|
|
|
|
@ -81,131 +81,6 @@ For detection, use the specific buffer (cf :ref:`lua-detection` for a complete l
|
|
|
|
|
return needs
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetRequestBody and HttpGetResponseBody.
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Make normalized body data available to the script through
|
|
|
|
|
HttpGetRequestBody and HttpGetResponseBody.
|
|
|
|
|
|
|
|
|
|
There no guarantees that all of the body will be available.
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
function log(args)
|
|
|
|
|
a, o, e = HttpGetResponseBody();
|
|
|
|
|
--print("offset " .. o .. " end " .. e)
|
|
|
|
|
for n, v in ipairs(a) do
|
|
|
|
|
print(v)
|
|
|
|
|
end
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetRequestHost
|
|
|
|
|
~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Get the host from libhtp's htp_tx_request_hostname(tx), which can either be
|
|
|
|
|
the host portion of the url or the host portion of the Host header.
|
|
|
|
|
|
|
|
|
|
Example:
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
http_host = HttpGetRequestHost()
|
|
|
|
|
if http_host == nil then
|
|
|
|
|
http_host = "<hostname unknown>"
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetRequestHeader
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
http_ua = HttpGetRequestHeader("User-Agent")
|
|
|
|
|
if http_ua == nil then
|
|
|
|
|
http_ua = "<useragent unknown>"
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetResponseHeader
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
server = HttpGetResponseHeader("Server");
|
|
|
|
|
print ("Server: " .. server);
|
|
|
|
|
|
|
|
|
|
HttpGetRequestLine
|
|
|
|
|
~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
rl = HttpGetRequestLine();
|
|
|
|
|
print ("Request Line: " .. rl);
|
|
|
|
|
|
|
|
|
|
HttpGetResponseLine
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
rsl = HttpGetResponseLine();
|
|
|
|
|
print ("Response Line: " .. rsl);
|
|
|
|
|
|
|
|
|
|
HttpGetRawRequestHeaders
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
rh = HttpGetRawRequestHeaders();
|
|
|
|
|
print ("Raw Request Headers: " .. rh);
|
|
|
|
|
|
|
|
|
|
HttpGetRawResponseHeaders
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
rh = HttpGetRawResponseHeaders();
|
|
|
|
|
print ("Raw Response Headers: " .. rh);
|
|
|
|
|
|
|
|
|
|
HttpGetRequestUriRaw
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
http_uri = HttpGetRequestUriRaw()
|
|
|
|
|
if http_uri == nil then
|
|
|
|
|
http_uri = "<unknown>"
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetRequestUriNormalized
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
http_uri = HttpGetRequestUriNormalized()
|
|
|
|
|
if http_uri == nil then
|
|
|
|
|
http_uri = "<unknown>"
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetRequestHeaders
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
a = HttpGetRequestHeaders();
|
|
|
|
|
for n, v in pairs(a) do
|
|
|
|
|
print(n,v)
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
HttpGetResponseHeaders
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
a = HttpGetResponseHeaders();
|
|
|
|
|
for n, v in pairs(a) do
|
|
|
|
|
print(n,v)
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
Streaming Data
|
|
|
|
|
--------------
|
|
|
|
|
|
|
|
|
|
@ -249,53 +124,3 @@ function within a ``stream`` subtable::
|
|
|
|
|
-- To client?
|
|
|
|
|
local tc = args["stream"]["toclient"]
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
Flow variables
|
|
|
|
|
--------------
|
|
|
|
|
|
|
|
|
|
It is possible to access, define and modify Flow variables from Lua. To do so,
|
|
|
|
|
you must use the functions described in this section and declare the counter in
|
|
|
|
|
init function:
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
function init(args)
|
|
|
|
|
local needs = {}
|
|
|
|
|
needs["tls"] tostring(true)
|
|
|
|
|
needs["flowint"] = {"tls-cnt"}
|
|
|
|
|
return needs
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
Here we define a `tls-cnt` Flowint that can now be used in output or in a
|
|
|
|
|
signature via dedicated functions. The access to the Flow variable is done by
|
|
|
|
|
index so in our case we need to use 0.
|
|
|
|
|
|
|
|
|
|
::
|
|
|
|
|
|
|
|
|
|
function match(args)
|
|
|
|
|
a = SCFlowintGet(0);
|
|
|
|
|
if a then
|
|
|
|
|
SCFlowintSet(0, a + 1)
|
|
|
|
|
else
|
|
|
|
|
SCFlowintSet(0, 1)
|
|
|
|
|
end
|
|
|
|
|
|
|
|
|
|
SCFlowintGet
|
|
|
|
|
~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Get the Flowint at index given by the parameter.
|
|
|
|
|
|
|
|
|
|
SCFlowintSet
|
|
|
|
|
~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Set the Flowint at index given by the first parameter. The second parameter is the value.
|
|
|
|
|
|
|
|
|
|
SCFlowintIncr
|
|
|
|
|
~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Increment Flowint at index given by the first parameter.
|
|
|
|
|
|
|
|
|
|
SCFlowintDecr
|
|
|
|
|
~~~~~~~~~~~~~
|
|
|
|
|
|
|
|
|
|
Decrement Flowint at index given by the first parameter.
|
|
|
|
|
|