lua: always available, vendored and sandboxed - v9

.github/workflows/build-centos-7.yml

@@ -57,7 +57,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -169,7 +168,7 @@ jobs:
           git -c advice.detachedHead=false checkout FETCH_HEAD
 
       - run: ./autogen.sh
-      - run: ./configure
+      - run: ./configure --disable-lua
       - run: make -j ${{ env.CPUS }}
       - run: python3 ./suricata-verify/run.py -q --debug-failed
       - run: make install-full

.github/workflows/builds.yml

@@ -212,7 +212,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -266,7 +265,7 @@ jobs:
           CFLAGS="${DEFAULT_CFLAGS}" ./configure
       - run: make -j ${{ env.CPUS }} distcheck
         env:
-          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
+          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
           MAKEFLAGS: "-j ${{ env.CPUS }}"
       - run: test -e doc/userguide/suricata.1
       - name: Checking includes
@@ -365,7 +364,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -458,7 +456,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -554,7 +551,6 @@ jobs:
                 autoconf \
                 automake \
                 cargo-vendor \
-                cbindgen \
                 diffutils \
                 numactl-devel \
                 dpdk-devel \
@@ -564,7 +560,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -614,6 +609,9 @@ jobs:
       - run: python3 ./suricata-verify/run.py -q --debug-failed
       - run: suricata-update -V
       - run: suricatasc -h
+      # Test build after clean.
+      - run: make clean
+      - run: make -j ${{ env.CPUS }}
 
   centos-stream8:
     name: CentOS Stream 8
@@ -654,7 +652,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -744,7 +741,6 @@ jobs:
                 hiredis-devel \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -841,7 +837,6 @@ jobs:
                 hiredis-devel \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -877,7 +872,7 @@ jobs:
       - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow" ./configure --disable-shared
       - run: make check
       - run: make distclean
-      - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue --enable-lua
+      - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
         env:
           LDFLAGS: "-fsanitize=address"
           ac_cv_func_realloc_0_nonnull: "yes"
@@ -939,7 +934,6 @@ jobs:
                 hiredis-devel \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -1037,7 +1031,6 @@ jobs:
                 hiredis-devel \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -1068,7 +1061,7 @@ jobs:
       - run: tar xf prep/libhtp.tar.gz
       - run: tar xf prep/suricata-update.tar.gz
       - run: ./autogen.sh
-      - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue --enable-lua
+      - run: CC="clang" CFLAGS="$DEFAULT_CFLAGS -Wshadow -fsanitize=address -fno-omit-frame-pointer" ./configure --enable-debug --enable-unittests --disable-shared --enable-rust-strict --enable-hiredis --enable-nfqueue
         env:
           LDFLAGS: "-fsanitize=address"
           ac_cv_func_realloc_0_nonnull: "yes"
@@ -1130,7 +1123,6 @@ jobs:
                 hiredis-devel \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -1215,7 +1207,6 @@ jobs:
                 hiredis-devel \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -1309,7 +1300,6 @@ jobs:
                 gcc \
                 gcc-c++ \
                 git \
-                lua-devel \
                 libasan \
                 libtool \
                 libyaml-devel \
@@ -1380,7 +1370,6 @@ jobs:
                 libhiredis-dev \
                 libhyperscan-dev \
                 libjansson-dev \
-                liblua5.4-dev \
                 libmagic-dev \
                 libnet1-dev \
                 libnetfilter-queue-dev \
@@ -1461,7 +1450,6 @@ jobs:
                 libnuma-dev \
                 libhiredis-dev \
                 libhyperscan-dev \
-                liblua5.1-dev \
                 libjansson-dev \
                 libevent-dev \
                 libevent-pthreads-2.1-7 \
@@ -2042,7 +2030,6 @@ jobs:
                 libnfnetlink0 \
                 libnuma-dev \
                 libhiredis-dev \
-                liblua5.1-dev \
                 libjansson-dev \
                 libevent-dev \
                 libevent-pthreads-2.1-7 \
@@ -2681,7 +2668,6 @@ jobs:
               libmaxminddb-dev \
               libjansson-dev \
               libjansson4 \
-              liblua5.1-dev \
               libnuma-dev \
               liblz4-dev \
               libssl-dev \
@@ -2714,7 +2700,7 @@ jobs:
         # -j2 caused random failures during cargo vendor
       - run: make distcheck
         env:
-          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
+          DISTCHECK_CONFIGURE_FLAGS: "--enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk"
       - run: test -e doc/userguide/suricata.1
       - run: test -e doc/userguide/userguide.pdf
       - name: Building Rust documentation
@@ -2850,7 +2836,6 @@ jobs:
               libmaxminddb-dev \
               libjansson-dev \
               libjansson4 \
-              liblua5.1-dev \
               libnuma-dev \
               liblz4-dev \
               libssl-dev \
@@ -2888,7 +2873,7 @@ jobs:
       - run: tar xf prep/suricata-update.tar.gz
       - run: tar xf prep/suricata-verify.tar.gz
       - run: ./autogen.sh
-      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests --enable-debug --enable-lua --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk
+      - run: CFLAGS="${DEFAULT_CFLAGS}" ./configure --enable-unittests --enable-debug --enable-geoip --enable-profiling --enable-profiling-locks --enable-dpdk
       - run: make -j ${{ env.CPUS }}
       - run: make check
       - name: Building Rust documentation
@@ -2938,7 +2923,6 @@ jobs:
                 libmagic-dev \
                 libjansson-dev \
                 libgeoip-dev \
-                liblua5.1-dev \
                 libhiredis-dev \
                 libevent-dev \
                 libtool \
@@ -3021,7 +3005,6 @@ jobs:
                 libmagic-dev \
                 libjansson-dev \
                 libgeoip-dev \
-                liblua5.1-dev \
                 libhiredis-dev \
                 libevent-dev \
                 libtool \
@@ -3089,7 +3072,6 @@ jobs:
           libtool \
           libyaml \
           pyyaml \
-          lua \
           pcre2 \
           pkg-config \
           python \

