Commit Graph

21 Commits (3de735ae7020da4e9ea42f12676609a9ec637d1a)

Author SHA1 Message Date
Benjamin Wilkins e21a50fee6 lua: Fix SCRule functions for match scripts
Save Signature structure to lua register so SCRule functions can work
in match scripts, where no PacketAlert is present

Resolves Feature #2450
4 years ago
Jeff Lucovsky 1eeb96696b general: Cleanup bool usage 4 years ago
Jeff Lucovsky c845974639 general: Correct typo 5 years ago
Jeff Lucovsky 431018d6f7 lua: Use SC prefix for Lua functions
This commit adds additional Lua API interfaces to bring consistency to
functions such that the `SC` prefix is available consistently across
flow int and flow var functions.
5 years ago
Vadym Malakhatko 8a8212d0f6 lua: add functions to get hassh parameters 5 years ago
Jeff Lucovsky be4c6b85de general: Convert _Bool to bool
This commit addresses task 3167 and changes usages of '_Bool` to `bool`.
The latter is included from `suricata-common.h`
6 years ago
Mats Klepsland 195fa9d272 lua: add Ja3GetHash function
Add Ja3GetHash() to return the content of the JA3 hash buffer from the
TLS session.

Example:

  function init (args)
      local needs = {}
      needs["protocol"] = "tls"
      return needs
  end

  function setup (args)
      filename = SCLogPath() .. "/ja3_hash.log"
      file = assert(io.open(filename, "a"))
  end

  function log (args)
      ja3_hash = Ja3GetHash()
      if ja3_hash == nil then
          return
      end

      file:write(ja3_hash .. "\n")
      file:flush()
  end

  function deinit (args)
      file:close()
  end

In the (useless) example above, each JA3 hash is logged to a log file.
7 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
8 years ago
Victor Julien 99517cbd53 lua: support key/value flowvars in lua 9 years ago
Victor Julien 3f8ee2afd3 detect-lua: unify on using 'lua' name vs 'luajit' 9 years ago
Jason Ish a59f31a99f DNP3: Lua detect support.
Adds support for access the DNP3 transaction in Lua rules.
9 years ago
Jason Ish 8865009fca lua: remove flow locking from the lua layer 9 years ago
tobiass1 7581f5129f Lua: SMTP support; Addresses feature ticket #1775; v5 9 years ago
Mats Klepsland 7eab16c478 lua: SSH support
Support SSH in lua detection scripts (Feature #1569).
10 years ago
Victor Julien 371648a8c6 lua: TLS support
Support TLS in Lua detection scripts.

function init (args)
    local needs = {}
    needs["tls"] = tostring(true)
    return needs
end

function match(args)
    version, subject, issuer, fingerprint = TlsGetCertInfo();
    if version == nil then
        return 0
    end
    str = string.format("Version %s\nIssuer %s\nSubject %s\nFingerprint %s",
                        version, issuer, subject, fingerprint)
    SCLogInfo(str);
    return 1
end
10 years ago
Victor Julien 1e84950017 detect-lua: set direction 10 years ago
Eric Leblond 667b9a5220 lua: add export of dns.rrname
Add the capability for a lua script to ask for rrname in DNS query.
11 years ago
Victor Julien 22272f6c5b lua: export packet keywords to detect scripts
Set packet pointer, so it's available to the lua keywords that
require it.
11 years ago
Victor Julien 5a86e57d41 detect-lua: register all 'output' keywords as well
Register all keywords available to output scripts to the detect
scripts as well.
11 years ago
Victor Julien 41523ede77 detect-lua: set tx ptr
Set tx ptr so it can be used later by other keywords.
11 years ago
Victor Julien f23399d672 Rename Lua code to just Lua
As we support regular Lua as well as LuaJIT, it makes more sense to call
it all Lua.
11 years ago