inliniac/suricata — pull request #1135 by inliniac (2014-09-24 14:32:29+00:00)
Title: WIP stream payload in lua

Allow a script to set the 'stream' buffer type. This will add the
script to the PMATCH list.

Example script:
alert tcp any any -> any any (content:"html"; lua:stream.lua; sid:1;)

function init (args)
local needs = {}
needs["stream"] = tostring(true)
return needs
end

-- return match via table
function match(args)
local result = {}

b = tostring(args["stream"])
o = tostring(args["offset"])

bo = string.sub(b, o);
print (bo)

return result
end

return 0

Prscript:
- PR build: https://buildbot.openinfosecfoundation.org/builders/inliniac/builds/23
- PR pcaps: https://buildbot.openinfosecfoundation.org/builders/inliniac-pcap/builds/23