.github/workflows/codeql.yml

@@ -52,6 +52,7 @@ jobs:
        sudo apt-get install libssl-dev
        sudo apt-get install libpcre2-dev
        sudo apt-get install libjansson-dev
+       sudo apt-get install liblua5.4-dev
        sudo apt-get install libpcap-dev
        sudo apt-get install libnuma-dev
        git clone --depth 1 https://github.com/OISF/libhtp.git

.github/workflows/commits.yml

@@ -88,7 +88,7 @@ jobs:
               git checkout $rev
               echo "Building rev ${rev}" | tee -a build_log.txt
               ./autogen.sh >> build_log.txt 2>&1
-              CC="sccache gcc" ./configure --enable-unittests >> build_log.txt 2>&1
+              CC="sccache gcc" ./configure --enable-unittests --disable-lua >> build_log.txt 2>&1
               if ! make -j2 >> build_log.txt 2>&1; then
                   echo "::error ::Failed to build rev ${rev}"
                   tail -n 50 build_log.txt

.github/workflows/formatting.yml

@@ -130,7 +130,7 @@ jobs:
         shell: bash {0}
       - run: git clone https://github.com/OISF/libhtp -b 0.5.x
       - run: ./autogen.sh
-      - run: ./configure --enable-unittests
+      - run: ./configure --enable-unittests --disable-lua
       - name: Check formatting
         run: |
           ./scripts/clang-format.sh check-branch --diffstat --show-commits  >> check_formatting_log.txt 2>&1

.github/workflows/rust-checks.yml

@@ -56,7 +56,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \
@@ -141,7 +140,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \

.github/workflows/rust.yml

@@ -44,7 +44,6 @@ jobs:
                 git \
                 jansson-devel \
                 jq \
-                lua-devel \
                 libtool \
                 libyaml-devel \
                 libnfnetlink-devel \

.github/workflows/scan-build.yml

@@ -56,7 +56,6 @@ jobs:
                 libnuma-dev \
                 libhiredis-dev \
                 libhyperscan-dev \
-                liblua5.1-dev \
                 libjansson-dev \
                 libevent-dev \
                 libevent-pthreads-2.1-7 \
@@ -79,7 +78,7 @@ jobs:
       # disable security.insecureAPI.DeprecatedOrUnsafeBufferHandling explicitly as
       # this will require significant effort to address.
       - run: |
-          scan-build-16 --status-bugs --exclude libhtp/ \
+          scan-build-16 --status-bugs --exclude libhtp/ --exclude rust \
                 -enable-checker valist.Uninitialized \
                 -enable-checker valist.CopyToSelf \
                 -enable-checker valist.Unterminated \