From 8e75f21e4f96d732a1ec8fa56d34098550e875e5 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 7 Dec 2025 09:41:13 -0500 Subject: [PATCH] doc/luaxform: Clarify luaxform calling convention Issue: 8135 Clarify the calling convention for the Lua transform's `transform` function. (cherry picked from commit 845544aad30b2a15762c92ef193c20c0ca5c4401) --- doc/userguide/rules/transforms.rst | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst index a5da4ecebb..eb5117ba7d 100644 --- a/doc/userguide/rules/transforms.rst +++ b/doc/userguide/rules/transforms.rst @@ -293,12 +293,19 @@ This transform allows a Lua script to apply a transformation to a buffer. Lua scripts that are used for transformations *must* contain a function -named ``transform``. +named ``transform``. The function signature is:: + + -- transform function arguments: + -- input - the buffer to be transformed. Use #input to determine byte count + -- args - The arguments from the rule. Access each as args[0], args[1], ... + function transform(input, args) Lua scripts can have other functions; Suricata only invokes the ``transform`` function. Lua transforms can be passed optional arguments -- see the examples below -- but they -are not required to do so. Arguments are comma-separated. +are not required to do so. Specify comma-separated arguments in the rule, e.g:: + + luaxform:transform.lua, bytes 0, offset 2 A Lua transform function is not invoked if the buffer is empty or the Lua framework is not accessible (rare). @@ -357,7 +364,8 @@ the buffer. -- Arguments supported local bytes_key = "bytes" local offset_key = "offset" - function transform(input_len, input, argc, args) + + function transform(input, args) local bytes = #input local offset = 0