suricata
util-lua-common.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Common function for Lua Output
24  */
25 
26 #include "suricata-common.h"
27 #include "debug.h"
28 #include "detect.h"
29 #include "pkt-var.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 
36 #include "util-print.h"
37 #include "util-unittest.h"
38 
39 #include "util-debug.h"
40 
41 #include "output.h"
42 #include "app-layer-htp.h"
43 #include "app-layer.h"
44 #include "app-layer-parser.h"
45 #include "util-privs.h"
46 #include "util-buffer.h"
47 #include "util-proto-name.h"
48 #include "util-logopenfile.h"
49 #include "util-time.h"
50 
51 #ifdef HAVE_LUA
52 
53 #include <lua.h>
54 #include <lualib.h>
55 #include <lauxlib.h>
56 
57 #include "util-lua.h"
58 #include "util-lua-common.h"
59 
60 int LuaCallbackError(lua_State *luastate, const char *msg)
61 {
62  lua_pushnil(luastate);
63  lua_pushstring(luastate, msg);
64  return 2;
65 }
66 
67 const char *LuaGetStringArgument(lua_State *luastate, int argc)
68 {
69  /* get argument */
70  if (!lua_isstring(luastate, argc))
71  return NULL;
72  const char *str = lua_tostring(luastate, argc);
73  if (str == NULL)
74  return NULL;
75  if (strlen(str) == 0)
76  return NULL;
77  return str;
78 }
79 
80 void LuaPushTableKeyValueInt(lua_State *luastate, const char *key, int value)
81 {
82  lua_pushstring(luastate, key);
83  lua_pushnumber(luastate, value);
84  lua_settable(luastate, -3);
85 }
86 
87 /** \brief Push a key plus string value to the stack
88  *
89  * If value is NULL, string "(null")" will be put on the stack.
90  */
91 void LuaPushTableKeyValueString(lua_State *luastate, const char *key, const char *value)
92 {
93  lua_pushstring(luastate, key);
94  lua_pushstring(luastate, value ? value : "(null)");
95  lua_settable(luastate, -3);
96 }
97 
98 void LuaPushTableKeyValueArray(lua_State *luastate, const char *key, const uint8_t *value, size_t len)
99 {
100  lua_pushstring(luastate, key);
101  LuaPushStringBuffer(luastate, value, len);
102  lua_settable(luastate, -3);
103 }
104 
105 /** \internal
106  * \brief fill lua stack with payload
107  * \param luastate the lua state
108  * \param p packet
109  * \retval cnt number of data items placed on the stack
110  *
111  * Places: payload (string), open (bool), close (bool), toserver (bool), toclient (bool)
112  */
113 static int LuaCallbackStreamingBufferPushToStack(lua_State *luastate, const LuaStreamingBuffer *b)
114 {
115  //PrintRawDataFp(stdout, (uint8_t *)b->data, b->data_len);
116  lua_pushlstring (luastate, (const char *)b->data, b->data_len);
117  lua_pushboolean (luastate, (b->flags & OUTPUT_STREAMING_FLAG_OPEN));
118  lua_pushboolean (luastate, (b->flags & OUTPUT_STREAMING_FLAG_CLOSE));
119  lua_pushboolean (luastate, (b->flags & OUTPUT_STREAMING_FLAG_TOSERVER));
120  lua_pushboolean (luastate, (b->flags & OUTPUT_STREAMING_FLAG_TOCLIENT));
121  return 5;
122 }
123 
124 /** \internal
125  * \brief Wrapper for getting payload into a lua script
126  * \retval cnt number of items placed on the stack
127  */
128 static int LuaCallbackStreamingBuffer(lua_State *luastate)
129 {
130  const LuaStreamingBuffer *b = LuaStateGetStreamingBuffer(luastate);
131  if (b == NULL)
132  return LuaCallbackError(luastate, "internal error: no buffer");
133 
134  return LuaCallbackStreamingBufferPushToStack(luastate, b);
135 }
136 
137 /** \internal
138  * \brief fill lua stack with payload
139  * \param luastate the lua state
140  * \param p packet
141  * \retval cnt number of data items placed on the stack
142  *
143  * Places: payload (string)
144  */
145 static int LuaCallbackPacketPayloadPushToStackFromPacket(lua_State *luastate, const Packet *p)
146 {
147  lua_pushlstring (luastate, (const char *)p->payload, p->payload_len);
148  return 1;
149 }
150 
151 /** \internal
152  * \brief Wrapper for getting payload into a lua script
