mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
81 lines
1.7 KiB
ReStructuredText
81 lines
1.7 KiB
ReStructuredText
Bytevar
|
|
#######
|
|
|
|
The ``suricata.bytevar`` module provides access to variables defined by
|
|
``byte_extract`` and ``byte_math`` keywords in Suricata rules.
|
|
|
|
It is only available in Suricata Lua rules, not output scripts.
|
|
|
|
Setup
|
|
*****
|
|
|
|
::
|
|
|
|
local bytevars = require("suricata.bytevar")
|
|
|
|
Module Functions
|
|
****************
|
|
|
|
.. function:: bytevars.map(sig, varname)
|
|
|
|
Ensures that the ``bytevar`` exists and sets it up for further use
|
|
in the script by mapping it into the Lua context. Must be called
|
|
during ``init()``.
|
|
|
|
:param sig: The signature object passed to ``init()``
|
|
:param string varname: Name of the variable as defined in the rule
|
|
|
|
:raises error: If the variable name is unknown
|
|
:raises error: If too many byte variables are mapped
|
|
|
|
Example:
|
|
|
|
::
|
|
|
|
function init(sig)
|
|
bytevars.map(sig, "var1")
|
|
bytevars.map(sig, "var2")
|
|
return {}
|
|
end
|
|
|
|
.. function:: bytevars.get(name)
|
|
|
|
Returns a byte variable object for the given name. May be called
|
|
during ``thread_init()`` to save a handle to the bytevar.
|
|
|
|
:param number name: Name of the variable previously setup with
|
|
``map()``.
|
|
|
|
:raises error: If variable name is not mapped with ``map()``.
|
|
|
|
:returns: A byte variable object
|
|
|
|
Example:
|
|
|
|
::
|
|
|
|
function thread_init()
|
|
bv_var1 = bytevars.get("var1")
|
|
bv_var2 = bytevars.get("var2")
|
|
end
|
|
|
|
Byte Variable Object Methods
|
|
****************************
|
|
|
|
.. method:: bytevar:value()
|
|
|
|
Returns the current value of the byte variable.
|
|
|
|
:returns: The value of the byte variable.
|
|
|
|
Example:
|
|
|
|
::
|
|
|
|
function match(args)
|
|
local var1 = bv_var1:value()
|
|
if var1 then
|
|
-- Use the value
|
|
end
|
|
end
|