Lua output script for Suricata

headers_db.lua

function init (args)
    local needs = {}
    needs["protocol"] = "http"
    return needs
end

function setup (args)
    sqlite3, errmsg = require("lsqlite3")
    db = sqlite3.open_memory()
    db:exec[[CREATE TABLE headers (id INTEGER PRIMARY KEY, header);]]
end

function log(args)
    a = HttpGetRequestHeaders();
    for n, v in pairs(a) do
        local stmt = db:prepare[[ INSERT INTO headers VALUES (:key, :header) ]]
        stmt:bind_names{ key = NULL, header = n}
        stmt:step()
        stmt:finalize()
    end

end

function deinit (args)
    print ("Request Headers:")
    for row in db:nrows("SELECT header, COUNT(*) as count FROM headers GROUP BY header") do
        print(row.count, row.header)
    end
end