local var1 = SCByteVarGet(0)
local var2 = SCByteVarGet(1)
- if string.pack(">i4", var1) == "HTTP" and string.pack(">i4", var2) == "/1.1" then
- return 1
- else
- return 0
+ if var1 and var2 then
+ if var1 == 0x48545450 and var2 == 0x2f312e31 then
+ return 1
+ end
end
+ return 0
end
function match(args)
local var2 = SCByteVarGet(0)
- if string.pack(">i4", var2) == "HTTP" then
+ if var2 and var2 == 0x48545450 then
return 1
- else
- return 0
end
+
+ return 0
end
+++ /dev/null
-%YAML 1.1
----
-
-include: ../../etc/suricata-4.0.3.yaml
\ No newline at end of file
requires:
+ min-version: 7
+
features:
- HAVE_LUA
+args:
+ - --set default-rule-path=${TEST_DIR}
+
checks:
- filter:
count: 1
count: 1
match:
alert.signature_id: 2
-