Lua packetlib/v1 #12506
Lua packetlib/v1 #12506
Conversation
Example:
```
local packet = require "suricata.packet"
function init (args)
local needs = {}
return needs
end
function match (args)
p = packet.get()
payload = p:payload()
ts = p:timestring()
for line in payload:gmatch("([^\r\n]*)[\r\n]+") do
if line == "GET /index.html HTTP/1.0" then
ipver, srcip, dstip, proto, sp, dp = p:tuple()
SCLogNotice(string.format("%s %s->%s %d->%d (pcap_cnt:%d) match! %s", ts, srcip, dstip, sp, dp, p:pcap_cnt(), line));
return 1
end
end
return 0
end
```
Methods:
`get` creates the packet object.
`payload` returns the packet payload as a buffer
`packet` returns the whole packet (includes headers)
`pcap_cnt` returns the `pcap_cnt` (pcap file mode only)
`tuple` returns various fields: srcip, dstip, proto, sp, dp
`timestamp` returns time as 2 numbers: seconds and microseconds
`timestring` returns a timestamp as a string
Ticket: OISF#7488.
Moving forward the packetlib is to be used. Ticket: OISF#7488.
Register internal libs for the case where loading external modules is allowed.
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #12506 +/- ##
==========================================
- Coverage 80.56% 80.56% -0.01%
==========================================
Files 925 926 +1
Lines 259292 259329 +37
==========================================
+ Hits 208906 208929 +23
- Misses 50386 50400 +14
Flags with carried forward coverage won't be shown. Click here to find out more. |
|
Information: QA ran without warnings. Pipeline 24444 |
| } else { | ||
| SCLuaSbLoadLibs(t->luastate); | ||
| } | ||
| SCLuaSbLoadLibs(t->luastate); |
There was a problem hiding this comment.
Keep the if/else. In the case of allowing restricted libs it should look like:
luaL_openlibs(luastate);
SCLuaRequirefBuiltIns(luastate);
As SCLuaSbLoadLibs is going to override the requires, plus re-load in already loaded libs, then wipe the ones that are not allowed. SCLuaRequirefBuiltIns just augments the standard libs with ours.
| luaL_setfuncs(luastate, packetlib, 0); | ||
| luaL_newlib(luastate, packetlib); |
There was a problem hiding this comment.
I think the metatable functions and the lib functions should not be shared. Leads a duplicate API and confusion on how it should be used.
Agree on the docs, but would like to see first if the current methods make sense. |
|
replaced by #12512 |
SV_BRANCH=OISF/suricata-verify#2267
https://redmine.openinfosecfoundation.org/issues/7488