luajit: SCFlowvarGet always returns null
Scenario: I want to manipulate a flow variable that I've extracted with a PCRE with a Lua script. Whenever I call the SCFlowvarGet method in the Lua script it returns "null" and not the value of the flow variable as it should.
Attached you can find the files that I am using (PCAP, rules, lua).
I'm using the following Suricata call:
suricata -v -r /home/suricata/test.pcap -S /etc/suricata/rules/test.rules -k none
As you can see out of the resulting eve.json file (attached) the rule works and also the variable is extracted. Furthermore the lua script is triggered and executed as the print commands of the lua script are in the console output. Also you can see in the console output that the "testVar" is not set (in my opinion it should be set there). It this a bug or am I doing something wrong in the script?
Updated by Philippe Antoine about 2 years ago
Chris, here is a setup that does what you expect I think :
The problem is that during detection, the steps happen in this order :
- pattern matching
- lua script execution
- setting flow variables as part of post match
So, a workaround is to have 2 rules :
- one that does the pattern matching and setting the flow var
- another second one that does the Lua script
Maybe you also want to use the
flowvar keyword in the second rule, but you cannot just test if it is set, you need to find for a pattern in it like
alert http any any -> any any (msg: "Test2"; lua:test.lua; flowvar: TestVar,zib; sid:6677001; rev:1;)
You may also want to use sticky buffers and pcrexform to get what you are looking for...