suricata/src/util-lua-flowlib.h

/* Copyright (C) 2025 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

#ifndef SURICATA_UTIL_LUA_FLOW_H
#define SURICATA_UTIL_LUA_FLOW_H

#include "lua.h"

int LuaLoadFlowLib(lua_State *luastate);

#endif /* SURICATA_UTIL_LUA_FLOW_H */
lua: add initial suricata.flow lib Methods: `get` creates the flow object. `id` returns the flow id. `has_alerts` returns a boolean indicating if the flow triggered alerts. `app_layer_proto` returns various app-layer related fields as 5 strings: alproto, alproto_ts, alproto_tc, alproto_orig, alproto_expect. `stats` returns cnts for bytes and packets to sever and to client, as 4 numbers. `tuple` -- returns various fields: srcip, dstip, proto, sp, dp. `timestamps` returns time as 4 numbers: seconds and microseconds, for first and last packet of the flow. `timestring_legacy` returns the first packet from the flow's timestring as a string (like fastlog). `timestring_iso8601` returns the first packet from the flow's timestring as an iso8601 compat timestring (like eve). Example: ``` name = "lua-scflowstats.log" local flow = require("suricata.flow") function init(args) local needs = {} needs["type"] = "flow" return needs end function setup(args) filename = SCLogPath() .. "/" .. name file = assert(io.open(filename, "a")) SCLogInfo("lua SCFlowStats Log Filename " .. filename) end function log(args) local f = flow.get() timestring = f:timestring_legacy() tscnt, tsbytes, tccnt, tcbytes = f:stats() file:write ("[] " .. timestring .. "\nSCFlowStats is\nPacket count to server: " .. tscnt .. "\nByte count to server: " .. tsbytes .. "\nPacket count to client: " .. tccnt .. "\nByte count to client: " .. tcbytes .. "\n[]") file:flush() end function deinit(args) file:close(file) end ``` Task #7489 5 months ago			`/* Copyright (C) 2025 Open Information Security Foundation`
			`*`
			`* You can copy, redistribute or modify this Program under the terms of`
			`* the GNU General Public License version 2 as published by the Free`
			`* Software Foundation.`
			`*`
			`* This program is distributed in the hope that it will be useful,`
			`* but WITHOUT ANY WARRANTY; without even the implied warranty of`
			`* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the`
			`* GNU General Public License for more details.`
			`*`
			`* You should have received a copy of the GNU General Public License`
			`* version 2 along with this program; if not, write to the Free Software`
			`* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA`
			`* 02110-1301, USA.`
			`*/`

			`#ifndef SURICATA_UTIL_LUA_FLOW_H`
			`#define SURICATA_UTIL_LUA_FLOW_H`

			`#include "lua.h"`

			`int LuaLoadFlowLib(lua_State *luastate);`

			`#endif /* SURICATA_UTIL_LUA_FLOW_H */`