Commit Graph

15 Commits (5e5761a29c98b8cbdeb575199cf2295f09891db2)

Author SHA1 Message Date
Mats Klepsland 195fa9d272 lua: add Ja3GetHash function
Add Ja3GetHash() to return the content of the JA3 hash buffer from the
TLS session.

Example:

  function init (args)
      local needs = {}
      needs["protocol"] = "tls"
      return needs
  end

  function setup (args)
      filename = SCLogPath() .. "/ja3_hash.log"
      file = assert(io.open(filename, "a"))
  end

  function log (args)
      ja3_hash = Ja3GetHash()
      if ja3_hash == nil then
          return
      end

      file:write(ja3_hash .. "\n")
      file:flush()
  end

  function deinit (args)
      file:close()
  end

In the (useless) example above, each JA3 hash is logged to a log file.
8 years ago
Victor Julien ab1200fbd7 compiler: more strict compiler warnings
Set flags by default:

    -Wmissing-prototypes
    -Wmissing-declarations
    -Wstrict-prototypes
    -Wwrite-strings
    -Wcast-align
    -Wbad-function-cast
    -Wformat-security
    -Wno-format-nonliteral
    -Wmissing-format-attribute
    -funsigned-char

Fix minor compiler warnings for these new flags on gcc and clang.
9 years ago
Victor Julien 99517cbd53 lua: support key/value flowvars in lua 10 years ago
Victor Julien 3f8ee2afd3 detect-lua: unify on using 'lua' name vs 'luajit' 10 years ago
Jason Ish a59f31a99f DNP3: Lua detect support.
Adds support for access the DNP3 transaction in Lua rules.
10 years ago
Jason Ish 8865009fca lua: remove flow locking from the lua layer 10 years ago
tobiass1 7581f5129f Lua: SMTP support; Addresses feature ticket #1775; v5 10 years ago
Mats Klepsland 7eab16c478 lua: SSH support
Support SSH in lua detection scripts (Feature #1569).
11 years ago
Victor Julien 371648a8c6 lua: TLS support
Support TLS in Lua detection scripts.

function init (args)
    local needs = {}
    needs["tls"] = tostring(true)
    return needs
end

function match(args)
    version, subject, issuer, fingerprint = TlsGetCertInfo();
    if version == nil then
        return 0
    end
    str = string.format("Version %s\nIssuer %s\nSubject %s\nFingerprint %s",
                        version, issuer, subject, fingerprint)
    SCLogInfo(str);
    return 1
end
11 years ago
Victor Julien 1e84950017 detect-lua: set direction 11 years ago
Eric Leblond 667b9a5220 lua: add export of dns.rrname
Add the capability for a lua script to ask for rrname in DNS query.
12 years ago
Victor Julien 22272f6c5b lua: export packet keywords to detect scripts
Set packet pointer, so it's available to the lua keywords that
require it.
12 years ago
Victor Julien 5a86e57d41 detect-lua: register all 'output' keywords as well
Register all keywords available to output scripts to the detect
scripts as well.
12 years ago
Victor Julien 41523ede77 detect-lua: set tx ptr
Set tx ptr so it can be used later by other keywords.
12 years ago
Victor Julien f23399d672 Rename Lua code to just Lua
As we support regular Lua as well as LuaJIT, it makes more sense to call
it all Lua.
12 years ago