153  * \retval cnt number of items placed on the stack
154  */
155 static int LuaCallbackPacketPayload(lua_State *luastate)
156 {
157  const Packet *p = LuaStateGetPacket(luastate);
158  if (p == NULL)
159  return LuaCallbackError(luastate, "internal error: no packet");
160 
161  return LuaCallbackPacketPayloadPushToStackFromPacket(luastate, p);
162 }
163 
164 /** \internal
165  * \brief fill lua stack with packet timestamp
166  * \param luastate the lua state
167  * \param p packet
168  * \retval cnt number of data items placed on the stack
169  *
170  * Places: seconds (number), microseconds (number)
171  */
172 static int LuaCallbackTimestampPushToStack(lua_State *luastate, const struct timeval *ts)
173 {
174  lua_pushnumber(luastate, (double)ts->tv_sec);
175  lua_pushnumber(luastate, (double)ts->tv_usec);
176  return 2;
177 }
178 
179 /** \internal
180  * \brief fill lua stack with header info
181  * \param luastate the lua state
182  * \param p packet
183  * \retval cnt number of data items placed on the stack
184  *
185  * Places: ts (string)
186  */
187 static int LuaCallbackTimeStringPushToStackFromPacket(lua_State *luastate, const Packet *p)
188 {
189  char timebuf[64];
190  CreateTimeString(&p->ts, timebuf, sizeof(timebuf));
191  lua_pushstring (luastate, timebuf);
192  return 1;
193 }
194 
195 /** \internal
196  * \brief Wrapper for getting packet timestamp (as numbers) into a lua script
197  * \retval cnt number of items placed on the stack
198  */
199 static int LuaCallbackPacketTimestamp(lua_State *luastate)
200 {
201  const Packet *p = LuaStateGetPacket(luastate);
202  if (p == NULL)
203  return LuaCallbackError(luastate, "internal error: no packet");
204 
205  return LuaCallbackTimestampPushToStack(luastate, &p->ts);
206 }
207 
208 /** \internal
209  * \brief Wrapper for getting tuple info into a lua script
210  * \retval cnt number of items placed on the stack
211  */
212 static int LuaCallbackPacketTimeString(lua_State *luastate)
213 {
214  const Packet *p = LuaStateGetPacket(luastate);
215  if (p == NULL)
216  return LuaCallbackError(luastate, "internal error: no packet");
217 
218  return LuaCallbackTimeStringPushToStackFromPacket(luastate, p);
219 }
220 
221 /** \internal
222  * \brief fill lua stack with flow timestamps
223  * \param luastate the lua state
224  * \param startts timestamp of first packet in the flow
225  * \param lastts timestamp of last packet in the flow
226  * \retval cnt number of data items placed on the stack
227  *
228  * Places: seconds (number), seconds (number), microseconds (number),
229  * microseconds (number)
230  */
231 static int LuaCallbackFlowTimestampsPushToStack(lua_State *luastate,
232  const struct timeval *startts,
233  const struct timeval *lastts)
234 {
235  lua_pushnumber(luastate, (double)startts->tv_sec);
236  lua_pushnumber(luastate, (double)lastts->tv_sec);
237  lua_pushnumber(luastate, (double)startts->tv_usec);
238  lua_pushnumber(luastate, (double)lastts->tv_usec);
239  return 4;
240 }
241 
242 /** \internal
243  * \brief Wrapper for getting flow timestamp (as numbers) into a lua script
244  * \retval cnt number of items placed on the stack
245  */
246 static int LuaCallbackFlowTimestamps(lua_State *luastate)
247 {
248  Flow *flow = LuaStateGetFlow(luastate);
249  if (flow == NULL) {
250  return LuaCallbackError(luastate, "internal error: no flow");
251  }
252 
253  return LuaCallbackFlowTimestampsPushToStack(luastate, &flow->startts,
254  &flow->lastts);
255 }
256 
257 /** \internal
258  * \brief fill lua stack with time string
259  * \param luastate the lua state
260  * \param flow flow
261  * \retval cnt number of data items placed on the stack
262  *
263  * Places: ts (string)
264  */
265 static int LuaCallbackTimeStringPushToStackFromFlow(lua_State *luastate, const Flow *flow)
266 {
