forked from OISF/suricata
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
detect/lua: add support for datasets
dataset.new create a dataset object in lua <dataset>:get gets a reference to an existing dataset <dataset>:add returns 1 if a new entry was added returns 0 if entry was already in the set Example: ``` function init (args) local needs = {} needs["packet"] = tostring(true) return needs end function thread_init (args) conn_new, dataset.new() ret, err conn_new:get("conn-seen") if err ~= nil then SCLogWarning("dataset warning: " .. err) return 0 end end function match (args) ipver, srcip, dstip, proto, sp, dp = SCFlowTuple() str = ipver .. ":<" .. srcip .. ">:<" .. dstip .. ">:" .. dp ret, err = conn_new:add(str, #str); if ret == 1 then SCLogInfo(str .. " => " .. ret) end return ret end ``` Ticket: OISF#7243.
- Loading branch information
1 parent
febca27
commit e032c90
Showing
1 changed file
with
118 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters