Header functions in the Lua http library read the header tables and the raw header
buffer. Once trailer fields moved out of those, a script could no longer see them at
all, and nothing replaced the access: the only way to act on a trailer was a rule.
Add the trailer twins over the tables and blocks the http.trailer buffers use:
tx:request_trailer(), tx:request_trailers(), tx:request_trailers_raw() and the response
versions. Name lookup is case insensitive and reports a miss as an error, like the
header functions. Repeated fields need no merging here: the parser folds them while
storing, so a name has one entry.
HTTP/2 is out of reach of these functions: the Lua http library is driven by htp, so it
has no HTTP/2 transaction to read.
Ticket: #8256.
And say on the header buffers that the trailer section is not part of
them. That is a change in behaviour for chunked traffic carrying
trailers: a rule that happened to match trailer content through
http.header, http.header.raw, http.header_names or a field keyword now
needs the matching trailer buffer.
Ticket: #8256.
State table and failure/completion semantics for the
per-direction scale (banner/kex/session, done never reported),
the removed banner_wait_eol state and legacy hook names, the new
eve ssh error/state fields, and the transactions/lua/upgrade
examples - all updated to match.
Ticket: #9046.
Move the SCThreadInfo global function into the suricata.util library as
thread_info().
This is the last global function to be registered, so remove the
supporting functions.
Similar to flowvars and flowints, but a byte var cannot be registered
from a Lua script, but it still needs to be setup. Instead provide an
"map" function that sets it up, or errors out if the byte var is
unknown.
This also required passing the signature into the Lua init method, as
the state of the Signature object and the time of loading the Lua
keyword is required.
Issue: 7608
Update the documentation to reflect the new and expanded functions
available form the Lua TLS library
There are now "server" and "client" versions of most functions. The TLS
object getter is now "get_tx"
This also breaks out the fileinfo function into a method per file info
item. And likewise for state, just return the state and add a new method
for checking if the file is stored.
Ticket: #7491
New Lua lib, "suricata.flowvar" for working with flowvars from Lua.
Replaces functions:
- SCFlowvarGet (and ScFlowvarGet)
- SCFlowvarSet (and SCFlowvarSet)
Of note, the DetectLuaData has been made available to the init and
thread_init methods, instead of just the match. This is due to an
issue that if a flow variable is not registered in init, it will not
be logged, registering in thread_init is too late.
Ticket: #7486
Add a "suricata.rule" library for accessing rule information from a
Lua rule, or a Lua output script.
This lib replaces the following global Lua functions:
- SCRuleIds
- SCRuleAction
- SCRuleMsg
- SCRuleClass
Ticket: #7490
Victor Julien
Jason Ish
Philippe Antoine
Tommy Wang
Juliana Fajardini
Jeff Lucovsky
Shivani Bhardwaj