Suricata Lua

Beispiel

• Das folgende Skript loggt HTTP-Anfragen und schreibt sie in http.log
• vim /etc/suricata/lua-output/http.lua

local name = "http.log"

function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end

function setup (args)
    filename = SCLogPath() .. "/" .. name
    file = assert(io.open(filename, "a"))
    SCLogInfo("HTTP Log Filename " .. filename)
    http = 0
end

function log(args)
    http_uri = HttpGetRequestUriRaw()
    if http_uri == nil then
        http_uri = "<unknown>"
    end

    http_uri = string.gsub(http_uri, "%c", ".")
    http_host = HttpGetRequestHost()
    if http_host == nil then
        http_host = "<hostname unknown>"
    end

    http_host = string.gsub(http_host, "%c", ".")
    http_ua = HttpGetRequestHeader("User-Agent")
    if http_ua == nil then
        http_ua = "<useragent unknown>"
    end

    http_ua = string.gsub(http_ua, "%g", ".")
    timestring = SCPacketTimeString()
    ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()
    file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
           http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
           dst_ip .. ":" .. dst_port .. "\n")
    file:flush()
    http = http + 1
end

function deinit (args)
    SCLogInfo ("HTTP transactions logged: " .. http);
    file:close(file)
end

• Lua-Scripting in der Konfiguration aktivieren
• vim /etc/suricata/suricata.yaml

outputs:
  ...
  - lua:
      enabled: yes
      scripts-dir: /etc/suricata/lua-output/
      scripts:
        - http.lua
  ...

• Suricata neustarten
• systemctl restart suricata
• bzw.
• suricatasc -c shutdown
• suricata -D --af-packet
• tail -fn0 /var/log/suricata/http.log

Links

• https://docs.suricata.io/en/suricata-6.0.1/output/lua-output.html#lua-output