267  char timebuf[64];
268  CreateTimeString(&flow->startts, timebuf, sizeof(timebuf));
269  lua_pushstring (luastate, timebuf);
270  return 1;
271 }
272 
273 /** \internal
274  * \brief Wrapper for getting ts info into a lua script
275  * \retval cnt number of items placed on the stack
276  */
277 static int LuaCallbackFlowTimeString(lua_State *luastate)
278 {
279  int r = 0;
280  Flow *flow = LuaStateGetFlow(luastate);
281  if (flow == NULL)
282  return LuaCallbackError(luastate, "internal error: no flow");
283 
284  r = LuaCallbackTimeStringPushToStackFromFlow(luastate, flow);
285 
286  return r;
287 }
288 
289 /** \internal
290  * \brief fill lua stack with flow has alerts
291  * \param luastate the lua state
292  * \param flow flow
293  * \retval cnt number of data items placed on the stack
294  *
295  * Places alerts (bool)
296  */
297 static int LuaCallbackHasAlertsPushToStackFromFlow(lua_State *luastate, const Flow *flow)
298 {
299  lua_pushboolean(luastate, FlowHasAlerts(flow));
300 
301  return 1;
302 }
303 
304 /** \internal
305  * \brief Wrapper for getting flow has alerts info into a lua script
306  * \retval cnt number of items placed on the stack
307  */
308 static int LuaCallbackFlowHasAlerts(lua_State *luastate)
309 {
310  int r = 0;
311  Flow *flow = LuaStateGetFlow(luastate);
312  if (flow == NULL)
313  return LuaCallbackError(luastate, "internal error: no flow");
314 
315  r = LuaCallbackHasAlertsPushToStackFromFlow(luastate, flow);
316 
317  return r;
318 }
319 
320 /** \internal
321  * \brief fill lua stack with header info
322  * \param luastate the lua state
323  * \param p packet
324  * \retval cnt number of data items placed on the stack
325  *
326  * Places: ipver (number), src ip (string), dst ip (string), protocol (number),
327  * sp or icmp type (number), dp or icmp code (number).
328  */
329 static int LuaCallbackTuplePushToStackFromPacket(lua_State *luastate, const Packet *p)
330 {
331  int ipver = 0;
332  if (PKT_IS_IPV4(p)) {
333  ipver = 4;
334  } else if (PKT_IS_IPV6(p)) {
335  ipver = 6;
336  }
337  lua_pushnumber (luastate, ipver);
338  if (ipver == 0)
339  return 1;
340 
341  char srcip[46] = "", dstip[46] = "";
342  if (PKT_IS_IPV4(p)) {
343  PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
344  PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
345  } else if (PKT_IS_IPV6(p)) {
346  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
347  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
348  }
349 
350  lua_pushstring (luastate, srcip);
351  lua_pushstring (luastate, dstip);
352 
353  /* proto and ports (or type/code) */
354  lua_pushnumber (luastate, p->proto);
355  if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) {
356  lua_pushnumber (luastate, p->sp);
357  lua_pushnumber (luastate, p->dp);
358 
359  } else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
360  lua_pushnumber (luastate, p->icmp_s.type);
361  lua_pushnumber (luastate, p->icmp_s.code);
362  } else {
363  lua_pushnumber (luastate, 0);
364  lua_pushnumber (luastate, 0);
365  }
366 
367  return 6;
368 }
369 
370 /** \internal
371  * \brief Wrapper for getting tuple info into a lua script
372  * \retval cnt number of items placed on the stack
373  */
374 static int LuaCallbackTuple(lua_State *luastate)
375 {
376  const Packet *p = LuaStateGetPacket(luastate);
377  if (p == NULL)
378  return LuaCallbackError(luastate, "internal error: no packet");
379 
380  return LuaCallbackTuplePushToStackFromPacket(luastate, p);
381 }
382 
383 /** \internal
384  * \brief fill lua stack with header info
385  * \param luastate the lua state
386  * \param f flow, locked
387  * \retval cnt number of data items placed on the stack
388  *
389  * Places: ipver (number), src ip (string), dst ip (string), protocol (number),
390  * sp or icmp type (number), dp or icmp code (number).
391  */
392 static int LuaCallbackTuplePushToStackFromFlow(lua_State *luastate, const Flow *f)
393 {
394  int ipver = 0;
395  if (FLOW_IS_IPV4(f)) {
396  ipver = 4;
397  } else if (FLOW_IS_IPV6(f)) {
398  ipver = 6;
399  }
400  lua_pushnumber (luastate, ipver);
401  if (ipver == 0)
402  return 1;
403 
404  char srcip[46] = "", dstip[46] = "";
405  if (FLOW_IS_IPV4(f)) {
406  PrintInet(AF_INET, (const void *)&(f->src.addr_data32[0]), srcip, sizeof(srcip));
407  PrintInet(AF_INET, (const void *)&(f->dst.addr_data32[0]), dstip, sizeof(dstip));
408  } else if (FLOW_IS_IPV6(f)) {
409  PrintInet(AF_INET6, (const void *)&(f->src.address), srcip, sizeof(srcip));
410  PrintInet(AF_INET6, (const void *)&(f->dst.address), dstip, sizeof(dstip));
411  }
412 
413  lua_pushstring (luastate, srcip);
414  lua_pushstring (luastate, dstip);
415 
416  /* proto and ports (or type/code) */
417  lua_pushnumber (luastate, f->proto);
418  if (f->proto == IPPROTO_TCP || f->proto == IPPROTO_UDP) {
419  lua_pushnumber (luastate, f->sp);
420  lua_pushnumber (luastate, f->dp);
421 
422  } else if (f->proto == IPPROTO_ICMP || f->proto == IPPROTO_ICMPV6) {
423  lua_pushnumber (luastate, f->icmp_s.type);
424  lua_pushnumber (luastate, f->icmp_s.code);
425  } else {
426  lua_pushnumber (luastate, 0);
427  lua_pushnumber (luastate, 0);
428  }
429 
430  return 6;
431 }
432 
433 /** \internal
434  * \brief Wrapper for getting tuple info into a lua script
435  * \retval cnt number of items placed on the stack
436  */
437 static int LuaCallbackTupleFlow(lua_State *luastate)
438 {
439  int r = 0;
440  Flow *f = LuaStateGetFlow(luastate);
441  if (f == NULL)
442  return LuaCallbackError(luastate, "internal error: no flow");
443 
444  r = LuaCallbackTuplePushToStackFromFlow(luastate, f);
445 
446  return r;
447 }
448 
449 /** \internal
450  * \brief fill lua stack with AppLayerProto
451  * \param luastate the lua state
452  * \param alproto AppProto to push to stack as string
453  * \retval cnt number of data items placed on the stack
454  *
455  * Places: alproto as string (string)
456  */
457 static int LuaCallbackAppLayerProtoPushToStackFromFlow(lua_State *luastate, const AppProto alproto)
458 {
459  const char *string = AppProtoToString(alproto);
460  if (string == NULL)
461  string = "unknown";
462  lua_pushstring(luastate, string);
463  return 1;
464 }
465 
466 /** \internal
467  * \brief Wrapper for getting AppLayerProto info into a lua script
468  * \retval cnt number of items placed on the stack
469  */
470 static int LuaCallbackAppLayerProtoFlow(lua_State *luastate)
471 {
472  int r = 0;
473  Flow *f = LuaStateGetFlow(luastate);
474  if (f == NULL)
475  return LuaCallbackError(luastate, "internal error: no flow");
476 
477  r = LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->alproto);
478  r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->alproto_ts);
479  r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->alproto_tc);
480  r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->alproto_orig);
481  r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->alproto_expect);
482 
483  return r;
484 }
485 
486 /** \internal
487  * \brief fill lua stack with flow stats
488  * \param luastate the lua state
489  * \param f flow, locked
490  * \retval cnt number of data items placed on the stack
491  *
492  * Places: ts pkts (number), ts bytes (number), tc pkts (number), tc bytes (number)
493  */
494 static int LuaCallbackStatsPushToStackFromFlow(lua_State *luastate, const Flow *f)
495 {
496  lua_pushnumber(luastate, f->todstpktcnt);
497  lua_pushnumber(luastate, f->todstbytecnt);
498  lua_pushnumber(luastate, f->tosrcpktcnt);
499  lua_pushnumber(luastate, f->tosrcbytecnt);
500  return 4;
501 }
502 
503 /** \internal
504  * \brief Wrapper for getting AppLayerProto info into a lua script
505  * \retval cnt number of items placed on the stack
506  */
507 static int LuaCallbackStatsFlow(lua_State *luastate)
508 {
509  int r = 0;
510  Flow *f = LuaStateGetFlow(luastate);
511  if (f == NULL)
512  return LuaCallbackError(luastate, "internal error: no flow");
513 
514  r = LuaCallbackStatsPushToStackFromFlow(luastate, f);
515 
516  return r;
517 }
518 
519 /** \internal
520  * \brief fill lua stack with flow id
521  * \param luastate the lua state
522  * \param f flow, locked
523  * \retval cnt number of data items placed on the stack
524  *
525  * Places: flow id (number)
526  */
527 static int LuaCallbackPushFlowIdToStackFromFlow(lua_State *luastate, const Flow *f)
528 {
529  int64_t id = FlowGetId(f);
530  lua_pushinteger(luastate, id);
531  return 1;
532 }
533 
534 /** \internal
535  * \brief Wrapper for getting FlowId into lua script
536  * \retval cnt number of items placed on the stack
537  */
538 static int LuaCallbackFlowId(lua_State *luastate)
539 {
540  int r = 0;
541  Flow *f = LuaStateGetFlow(luastate);
542  if (f == NULL)
543  return LuaCallbackError(luastate, "internal error: no flow");
544 
545  r = LuaCallbackPushFlowIdToStackFromFlow(luastate, f);
546 
547  return r;
548 }
549 
550 /** \internal
551  * \brief fill lua stack with alert info
552  * \param luastate the lua state
553  * \param pa pointer to packet alert struct
554  * \retval cnt number of data items placed on the stack
555  *
556  * Places: sid (number), rev (number), gid (number)
557  */
558 static int LuaCallbackRuleIdsPushToStackFromPacketAlert(lua_State *luastate, const PacketAlert *pa)
559 {
560  lua_pushnumber (luastate, pa->s->id);
561  lua_pushnumber (luastate, pa->s->rev);
562  lua_pushnumber (luastate, pa->s->gid);
563  return 3;
564 }
565 
566 /** \internal
567  * \brief Wrapper for getting tuple info into a lua script
568  * \retval cnt number of items placed on the stack
569  */
570 static int LuaCallbackRuleIds(lua_State *luastate)
571 {
572  const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
573  if (pa == NULL)
574  return LuaCallbackError(luastate, "internal error: no packet");
575 
576  return LuaCallbackRuleIdsPushToStackFromPacketAlert(luastate, pa);
577 }
578 
579 /** \internal
580  * \brief fill lua stack with alert info
581  * \param luastate the lua state
582  * \param pa pointer to packet alert struct
583  * \retval cnt number of data items placed on the stack
584  *
585  * Places: msg (string)
586  */
587 static int LuaCallbackRuleMsgPushToStackFromPacketAlert(lua_State *luastate, const PacketAlert *pa)
588 {
589  lua_pushstring (luastate, pa->s->msg);
590  return 1;
591 }
592 
593 /** \internal
594  * \brief Wrapper for getting tuple info into a lua script
595  * \retval cnt number of items placed on the stack
596  */
597 static int LuaCallbackRuleMsg(lua_State *luastate)
598 {
599  const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
600  if (pa == NULL)
601  return LuaCallbackError(luastate, "internal error: no packet");
602 
603  return LuaCallbackRuleMsgPushToStackFromPacketAlert(luastate, pa);
604 }
605 
606 /** \internal
607  * \brief fill lua stack with alert info
608  * \param luastate the lua state
609  * \param pa pointer to packet alert struct
610  * \retval cnt number of data items placed on the stack
611  *
612  * Places: class (string), prio (number)
613  */
614 static int LuaCallbackRuleClassPushToStackFromPacketAlert(lua_State *luastate, const PacketAlert *pa)
615 {
616  lua_pushstring (luastate, pa->s->class_msg);
617  lua_pushnumber (luastate, pa->s->prio);
618  return 2;
619 }
620 
621 /** \internal
622  * \brief Wrapper for getting tuple info into a lua script
623  * \retval cnt number of items placed on the stack
624  */
625 static int LuaCallbackRuleClass(lua_State *luastate)
626 {
627  const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
628  if (pa == NULL)
629  return LuaCallbackError(luastate, "internal error: no packet");
630 
631  return LuaCallbackRuleClassPushToStackFromPacketAlert(luastate, pa);
632 }
633 
634 static int LuaCallbackLogPath(lua_State *luastate)
635 {
636  const char *ld = ConfigGetLogDirectory();
637  if (ld == NULL)
638  return LuaCallbackError(luastate, "internal error: no log dir");
639 
640  return LuaPushStringBuffer(luastate, (const uint8_t *)ld, strlen(ld));
641 }
642 
643 static int LuaCallbackLogDebug(lua_State *luastate)
644 {
645  const char *msg = LuaGetStringArgument(luastate, 1);
646  if (msg == NULL)
647  return LuaCallbackError(luastate, "1st argument missing, empty or wrong type");
648  SCLogDebug("%s", msg);
649  return 0;
650 }
651 
652 static int LuaCallbackLogInfo(lua_State *luastate)
653 {
654  const char *msg = LuaGetStringArgument(luastate, 1);
655  if (msg == NULL)
656  return LuaCallbackError(luastate, "1st argument missing, empty or wrong type");
657 
658  lua_Debug ar;
659  lua_getstack(luastate, 1, &ar);
660  lua_getinfo(luastate, "nSl", &ar);
661  const char *funcname = ar.name ? ar.name : ar.what;
662  SCLogInfoRaw(ar.short_src, funcname, ar.currentline, "%s", msg);
663  return 0;
664 }
665 
666 static int LuaCallbackLogNotice(lua_State *luastate)
667 {
668  const char *msg = LuaGetStringArgument(luastate, 1);
669  if (msg == NULL)
670  return LuaCallbackError(luastate, "1st argument missing, empty or wrong type");
671 
672  lua_Debug ar;
673  lua_getstack(luastate, 1, &ar);
674  lua_getinfo(luastate, "nSl", &ar);
675  const char *funcname = ar.name ? ar.name : ar.what;
676  SCLogNoticeRaw(ar.short_src, funcname, ar.currentline, "%s", msg);
677  return 0;
678 }
679 
680 static int LuaCallbackLogWarning(lua_State *luastate)
681 {
682  const char *msg = LuaGetStringArgument(luastate, 1);
683  if (msg == NULL)
684  return LuaCallbackError(luastate, "1st argument missing, empty or wrong type");
685 
686  lua_Debug ar;
687  lua_getstack(luastate, 1, &ar);
688  lua_getinfo(luastate, "nSl", &ar);
689  const char *funcname = ar.name ? ar.name : ar.what;
690  SCLogWarningRaw(SC_WARN_LUA_SCRIPT, ar.short_src, funcname, ar.currentline, "%s", msg);
691  return 0;
692 }
693 
694 static int LuaCallbackLogError(lua_State *luastate)
695 {
696  const char *msg = LuaGetStringArgument(luastate, 1);
697  if (msg == NULL)
698  return LuaCallbackError(luastate, "1st argument missing, empty or wrong type");
699  lua_Debug ar;
700  lua_getstack(luastate, 1, &ar);
701  lua_getinfo(luastate, "nSl", &ar);
702  const char *funcname = ar.name ? ar.name : ar.what;
703  SCLogErrorRaw(SC_ERR_LUA_SCRIPT, ar.short_src, funcname, ar.currentline, "%s", msg);
704  return 0;
705 }
706 
707 /** \internal
708  * \brief fill lua stack with file info
709  * \param luastate the lua state
710  * \param pa pointer to packet alert struct
711  * \retval cnt number of data items placed on the stack
712  *
713  * Places: fileid (number), txid (number), name (string),
714  * size (number), magic (string), md5 in hex (string)
715  */
716 static int LuaCallbackFileInfoPushToStackFromFile(lua_State *luastate, const File *file)
717 {
718 #ifdef HAVE_NSS
719  char md5[33] = "";
720  char *md5ptr = md5;
721  if (file->flags & FILE_MD5) {
722  size_t x;
723  for (x = 0; x < sizeof(file->md5); x++) {
724  char one[3] = "";
725  snprintf(one, sizeof(one), "%02x", file->md5[x]);
726  strlcat(md5, one, sizeof(md5));
727  }
728  }
729  char sha1[41] = "";
730  char *sha1ptr = sha1;
731  if (file->flags & FILE_SHA1) {
732  size_t x;
733  for (x = 0; x < sizeof(file->sha1); x++) {
734  char one[3] = "";
735  snprintf(one, sizeof(one), "%02x", file->sha1[x]);
736  strlcat(sha1, one, sizeof(sha1));
737  }
738  }
739  char sha256[65] = "";
740  char *sha256ptr = sha256;
741  if (file->flags & FILE_SHA256) {
742  size_t x;
743  for (x = 0; x < sizeof(file->sha256); x++) {
744  char one[3] = "";
745  snprintf(one, sizeof(one), "%02x", file->sha256[x]);
746  strlcat(sha256, one, sizeof(sha256));
747  }
748  }
749 #else
750  char *md5ptr = NULL;
751  char *sha1ptr = NULL;
752  char *sha256ptr = NULL;
753 #endif
754 
755  lua_pushnumber(luastate, file->file_store_id);
