I think it is great addition and I would like to see it implemented for HTTP streams.<br><br>There are a thousand things you could do with lua scripting in suricata. For example, if we had lua for HTTP streams, you could write a lua script to implement some basic machine learning algorithm over the useragents found in the HTTP requests (and some other http headers) to detect malware C&C communications.<br>
<br>Another possible use would be the creation of a lua script for the monitoring of the parameters sent via GET or POST to your web applications, with some machine learning to create a profile per parameter and URL, so that it is able to understand that your id=xx (?id=4, ?id=7, id=188) is always numeric, so it will trigger an alert if somebody attempts id=1 and 1=0.<br>
<br>You could do this for network security research or even as IDS/IPS for production environments. Luajit was created with performance in mind, so it should be fast enough to support such implementations.<br><br>IMHO triggering a lua script per packet could be too excessive for production environments, but triggering a lua script per HTTP transaction (and in the future, per SMTP transaction) should be feasible.<br>
<br>Regards,<br><br> Ignacio Sanchez<br><br><div class="gmail_quote">On Wed, Sep 5, 2012 at 6:17 PM, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 09/05/2012 06:07 PM, Peter Manev wrote:<br>
> What is the advantage?<br>
> Besides the fact of course that you can add your own script execution,<br>
> in other words<br>
> what is it that a Lua script gives you that you can not use a rule<br>
> language for?<br>
> is Lua pattern matching, better and faster than PCRE? - how much<br>
> time/coding would it be needed, if so?<br>
<br>
</div>It's a whole scripting language, so there will be much more flexibility<br>
when it comes to detection. We'll have to see how this will perform, so<br>
it's hard to say how useful it will be. But I think for starters we<br>
should threat it like pcre, in other words try to add prefilters like<br>
regular "content" matches.<br>
<div class="im"><br>
><br>
><br>
><br>
><br>
> On Wed, Sep 5, 2012 at 5:50 PM, Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a><br>
</div><div><div class="h5">> <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>>> wrote:<br>
><br>
> So Will started bugging me (again) on doing scripting from Suricata and<br>
> I gave in. Just committed extremely immature, incomplete, experimental<br>
> luajit scripting support.<br>
><br>
> What it does is that it adds a new keyword, "luajit". There is one<br>
> argument, a script name. That script is then loaded from your rules<br>
> directory and ran against a packet. No flow, http or any of that right<br>
> now, just packets.<br>
><br>
> Example rule:<br>
> alert tcp any any -> any any (msg:"LUAJIT test"; luajit:test.lua;<br>
> sid:1;)<br>
><br>
> This loads the script from /etc/suricata/rules/test.lua<br>
><br>
> The script has a "match" function that will return either 1 or 0. 1 for<br>
> match, 0 for no match.<br>
><br>
> Example script:<br>
><br>
> -- match string HTTP in packet payload<br>
> function match(args)<br>
> for k,v in pairs(args) do<br>
> if tostring(k) == "payload" then<br>
> a = tostring(v)<br>
> if #a > 0 then<br>
> if a:find("HTTP") then<br>
> return 1<br>
> end<br>
> end<br>
> end<br>
> end<br>
><br>
> return 0<br>
> end<br>
><br>
> return 0<br>
> -- eof<br>
><br>
> The fun thing is that it works, but the best joke is that on my box this<br>
> simple script makes no performance impact at all.<br>
><br>
> Currently only "payload" and "packet" keys are available. More will<br>
> follow, or not. This is research stuff, and if we run into some major<br>
> obstacle we'll remove it or change it completely. Until then, let me<br>
> know how you feel about it :)<br>
><br>
> Oh yeah, to enable add "--with-<br>
> libluajit-includes=/usr/include/luajit-2.0/<br>
> --with-libluajit-libraries=/usr/lib/x86_64-linux-gnu/" to your configure<br>
> line. Adapt for your distro.<br>
><br>
> Happy scripting!<br>
><br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
><br>
> _______________________________________________<br>
> Oisf-devel mailing list<br>
> <a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
</div></div>> <mailto:<a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a>><br>
<div class="HOEnZb"><div class="h5">> <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
><br>
><br>
><br>
><br>
> --<br>
> Regards,<br>
> Peter Manev<br>
><br>
<br>
<br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
_______________________________________________<br>
Oisf-devel mailing list<br>
<a href="mailto:Oisf-devel@openinfosecfoundation.org">Oisf-devel@openinfosecfoundation.org</a><br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
</div></div></blockquote></div><br>