suricata
detect-lua-extensions.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Functions to expose to the lua scripts.
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "decode.h"
29 #include "detect.h"
30 
31 #include "flow.h"
32 
33 #include "util-debug.h"
34 
35 #include "detect-lua.h"
36 
37 #include "app-layer-parser.h"
38 
39 #include "util-lua.h"
40 #include "util-lua-common.h"
41 #include "util-lua-smtp.h"
42 #include "util-lua-dnp3.h"
43 #include "detect-lua-extensions.h"
44 
45 /* Lua registry key for DetectLuaData. */
46 const char luaext_key_ld[] = "suricata:luadata";
47 
48 static int GetLuaData(lua_State *luastate, DetectLuaData **ret_ld)
49 {
50  *ret_ld = NULL;
51 
52  DetectLuaData *ld;
53  lua_pushlightuserdata(luastate, (void *)&luaext_key_ld);
54  lua_gettable(luastate, LUA_REGISTRYINDEX);
55  ld = lua_touserdata(luastate, -1);
56  if (ld == NULL) {
57  LUA_ERROR("internal error: no ld");
58  }
59  *ret_ld = ld;
60  return 0;
61 }
62 
63 static int LuaGetByteVar(lua_State *luastate)
64 {
65  DetectLuaData *ld = NULL;
66  DetectEngineThreadCtx *det_ctx = LuaStateGetDetCtx(luastate);
67 
68  if (det_ctx == NULL)
69  return LuaCallbackError(luastate, "internal error: no ldet_ctx");
70 
71  int ret = GetLuaData(luastate, &ld);
72  if (ret != 0)
73  return ret;
74 
75  if (!lua_isnumber(luastate, 1)) {
76  LUA_ERROR("bytevar id not a number");
77  }
78  int id = lua_tonumber(luastate, 1);
79  if (id < 0 || id >= DETECT_LUA_MAX_BYTEVARS) {
80  LUA_ERROR("bytevar id out of range");
81  }
82  uint32_t idx = ld->bytevar[id];
83 
84  lua_pushinteger(luastate, det_ctx->byte_values[idx]);
85 
86  return 1;
87 }
88 
90  DetectEngineThreadCtx *det_ctx, Flow *f, Packet *p, const Signature *s, uint8_t flags)
91 {
92  SCLogDebug("det_ctx %p, f %p", det_ctx, f);
93 
94  LuaStateSetSignature(lua_state, s);
95  LuaStateSetFlow(lua_state, f);
96  LuaStateSetDetCtx(lua_state, det_ctx);
97 
98  if (det_ctx->tx_id_set) {
99  if (f && f->alstate) {
100  void *txptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, det_ctx->tx_id);
101  if (txptr) {
102  LuaStateSetTX(lua_state, txptr, det_ctx->tx_id);
103  }
104  }
105  }
106 
107  if (p != NULL)
108  LuaStateSetPacket(lua_state, p);
109 
110  LuaStateSetDirection(lua_state, (flags & STREAM_TOSERVER));
111 }
112 
113 /**
114  * \brief Register Suricata Lua functions
115  */
117 {
118  lua_pushcfunction(lua_state, LuaGetByteVar);
119  lua_setglobal(lua_state, "SCByteVarGet");
120 
121  LuaRegisterFunctions(lua_state);
122  return 0;
123 }
DetectEngineThreadCtx_::byte_values
uint64_t * byte_values
Definition: detect.h:1246
LuaStateSetTX
void LuaStateSetTX(lua_State *luastate, void *txptr, const uint64_t tx_id)
Definition: util-lua.c:150
LuaStateSetPacket
void LuaStateSetPacket(lua_State *luastate, Packet *p)
Definition: util-lua.c:126
DetectLuaData
Definition: detect-lua.h:39
LUA_ERROR
#define LUA_ERROR(msg)
Definition: util-lua-common.h:44
util-lua-common.h
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:270
Flow_::proto
uint8_t proto
Definition: flow.h:378
util-lua.h
LuaCallbackError
int LuaCallbackError(lua_State *luastate, const char *msg)
Definition: util-lua-common.c:39
DetectEngineThreadCtx_::tx_id
uint64_t tx_id
Definition: detect.h:1283
Flow_
Flow data structure.
Definition: flow.h:356
detect-lua.h
LuaStateSetFlow
void LuaStateSetFlow(lua_State *luastate, Flow *f)
set a flow pointer in the lua state
Definition: util-lua.c:176
LuaStateGetDetCtx
DetectEngineThreadCtx * LuaStateGetDetCtx(lua_State *luastate)
get DetectEngineThreadCtx pointer from the lua state
Definition: util-lua.c:239
lua_State
struct lua_State lua_State
Definition: suricata-common.h:523
decode.h
util-debug.h
DetectEngineThreadCtx_
Definition: detect.h:1211
detect.h
DETECT_LUA_MAX_BYTEVARS
#define DETECT_LUA_MAX_BYTEVARS
Definition: detect-lua.h:37
app-layer-parser.h
DetectLuaData::bytevar
uint32_t bytevar[DETECT_LUA_MAX_BYTEVARS]
Definition: detect-lua.h:50
LuaStateSetDetCtx
void LuaStateSetDetCtx(lua_State *luastate, DetectEngineThreadCtx *det_ctx)
Definition: util-lua.c:247
Packet_
Definition: decode.h:492
util-lua-dnp3.h
LuaExtensionsMatchSetup
void LuaExtensionsMatchSetup(lua_State *lua_state, DetectLuaData *ld, DetectEngineThreadCtx *det_ctx, Flow *f, Packet *p, const Signature *s, uint8_t flags)
Definition: detect-lua-extensions.c:89
AppLayerParserGetTx
void * AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id)
Definition: app-layer-parser.c:1108
util-lua-smtp.h
flags
uint8_t flags
Definition: decode-gre.h:0
detect-lua-extensions.h
suricata-common.h
luaext_key_ld
const char luaext_key_ld[]
Definition: detect-lua-extensions.c:46
LuaStateSetDirection
void LuaStateSetDirection(lua_State *luastate, int direction)
Definition: util-lua.c:278
Flow_::alstate
void * alstate
Definition: flow.h:479
Signature_
Signature container.
Definition: detect.h:657
DetectEngineThreadCtx_::tx_id_set
bool tx_id_set
Definition: detect.h:1281
LuaRegisterExtensions
int LuaRegisterExtensions(lua_State *lua_state)
Register Suricata Lua functions.
Definition: detect-lua-extensions.c:116
id
uint32_t id
Definition: detect-flowbits.c:933
flow.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:450
LuaStateSetSignature
void LuaStateSetSignature(lua_State *luastate, const Signature *s)
Definition: util-lua.c:215
LuaRegisterFunctions
int LuaRegisterFunctions(lua_State *luastate)
Definition: util-lua-common.c:155