"Fossies" - the Fresh Open Source Software Archive

Member "snort3_extra-3.0.3-1/src/ips_options/find/find.lua" (23 Sep 2020, 1708 Bytes) of package /linux/misc/snort3_extra-3.0.3-1.tar.gz:

As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) Lua source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. 
    1 -- ----------------------------------------------------------
    2 -- ips_option example:
    3 --
    4 --     define keyword find
    5 --
    6 -- configure snort with
    7 --
    8 --     ./configure_cmake.sh --prefix=my/prefix
    9 --
   10 -- then set up the path as follows:
   11 --
   12 --     export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\;
   13 --
   14 -- write a rule as follows:
   15 --
   16 --     alert tcp any any -> any 80 ( \
   17 --         msg:"luajit example"; sid:1; \
   18 --         content:"GET"; \
   19 --         find:"pat='HTTP/1%.%d'"; )
   20 --
   21 -- the arg string is (in general) optional
   22 -- if present, it will be put in a table named args, eg:
   23 --
   24 --     args { pat='GET .+ HTTP/1.1' }
   25 --
   26 -- this table is defined before init is called
   27 -- the args string, if present, must be valid lua code like
   28 -- name1 = value1, name2 = 'value2'.
   29 -- ----------------------------------------------------------
   30 
   31 -- this pulls in snort bindings with ffi
   32 require("snort_plugin")
   33 
   34 -- init() is optional
   35 -- if present, called once when script is loaded
   36 -- here we return bool indicating args ok
   37 function init ()
   38     if ( args.pat == nil ) then
   39         return 'missing pat'
   40     end
   41 
   42     if ( type(args.pat) ~= 'string' ) then
   43         return 'pat must be string'
   44     end
   45 
   46     return true
   47 end
   48 
   49 -- eval() is required
   50 -- eval must return a bool (match == true)
   51 function eval ()
   52     -- buf is a luajit cdata
   53     local buf = ffi.C.get_buffer()
   54 
   55     -- str is a lua string
   56     local str = ffi.string(buf.data, buf.len)
   57 
   58     local i,j = string.find(str, args.pat)
   59 
   60     return (i and (i > 0))
   61 end
   62 
   63 -- plugin table is required
   64 plugin =
   65 {
   66     type = "ips_option",  -- only available type currently
   67     name = "find",        -- rule option keyword
   68     version = 0           -- optional, defaults to zero
   69 }
   70