detect/integers: support kibibyte unit

Ticket: 7869

diff --git a/doc/userguide/rules/integer-keywords.rst b/doc/userguide/rules/integer-keywords.rst
index 7c41f7eda8a541eabe10e8e1ae2c52da8b4770b8..9c0e511dad67f797c0cfceabc272b2e904903422 100644 (file)
--- a/doc/userguide/rules/integer-keywords.rst
+++ b/doc/userguide/rules/integer-keywords.rst
@@ -15,9 +15,9 @@ an hexadecimal value like ``0x64``.
 
 The integer value can also have a unit/multiplier as a
 case-insensitive suffix:
-* kb : 1024
-* mb : 1048576
-* gb : 1073741824
+* kb/kib : 1024
+* mb/mib : 1048576
+* gb/gib : 1073741824
 
 The most direct example is to match for equality, but there are
 different modes.

diff --git a/rust/src/detect/uint.rs b/rust/src/detect/uint.rs
index 083ad284491e084cddf2810b11c462d8a15d857d..ba61aa4038aab6cf755dbb619a112077aeddc5e3 100644 (file)
--- a/rust/src/detect/uint.rs
+++ b/rust/src/detect/uint.rs
@@ -104,8 +104,11 @@ impl<T> DetectIntType for T where
 
 pub fn detect_parse_uint_unit(i: &str) -> IResult<&str, u64> {
     let (i, unit) = alt((
+        value(1024, tag_no_case("kib")),
         value(1024, tag_no_case("kb")),
+        value(1024 * 1024, tag_no_case("mib")),
         value(1024 * 1024, tag_no_case("mb")),
+        value(1024 * 1024 * 1024, tag_no_case("gib")),
         value(1024 * 1024 * 1024, tag_no_case("gb")),
     ))(i)?;
     return Ok((i, unit));