Bug #2094
open
luajit: SCFlowvarGet always returns null
Added by Chris Knott over 7 years ago.
Updated about 3 years ago.
Description
Scenario: I want to manipulate a flow variable that I've extracted with a PCRE with a Lua script. Whenever I call the SCFlowvarGet method in the Lua script it returns "null" and not the value of the flow variable as it should.
Attached you can find the files that I am using (PCAP, rules, lua).
I'm using the following Suricata call:
suricata -v -r /home/suricata/test.pcap -S /etc/suricata/rules/test.rules -k none
As you can see out of the resulting eve.json file (attached) the rule works and also the variable is extracted. Furthermore the lua script is triggered and executed as the print commands of the lua script are in the console output. Also you can see in the console output that the "testVar" is not set (in my opinion it should be set there). It this a bug or am I doing something wrong in the script?
Files
- Priority changed from High to Normal
- Assignee set to OISF Dev
- Target version set to TBD
- Assignee changed from OISF Dev to Eric Leblond
Does one of our Lua gurus have an idea?
Can someone create SV test out of this?
- Assignee changed from Eric Leblond to OISF Dev
Chris, here is a setup that does what you expect I think :
https://github.com/OISF/suricata-verify/pull/566
The problem is that during detection, the steps happen in this order :
- pattern matching
- lua script execution
- setting flow variables as part of post match
So, a workaround is to have 2 rules :
- one that does the pattern matching and setting the flow var
- another second one that does the Lua script
Maybe you also want to use the flowvar keyword in the second rule, but you cannot just test if it is set, you need to find for a pattern in it like alert http any any -> any any (msg: "Test2"; lua:test.lua; flowvar: TestVar,zib; sid:6677001; rev:1;)
You may also want to use sticky buffers and pcrexform to get what you are looking for...
Also available in: Atom
PDF