).expect("CString::new failed");
462		unsafe {
463		let val = SCDetectF64Parse(c_string.as_ptr());
464		let str_arg_a = format!("{:.3}", (*val).arg1);
465		let str_arg_b = format!("{:.3}", arg1);
466		assert_eq!(str_arg_a, str_arg_b);
467		let str_arg_a = format!("{:.3}", (*val).arg2);
468		let str_arg_b = format!("{:.3}", arg2);
469		assert_eq!(str_arg_a, str_arg_b);
470
471		assert_eq!((*val).mode, mode);
472		}
473		}
474
475		fn do_parse_test_arg1(val: &str, arg1: f64, mode: DetectFloatMode) {
476		do_parse_test(val, arg1, FloatCore::min_value(), mode);
477		}
478
479		#[test]
480		fn test_ffi_detect_match_valid() {
481		do_match_test_arg1("1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeEqual);
482		do_match_test_arg1("> 1.0", 1.0, 1.1, DetectFloatMode::DetectFloatModeGt);
483		do_match_test_arg1(">= 1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeGte);
484		do_match_test_arg1("<= 1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeLte);
485		do_match_test_arg1("< 1.0", 1.0, 0.9, DetectFloatMode::DetectFloatModeLt);
486		do_match_test_arg1("= 1.0", 1.0, 1.0, DetectFloatMode::DetectFloatModeEqual);
487		do_match_test_arg1("!= 1.0", 1.0, 1.1, DetectFloatMode::DetectFloatModeNe);
488		do_match_test(
489		"37.0-42.0",
490		37.0,
491		37.1,
492		42.0,
493		DetectFloatMode::DetectFloatModeRange,
494		);
495		do_match_test(
496		"37.0-42.0",
497		37.0,
498		41.9,
499		42.0,
500		DetectFloatMode::DetectFloatModeRange,
501		);
502		do_match_test_arg1(
503		">= 4.15",
504		4.15,
505		4.150007324019584,
506		DetectFloatMode::DetectFloatModeGte,
507		);
508		do_match_test_arg1(
509		"> 4.15",
510		4.15,
511		4.150007324019584,
512		DetectFloatMode::DetectFloatModeGt,
513		);
514		}
515
516		#[test]
517		fn test_ffi_detect_parse_valid() {
518		do_parse_test_arg1("1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
519		do_parse_test_arg1("> 1.0", 1.0, DetectFloatMode::DetectFloatModeGt);
520		do_parse_test_arg1(">= 1.0", 1.0, DetectFloatMode::DetectFloatModeGte);
521		do_parse_test_arg1("<= 1.0", 1.0, DetectFloatMode::DetectFloatModeLte);
522		do_parse_test_arg1("< 1.0", 1.0, DetectFloatMode::DetectFloatModeLt);
523		do_parse_test_arg1("= 1.0", 1.0, DetectFloatMode::DetectFloatModeEqual);
524		do_parse_test_arg1("!= 1.0", 1.0, DetectFloatMode::DetectFloatModeNe);
525		do_parse_test(
526		"37.0-42.0",
527		37.0,
528		42.0,
529		DetectFloatMode::DetectFloatModeRange,
530		);
531		}
532		}