WIP rule hook initial tests

tests/datasets/datasets-lua-02/dataset-dns.lua

@@ -2,7 +2,6 @@ local dataset = require("suricata.dataset")
 
 function init (args)
     local needs = {}
-    needs["dns.request"] = tostring(true)
     return needs
 end
 

tests/datasets/datasets-lua-02/dataset-lua.rules

@@ -1 +1 @@
-alert dns any any -> any any (flow:to_server; lua:dataset-dns.lua; sid:1;)
+alert dns:request_complete any any -> any any (flow:to_server; lua:dataset-dns.lua; sid:1;)

tests/dns-lua-rules/test-request.lua

@@ -1,6 +1,5 @@
 function init (args)
    local needs = {}
-   needs["dns.request"] = tostring(true)
    return needs
 end
 

tests/dns-lua-rules/test-response.lua

@@ -1,6 +1,5 @@
 function init (args)
    local needs = {}
-   needs["dns.response"] = tostring(true)
    return needs
 end
 

tests/dns-lua-rules/test-rrname.lua

@@ -1,11 +1,10 @@
 function init (args)
    local needs = {}
-   needs["dns.rrname"] = tostring(true)
    return needs
 end
 
 function match(args)
-   rrname = tostring(args["dns.rrname"])
+   rrname = DnsGetDnsRrname()
    if rrname == "www.suricata-ids.org" then
       return 1
    end

tests/dns-lua-rules/test.rules

@@ -1,7 +1,6 @@
-alert dns any any -> any any (msg:"TEST DNS LUA dns.rrname"; \
+alert dns:request_complete any any -> any any (msg:"TEST DNS LUA dns.rrname"; \
       lua:test-rrname.lua; sid:1; rev:1;)
-alert dns any any -> any any (msg:"TEST DNS LUA dns.request"; \
+alert dns:request_complete any any -> any any (msg:"TEST DNS LUA dns.request"; \
       lua:test-request.lua; sid:2; rev:1;)
-alert dns any any -> any any (msg:"TEST DNS LUA dns.response"; \
-      lua:test-response.lua; sid:3; rev:1;)
-
+alert dns:response_complete any any -> any any (msg:"TEST DNS LUA dns.response"; \
+      lua:test-response.lua; sid:3; rev:1;) 

tests/lua-memleak/test.lua

@@ -1,6 +1,5 @@
 function init (args)
     local needs = {}
-    needs["http.request_headers"] = tostring(true)
     return needs
 end
 

tests/lua-memleak/test.rules

@@ -1 +1 @@
-alert http any any -> any any (msg: "Test1"; flow: to_server; lua:test.lua; sid:6677001; rev:1;)
+alert http1:request_complete any any -> any any (msg: "Test1"; flow: to_server; lua:test.lua; sid:6677001; rev:1;)

tests/lua-output-dns-pre8/README.md

@@ -0,0 +1,3 @@
+Tests the output of DNS being logged by Lua.
+
+PCAPs created by Jason Ish.

tests/lua-output-dns-pre8/suricata.yaml

@@ -0,0 +1,13 @@
+%YAML 1.1
+---
+
+include: ../../etc/suricata-3.1.2.yaml
+
+rule-files:
+
+outputs:
+  - lua:
+      enabled: yes
+      scripts-dir: .
+      scripts:
+        - test.lua

tests/lua-output-dns-pre8/test.lua

@@ -0,0 +1,95 @@
+filename = "lua-dns.log"
+
+function init (args)
+   local needs = {}
+   needs["protocol"] = "dns"
+   return needs
+end
+
+function setup (args)
+   SCLogNotice("lua: setup()")
+   file = assert(io.open(SCLogPath() .. "/" .. filename, "w"))
+end
+
+function log(args)
+   ts = SCPacketTimeString()
+   ip_ver, src_ip, dst_ip, proto, sp, dp = SCFlowTuple()
+   tx_id = DnsGetTxid()
+
+   queries = DnsGetQueries()
+   if queries ~= nil then
+      for n, t in pairs(queries) do
+	 msg = string.format(
+	    "%s [**] Query TX %04x [**] %s [**] %s [**] %s:%d -> %s:%d",
+	    ts,
+	    tx_id,
+	    t["rrname"],
+	    t["type"],
+	    src_ip,
+	    sp,
+	    dst_ip,
+	    dp)
+	 write(msg)
+      end
+   end
+
+   rcode = DnsGetRcode()
+   if rcode ~= nil then
+      msg = string.format(
+	 "%s [**] Response TX %04x [**] %s [**] %s:%d -> %s:%d",
+	 ts,
+	 tx_id,
+	 rcode,
+	 src_ip,
+	 sp,
+	 dst_ip,
+	 dp)
+      write(msg)
+   end
+
+   answers = DnsGetAnswers()
+   if answers ~= nil then
+      for n, t in pairs(answers) do
+	 msg = string.format(
+	    "%s [**] Response TX %04x [**] %s [**] %s [**] TTL %d [**] %s [**] %s:%d -> %s:%d",
+	    ts,
+	    tx_id,
+	    t["rrname"],
+	    t["type"],
+	    t["ttl"],
+	    t["addr"],
+	    src_ip,
+	    sp,
+	    dst_ip,
+	    dp);
+	 write(msg)
+      end
+   end
+
+   authorities = DnsGetAuthorities()
+   if authorities ~= nil then
+      for n, t in pairs(authorities) do
+	 msg = string.format(
+	    "%s [**] Response TX %04x [**] %s [**] %s [**] TTL %d [**] %s:%d -> %s:%d",
+	    ts,
+	    tx_id,
+	    t["rrname"],
+	    t["type"],
+	    t["ttl"],
+	    src_ip,
+	    sp,
+	    dst_ip,
+	    dp);
+	 write(msg)
+      end
+   end
+
+end
+
+function deinit(args)
+   file:close(file)
+end
+
+function write(msg)
+   file:write(msg .. "\n")
+end

tests/lua-output-dns-pre8/test.yaml

@@ -0,0 +1,19 @@
+requires:
+  features:
+    - HAVE_LUA
+  lt-version: 8
+
+pcap: ../lua-output-dns/test.pcap
+
+checks:
+  - shell:
+      args: grep -q "Query TX 0d4f \[\*\*\] block.dropbox.com \[\*\*\] A \[\*\*\] 10.16.1.11:49697 -> 10.16.1.1:53" lua-dns.log
+  - shell:
+      args: cat lua-dns.log | grep Response | grep client-cf.dropbox.com | wc -l
+      expect: 2
+  - shell:
+      args: cat lua-dns.log | grep "Response TX 62b2" | grep NXDOMAIN | wc -l
+      expect: 1
+  - shell:
+      args: grep SOA lua-dns.log | wc -l
+      expect: 1

tests/lua-output-dns/test.lua

@@ -1,3 +1,5 @@
+local packet = require "suricata.packet"
+
 filename = "lua-dns.log"
 
 function init (args)
@@ -12,7 +14,8 @@ function setup (args)
 end
 
 function log(args)
-   ts = SCPacketTimeString()
+   p = packet.get()
+   ts = p:timestring()
    ip_ver, src_ip, dst_ip, proto, sp, dp = SCFlowTuple()
    tx_id = DnsGetTxid()
 

tests/lua-output-dns/test.yaml

@@ -1,4 +1,5 @@
 requires:
+  min-version: 8
   features:
     - HAVE_LUA
 

tests/lua-output-http-pre8/README.md

@@ -0,0 +1 @@
+Test Lua output of HTTP metadata.