Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

transform: luaxform transform script #11940

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Conversation

jlucovsky
Copy link
Contributor

Continuation of #11938

Add the luaxform transform that uses a Lua script to receive and transform a sticky buffer.

Lua transforms receive arguments

  • (always): length of input buffer and input buffer
  • (always): number of additional arguments (may be 0)
  • (when present): argument array (bounded by argument count)

Arguments are passed to the Lua script as they appear in the rule:

 luaxform:./lua/lua-transform.lua, bytes 4, offset 13, hash sha256;

When the transform is invoked, 3 additional arguments are passed (arg count will be 3)

  • bytes 4
  • offset 13
  • hash sha256

The Lua script is responsible for parsing and using the arguments and returning a tuple: output-buffer, output-buffer-byte-count

I used this Lua script:

function init (args)
  -- Optional, no return value
end

function transform(input_len, input, argc, args)
    SCLogNotice("Input length: " .. input_len .. " arg-count: " .. argc)
    for i = 1, argc do
        print("Argument " .. i .. ":", args[i])
    end
    return string.upper(input), input_len
end

return 0

Example rule using the Lua script:

alert http any any -> any any (msg:"Lua Xform example"; flow:established;  file.data; luaxform:./lua/lua-transform.lua; content: "abc"; sid: 1;)

Link to ticket: https://redmine.openinfosecfoundation.org/issues/2290

Describe changes:

  • Luaxform transform changes

Updates

  • Eliminate usage of (banned) function strtok.
  • det_ctx was removed from the inspection buffer. The det_ctx is supplied when evaluating the transform
  • Refactored common pattern of setup/apply into a combined "SetupAndApply" function.
  • Rebase (cbindgen-related issue)

Provide values to any of the below to override the defaults.

  • To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
    link to the pull request in the respective _BRANCH variable.
  • Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2090
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

This commit makes the detection engine thread context available for
transforms to use. The Lua transform requires this value.

Issue: 2290
Issue: 2290

This commit extends the hash table logic with an alternate free function
that provides the detection engine context.

Users that wish to use the next functionality must use the
HashListTableInitWithCtx function when initializing the hash table.
Using this interface will result in the hash table "free with context"
function (new) being used instead.
Issue: 2290

Defer freeing the keyword hash table until the engine context has
been freed. This eliminates a double-free from occurring.

For the unittests ONLY, clear the keyword_hash to prevent a double
free attempt.
Issue: 2290

This commit adds the source files for the new transform -- luaxform.
git grep -A 1 -w InspectionBufferSetup shows numbers cases of the pattern:
    - InspectionBufferSetup
    - InspectionBufferApplyTransforms

Refactor the implementations of those functions into
InspectionBufferSetupAndApplyTransforms to reduce function call count.

Issuer: 2290
Copy link

codecov bot commented Oct 11, 2024

Codecov Report

Attention: Patch coverage is 85.94848% with 60 lines in your changes missing coverage. Please review.

Project coverage is 82.71%. Comparing base (58556b7) to head (4298554).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11940      +/-   ##
==========================================
- Coverage   82.74%   82.71%   -0.03%     
==========================================
  Files         912      915       +3     
  Lines      249102   249302     +200     
==========================================
+ Hits       206117   206213      +96     
- Misses      42985    43089     +104     
Flag Coverage Δ
fuzzcorpus 60.73% <45.92%> (+0.01%) ⬆️
livemode 18.72% <11.85%> (-0.13%) ⬇️
pcap 44.03% <29.87%> (-0.08%) ⬇️
suricata-verify 62.16% <82.96%> (-0.02%) ⬇️
unittests 58.96% <27.86%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 23089

@victorjulien victorjulien self-assigned this Oct 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants