Lua Script in suricata to detect the change in file - lua

I am new in lua programming. I was looking for a lua script that can read the file being downloaded through Suricata from the internet and detect if file is changed. Any help would be appreciated. Thanks in advance.
Something like this:
function init(args)
return {http.response_body = tostring(true)}
end
local function read_file(path)
local file = open(path, "rb") -- r read mode and b binary mode
if not file then return nil end
local content = file:read "*a" -- *a or *all reads the whole file
file:close()
return content
end
local fileContent = read_file(path-to-where-previous-file-is-stored);
local fileContent2 = read_file(init());
if fileContent != fileContent2:
print("File changed")
and block if contents are same
drop http any any -> any any (msg:"NVISO PDF file lua"; flow:established,to_client; luajit:pdfcheckname.lua; classtype:policy-violation; sid:1000000; rev:1;)

Unless you have some other open function that is now shown in your snippet local file = open(path, "rb") should be replaced with local file = io.open(path, "rb")
local fileContent2 = read_file(init()); will cause problems as init() will return a table, not a path string. This will cause an error when calling io.open
if fileContent != fileContent2:
print("File changed")
is syntactically incorrect.
Replace it with
if fileContent != fileContent2 then
print("File Changed")
end
Also a name like file2Content would make more sense as it is not the second content of file but the content of file 2. But that's just my personal opinion.

Related

Issues with LUA copy

I am using the following program to copy one file another. I am often seeing source and destination is not exactly the same (md5sum is different). Are there anything wrong with the below code?
local size = 2^13 -- good buffer size (8K)
local params = {...}
local srcfile = params[1]
local outfile = params[1] .. "_copy"
print (srcfile)
print (outfile)
local inf = io.open(srcfile, "r")
local of = io.open(outfile, "w")
while true do
local block = inf:read(size)
print(size)
if not block then break end
of:write(block)
end
inf:close()
of:close()
Thanks,
GL
You may want to use binary mode to ensure endline characters were not modified.
local inf = io.open(srcfile, "rb")
local of = io.open(outfile, "wb")

Thrift Example in Lua

Where can I find an example of how to load a Thrift file in lua?
My code so far is below. I can't figure out how to create memory buffer. It fails at TMemoryBuffer:new()
local fullpath = FullPath("ConfigData.bin")
local infile = io.open(fullpath, "rb")
local buffer = infile:read("*all")
local transport1 = TMemoryBuffer:new()
transport1:resetBuffer(buffer)
local transport = TFramedTransportFactory:getTransport(transport1) local protocol = TBinaryProtocolFactory:getProtocol(transport)
flux.assert(protocol)
Data:read(protocol)
Here is a working example:
local fullpath = FullPath("ConfigData.bin")
local infile = io.open(fullpath, "rb")
local buffer = infile:read("*all")
TMemoryBuffer:resetBuffer(buffer)
local protocol = TBinaryProtocolFactory:getProtocol(TMemoryBuffer)
Data:read(protocol)

Reading artist metadata from DBus in lua script - weird output

I'm trying to reading in DBus metadata from nuvolaplayer in a Lua script. The (track) title and album fields display as expect, but the artist data appears oddly:
lgi.rec 0x7f9ee8005c90:GLib.Variant Underwater Dub Dictionary
Where "Sly & Robbie" is expected in place of "lgi.rec 0x7f9ee8005c90:GLib.Variant".
When I look at the value using d-feet, I can see that the xesam:artist field differs from the others in being surrounded by []s.
Here's the code I'm using:
local lgi = require 'lgi'
local Gio = lgi.require 'Gio'
local core = require 'lgi.core'
local GLib = lgi.require 'GLib'
local type,unpack = type,unpack
local bus = Gio.bus_get_sync(Gio.BusType.SESSION)
local ret,err = bus:call(
"org.mpris.MediaPlayer2.nuvolaplayer",
--"org.gnome.Rhythmbox3",
"/org/mpris/MediaPlayer2",
"org.freedesktop.DBus.Properties",
"GetAll",
GLib.Variant.new_tuple(
{
GLib.Variant("s","org.mpris.MediaPlayer2.Player")
}, 1),
nil,
Gio.DBusConnectionFlags.NONE,
-1, -- Timeout
nil, -- Cancellable
function(conn, res)
local ret, err = bus:call_finish(res)
print("here",err)
local returnValue1, returnValue2 = unpack(ret.value)
if not err then
print("META", returnValue1.Metadata["xesam:artist"],
returnValue1.Metadata["xesam:album"],
returnValue1.Metadata["xesam:title"])
end
end
)
local main_loop = GLib.MainLoop()
main_loop:run()
The field xesam:artist is a list/array of strings (artists). Maybe Lua needs special handling of this type for printing, for example iterate the array and extract plain strings from it.