756  lua_pushnumber(luastate, file->txid);
757  lua_pushlstring(luastate, (char *)file->name, file->name_len);
758  lua_pushnumber(luastate, FileTrackedSize(file));
759  lua_pushstring (luastate,
760 #ifdef HAVE_MAGIC
761  file->magic
762 #else
763  "nomagic"
764 #endif
765  );
766  lua_pushstring(luastate, md5ptr);
767  lua_pushstring(luastate, sha1ptr);
768  lua_pushstring(luastate, sha256ptr);
769  return 6;
770 }
771 
772 /** \internal
773  * \brief Wrapper for getting tuple info into a lua script
774  * \retval cnt number of items placed on the stack
775  */
776 static int LuaCallbackFileInfo(lua_State *luastate)
777 {
778  const File *file = LuaStateGetFile(luastate);
779  if (file == NULL)
780  return LuaCallbackError(luastate, "internal error: no file");
781 
782  return LuaCallbackFileInfoPushToStackFromFile(luastate, file);
783 }
784 
785 /** \internal
786  * \brief fill lua stack with file info
787  * \param luastate the lua state
788  * \param pa pointer to packet alert struct
789  * \retval cnt number of data items placed on the stack
790  *
791  * Places: state (string), stored (bool)
792  */
793 static int LuaCallbackFileStatePushToStackFromFile(lua_State *luastate, const File *file)
794 {
795  const char *state = "UNKNOWN";
796  switch (file->state) {
797  case FILE_STATE_CLOSED:
798  state = "CLOSED";
799  break;
801  state = "TRUNCATED";
802  break;
803  case FILE_STATE_ERROR:
804  state = "ERROR";
805  break;
806  case FILE_STATE_OPENED:
807  state = "OPENED";
808  break;
809  case FILE_STATE_NONE:
810  state = "NONE";
811  break;
812  case FILE_STATE_MAX:
813  break;
814  }
815 
816  lua_pushstring (luastate, state);
817  lua_pushboolean (luastate, file->flags & FILE_STORED);
818  return 2;
819 }
820 
821 /** \internal
822  * \brief Wrapper for getting tuple info into a lua script
823  * \retval cnt number of items placed on the stack
824  */
825 static int LuaCallbackFileState(lua_State *luastate)
826 {
827  const File *file = LuaStateGetFile(luastate);
828  if (file == NULL)
829  return LuaCallbackError(luastate, "internal error: no file");
830 
831  return LuaCallbackFileStatePushToStackFromFile(luastate, file);
832 }
833 
834 /** \internal
835  * \brief fill lua stack with thread info
836  * \param luastate the lua state
837  * \param pa pointer to packet alert struct
838  * \retval cnt number of data items placed on the stack
839  *
840  * Places: thread id (number), thread name (string, thread group name (string)
841  */
842 static int LuaCallbackThreadInfoPushToStackFromThreadVars(lua_State *luastate, const ThreadVars *tv)
843 {
844  u_long tid = SCGetThreadIdLong();
845  lua_pushinteger (luastate, (lua_Integer)tid);
846  lua_pushstring (luastate, tv->name);
847  lua_pushstring (luastate, tv->thread_group_name);
848  return 3;
849 }
850 
851 /** \internal
852  * \brief Wrapper for getting tuple info into a lua script
853  * \retval cnt number of items placed on the stack
854  */
855 static int LuaCallbackThreadInfo(lua_State *luastate)
856 {
857  const ThreadVars *tv = LuaStateGetThreadVars(luastate);
858  if (tv == NULL)
859  return LuaCallbackError(luastate, "internal error: no tv");
860 
861  return LuaCallbackThreadInfoPushToStackFromThreadVars(luastate, tv);
862 }
863 
864 int LuaRegisterFunctions(lua_State *luastate)
865 {
866  /* registration of the callbacks */
867  lua_pushcfunction(luastate, LuaCallbackPacketPayload);
868  lua_setglobal(luastate, "SCPacketPayload");
869  lua_pushcfunction(luastate, LuaCallbackPacketTimestamp);
870  lua_setglobal(luastate, "SCPacketTimestamp");
871  lua_pushcfunction(luastate, LuaCallbackPacketTimeString);
872  lua_setglobal(luastate, "SCPacketTimeString");
873  lua_pushcfunction(luastate, LuaCallbackTuple);
874  lua_setglobal(luastate, "SCPacketTuple");
875 
876  lua_pushcfunction(luastate, LuaCallbackFlowTimestamps);
877  lua_setglobal(luastate, "SCFlowTimestamps");
878  lua_pushcfunction(luastate, LuaCallbackFlowTimeString);
