transform: luaxform transform script

[jlucovsky]

Continuation of #11860

Add the luaxform transform that uses a Lua script to receive and transform a sticky buffer.

Lua transforms receive arguments

• (always): length of input buffer and input buffer
• (always): number of additional arguments (may be 0)
• (when present): argument array (bounded by argument count)

Arguments are passed to the lua script as they appear in the rule:

 luaxform:./lua/lua-transform.lua, bytes 4, offset 13, hash sha256;

When the transform is invoked, 3 additional arguments are passed (arg count will be 3)

• bytes 4
• offset 13
• hash sha256

The Lua script is responsible for parsing and using the arguments and returning a tuple: output-buffer, output-buffer-byte-count

I used this lua script:

function init (args)
    local needs = {}
    return needs
end

function transform(input_len, input, argc, args)
    SCLogNotice("Input length: " .. input_len .. " arg-count: " .. argc)
    for i = 1, argc do
        print("Argument " .. i .. ":", args[i])
    end
    return string.upper(input), input_len
end

return 0

Example rule using the lua script:

alert http any any -> any any (msg:"Lua Xform example"; flow:established;  file.data; luaxform:./lua/lua-transform.lua; content: "abc"; sid: 1;)

Link to ticket: https://redmine.openinfosecfoundation.org/issues/2290

Describe changes:

• Luaxform transform changes

Updates

• Fixed ASAN issues with unittests (discovered in CI).

Provide values to any of the below to override the defaults.

• To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2044
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[suricata-qa]

ERROR:
ERROR: ASAN TEST FAIL in ASAN_TLPR1_cfg QA test

ERROR: QA failed on ASAN_TLPR1_cfg.

Pipeline 22992

[codecov]

Codecov Report

Attention: Patch coverage is 77.21088% with 67 lines in your changes missing coverage. Please review.

Project coverage is 82.61%. Comparing base (3f0512e) to head (7fde97a).

Additional details and impacted files

@@           Coverage Diff            @@
##           master   #11876    +/-   ##
========================================
  Coverage   82.61%   82.61%            
========================================
  Files         912      915     +3     
  Lines      249354   249595   +241     
========================================
+ Hits       205992   206194   +202     
- Misses      43362    43401    +39     

Flag	Coverage Δ
fuzzcorpus	60.56% <28.17%> (-0.07%)	⬇️
livemode	18.72% <15.46%> (-0.13%)	⬇️
pcap	44.08% <18.55%> (-0.01%)	⬇️
suricata-verify	62.02% <76.63%> (+0.02%)	⬆️
unittests	58.89% <22.10%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 22993

[jufajardini]

A few doc comments...

[jufajardini]

Just for the sake of extra clarity, should we add something about how the script should be called, via a rule?

Maybe just bring one of the examples that are further below here to help illustrate it right from the beginning...

[jlucovsky]

Continued in #11892