vlc lua: how do I get the full path of the current playing item?

I'm not a programmer so this is difficult for me. I want to make an extension to send the full path to the clipboard in the full format. Example:
D:\MyFolder\music\audio.mp3
I recently found and butchered this extension which sends the running time to the clipboard. Is it possible to modify it so it gets the full path instead of the running time?
I'm using VLC media player 2.0.5 Twoflower 32 bits.
Windows 7 professional 32bits SP1
Here's the content of the .lua file I'm using and want to modify:
-- Time2Clip.lua -- VLC extension --
--[[
INSTALLATION:
Put the file in the VLC subdir /lua/extensions, by default:
* Windows (all users): %ProgramFiles%\VideoLAN\VLC\lua\extensions\
Restart the VLC.
Then you simply use the extension by going to the "View" menu and selecting it.
--]]
function descriptor()
return {
title = "Time2Clip";
version = "1.0";
author = "valuex";
url = 'https://forum.videolan.org/viewtopic.php?f=29&t=101114';
shortdesc = "Time2Clip";
description = "<div style=\"background-color:lightgreen;\"><b>just a simple VLC extension </b></div>";
capabilities = {"input-listener"}
}
end
function activate()
create_dialog()
end
function close()
vlc.deactivate()
end
function create_dialog()
w = vlc.dialog("Time2Clip")
--w2 = w:add_button("Save_to_Clip", click_SAVE,2,1,1,1)
click_SAVE()
end
function click_SAVE()
local input = vlc.object.input()
if input then
local curtime=vlc.path()
-- local curtime=vlc.var.get(input, "time")
-- w2:set_text( curtime )
save_to_clipboard(curtime)
end
end
function save_to_clipboard(var)
strCmd = 'echo '..var..' |clip'
os.execute(strCmd)
vlc.deactivate()
end
I read LUA's README.TXT file and found this but I don't know how to use it. Please help me. Thanks in advance.
input.item(): Get the current input item. Input item methods are:
:uri(): Get item's URI.
:name(): Get item's name.
How about:
function descriptor()
return {
title = "URI2Clip";
version = "1.0";
author = "";
url = '';
shortdesc = "URI2Clip";
description = "<div><b>Copy the media URI to the Windows clipboard</b></div>";
}
end
function activate()
local item = vlc.input.item()
local uri = item:uri()
uri = string.gsub(uri, '^file:///', '')
uri = string.gsub(uri, '/', '\\')
strCmd = 'echo '..uri..' |clip'
os.execute(strCmd)
end
URI returns something like file:///c:/users/username/Documents/song.mp3 so I convert that to c:\users\username... format instead. NB. This is only going to work for saved files, it will mangle web addresses.

Lua: getting the latest line in external txt file

I am having a lua function to reading and writing a txt file, I need every time lua write in at a new line instead of replacing the previous write in. How do I do that? Do I need to read in and get the lines 1st every time before I write in?
Here is my code:
local function FileOutput(name)
local f = io.open(name, "w+")
local meta = {
__call = function(t, str) f:write(str .. '\n') end,
__gc = function() f:close() end
}
return setmetatable({}, meta)
end
function writeRec()
LOG("writing")
local testfile = FileOutput(getScriptDirectory()..'/textOutput.txt')
testfile('oh yes!')
testfile = nil
end
Have you tried a+ instead of w+?
http://www.lua.org/manual/5.1/manual.html#pdf-io.open

Resources