Actions
Documentation #4725
closedInconsistent "needs" key documentation for Lua functions
Affected Versions:
Effort:
Difficulty:
low
Label:
Description
I noticed that some example code in the Lua functions documentation does not really match reality. For example, using
function init (args)
local needs = {}
needs["protocol"] = "tls"
return needs
end
in a Lua detection script (according to https://suricata.readthedocs.io/en/latest/lua/lua-functions.html#tls) only gives me
[30573] 30/9/2021 -- 13:27:13 - (detect-lua.c:969) <Error> (DetectLuaSetupPrime) -- [ERRCODE: SC_ERR_LUA_ERROR(212)] - unsupported data type protocol
while, after looking at https://github.com/OISF/suricata/blob/master/src/detect-lua.c#L944 it became clear that
function init (args)
local needs = {}
needs["tls"] = "true"
return needs
end
would be correct. Perhaps it could make sense to check the documentation to ensure that examples are working.
Actions