Flowint on Inliniac

More on Suricata lua flowints

Tue, 23 Apr 2013 10:17:52 +0000

This morning I added flowint lua functions for incrementing and decrementing flowints. From the commit:

Add flowint lua functions for incrementing and decrementing flowints.

First use creates the var and inits to 0. So a call:
    a = ScFlowintIncr(0)
Results in a == 1.

If the var reached UINT_MAX (2^32), it’s not further incremented. If the var reaches 0 it’s not decremented further.

Calling ScFlowintDecr on a uninitialized var will init it to 0.

Suricata Lua scripting flowint access

Mon, 22 Apr 2013 16:16:30 +0000

A few days ago I wrote about my Emerging Threats sponsored work to support flowvars from Lua scripts in Suricata.

Today, I updated that support. Flowvar ‘sets’ are now real time. This was needed to fix some issues where a script was invoked multiple times in single rule, which can happen with some buffers, like HTTP headers.

Also, I implemented flowint support. Flowints in Suricata are integers stored in the flow context.

Suricata Lua scripting flowvar access

Thu, 18 Apr 2013 16:36:56 +0000

Funded by Emerging Threats, I’ve been working on giving the lua scripts access to flowvars.

Currently only “flowvars” are done, “flowints” will be next. Please review the code at: https://github.com/inliniac/suricata/tree/dev-lua-flowvar

Pcre based flowvar capturing is done in a post-match fashion. If the rule containing the “capture” matches, the var is stored in the flow.

For lua scripting, this wasn’t what the rule writers wanted. In this case, the flowvars are stored in the flow regardless of a rule match.

HTTP parsing events in Suricata

Wed, 11 Jan 2012 19:09:17 +0000

With the 1.2rc1 release you will notice no more HTTP errors on the screen. Or SMTP errors. This output has been disabled finally. This was a long time annoyance.

As you may still be interested in the errors they are now available through the rule language. In rules/http-events.rules and rules/smtp-events.rules rules for all possible events/errors can be found.

Example: app-layer-event:http.missing_host_header;

This will match on HTTP/1.1 requests without a Host header.