"Fossies" - the Fresh Open Source Software Archive

Member "snort3_extra-3.1.53.0/src/loggers/alert_lua/alert.lua" (20 Dec 2022, 1654 Bytes) of package /linux/misc/snort3_extra-3.1.53.0.tar.gz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) Lua source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file.

    1 -- ----------------------------------------------------------
    2 -- logger example:
    3 --
    4 --     define keyword lualert
    5 --
    6 -- configure snort with
    7 --
    8 --     ./configure_cmake.sh --prefix=my/prefix
    9 --
   10 -- then set up the path as follows:
   11 --
   12 --     export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\;
   13 --
   14 -- You can use with -A lualert by adding lualert to your 
   15 -- snort.lua:
   16 --
   17 --     lualert =
   18 --     {
   19 --         args = "num = 1, str = 'bar', cond = true"
   20 --     }
   21 --
   22 -- the arg string is (in general) optional
   23 -- if present, it will be put in a table named args, eg:
   24 --
   25 --     args = { num = 1, str = 'bar', cond = true }
   26 --
   27 -- this table is defined before init is called
   28 -- the args string, if present, must be valid lua code like
   29 -- above.
   30 -- ----------------------------------------------------------
   31 
   32 -- this pulls in snort bindings with ffi
   33 require("snort_plugin")
   34 
   35 -- init() is optional
   36 -- if present, called once when script is loaded
   37 -- here we return bool indicating args ok
   38 function init ()
   39     return true
   40 end
   41 
   42 -- alert() is required
   43 function alert ()
   44     -- get luajit structs
   45     local evt = ffi.C.get_event()
   46     local pkt = ffi.C.get_packet()
   47 
   48     -- str is a luajit string
   49     local str = ffi.string(evt.msg)
   50 
   51     -- FIXIT - this gets:
   52     -- bad argument #2 to 'format' (number expected, got cdata)
   53     --print(string.format('%ld %d:%d:%d %s',
   54     --    pkt.num, evt.gid, evt.sid, evt.rev, str))
   55 
   56     print(string.format('%d:%d:%d %s',
   57         evt.gid, evt.sid, evt.rev, str))
   58 end
   59 
   60 -- plugin table is required
   61 plugin =
   62 {
   63     type = "logger", 
   64     name = "lualert", -- eg -A lualert
   65     version = 0       -- optional version of this file
   66 }
   67