Project

General

Profile

Actions

Documentation #4725

closed

Inconsistent "needs" key documentation for Lua functions

Added by Sascha Steinbiss about 3 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Low
Target version:
Affected Versions:
Effort:
Difficulty:
low
Label:

Description

I noticed that some example code in the Lua functions documentation does not really match reality. For example, using

function init (args)
    local needs = {}
    needs["protocol"] = "tls" 
    return needs
end

in a Lua detection script (according to https://suricata.readthedocs.io/en/latest/lua/lua-functions.html#tls) only gives me

[30573] 30/9/2021 -- 13:27:13 - (detect-lua.c:969) <Error> (DetectLuaSetupPrime) -- [ERRCODE: SC_ERR_LUA_ERROR(212)] - unsupported data type protocol

while, after looking at https://github.com/OISF/suricata/blob/master/src/detect-lua.c#L944 it became clear that

function init (args)
    local needs = {}
    needs["tls"] = "true" 
    return needs
end

would be correct. Perhaps it could make sense to check the documentation to ensure that examples are working.


Related issues 1 (1 open0 closed)

Related to Suricata - Optimization #4753: lua: fix inconsistency in the init "needs" keyNewJason IshActions
Actions

Also available in: Atom PDF