879  lua_setglobal(luastate, "SCFlowTimeString");
880  lua_pushcfunction(luastate, LuaCallbackTupleFlow);
881  lua_setglobal(luastate, "SCFlowTuple");
882  lua_pushcfunction(luastate, LuaCallbackAppLayerProtoFlow);
883  lua_setglobal(luastate, "SCFlowAppLayerProto");
884  lua_pushcfunction(luastate, LuaCallbackStatsFlow);
885  lua_setglobal(luastate, "SCFlowStats");
886  lua_pushcfunction(luastate, LuaCallbackFlowHasAlerts);
887  lua_setglobal(luastate, "SCFlowHasAlerts");
888  lua_pushcfunction(luastate, LuaCallbackFlowId);
889  lua_setglobal(luastate, "SCFlowId");
890 
891  lua_pushcfunction(luastate, LuaCallbackStreamingBuffer);
892  lua_setglobal(luastate, "SCStreamingBuffer");
893 
894  lua_pushcfunction(luastate, LuaCallbackLogPath);
895  lua_setglobal(luastate, "SCLogPath");
896 
897  lua_pushcfunction(luastate, LuaCallbackLogDebug);
898  lua_setglobal(luastate, "SCLogDebug");
899  lua_pushcfunction(luastate, LuaCallbackLogInfo);
900  lua_setglobal(luastate, "SCLogInfo");
901  lua_pushcfunction(luastate, LuaCallbackLogNotice);
902  lua_setglobal(luastate, "SCLogNotice");
903  lua_pushcfunction(luastate, LuaCallbackLogWarning);
904  lua_setglobal(luastate, "SCLogWarning");
905  lua_pushcfunction(luastate, LuaCallbackLogError);
906  lua_setglobal(luastate, "SCLogError");
907 
908 
909  lua_pushcfunction(luastate, LuaCallbackRuleIds);
910  lua_setglobal(luastate, "SCRuleIds");
911  lua_pushcfunction(luastate, LuaCallbackRuleMsg);
912  lua_setglobal(luastate, "SCRuleMsg");
913  lua_pushcfunction(luastate, LuaCallbackRuleClass);
914  lua_setglobal(luastate, "SCRuleClass");
915 
916  lua_pushcfunction(luastate, LuaCallbackFileInfo);
917  lua_setglobal(luastate, "SCFileInfo");
918  lua_pushcfunction(luastate, LuaCallbackFileState);
919  lua_setglobal(luastate, "SCFileState");
920 
921  lua_pushcfunction(luastate, LuaCallbackThreadInfo);
922  lua_setglobal(luastate, "SCThreadInfo");
923  return 0;
924 }
925 
926 int LuaStateNeedProto(lua_State *luastate, AppProto alproto)
927 {
928  AppProto flow_alproto = 0;
929  Flow *flow = LuaStateGetFlow(luastate);
930  if (flow == NULL)
931  return LuaCallbackError(luastate, "internal error: no flow");
932 
933  flow_alproto = flow->alproto;
934 
935  return (alproto == flow_alproto);
936 
937 }
938 
939 #endif /* HAVE_LUA */
AppProto alproto_expect
Definition: flow.h:418
struct Flow_::@116::@120 icmp_s
#define FLOW_IS_IPV4(f)
Definition: flow.h:134
#define GET_IPV4_SRC_ADDR_PTR(p)
Definition: decode.h:212
#define SCLogDebug(...)
Definition: util-debug.h:335
AppProto alproto_tc
Definition: flow.h:411
#define OUTPUT_STREAMING_FLAG_OPEN
uint64_t todstbytecnt
Definition: flow.h:462
uint8_t proto
Definition: flow.h:344
char * msg
Definition: detect.h:572
uint32_t id
Definition: detect.h:547
Port sp
Definition: flow.h:331
#define GET_IPV4_DST_ADDR_PTR(p)
Definition: decode.h:213
Port sp
Definition: decode.h:413
#define FILE_SHA256
Definition: util-file.h:43
int FlowHasAlerts(const Flow *f)
Check if flow has alerts.
Definition: flow.c:208
int prio
Definition: detect.h:550
Port dp
Definition: decode.h:421
size_t strlcat(char *, const char *src, size_t siz)
Definition: util-strlcatu.c:45
#define SCLogErrorRaw(err_code, file, func, line,...)
Definition: util-debug.h:297
#define PKT_IS_IPV6(p)
Definition: decode.h:250
#define OUTPUT_STREAMING_FLAG_TOCLIENT
struct timeval startts
Definition: flow.h:458
uint32_t todstpktcnt
Definition: flow.h:460
uint16_t AppProto
#define PKT_IS_IPV4(p)
Definition: decode.h:249
#define SCLogInfoRaw(file, func, line,...)
Definition: util-debug.h:256
char * thread_group_name
Definition: threadvars.h:61
FlowAddress dst
Definition: flow.h:329
const struct Signature_ * s
Definition: decode.h:271
AppProto alproto_orig
Definition: flow.h:415
AppProto alproto_ts
Definition: flow.h:410
uint64_t tosrcbytecnt
Definition: flow.h:463
#define str(s)
uint16_t flags
Definition: util-file.h:65
#define SCLogWarningRaw(err_code, file, func, line,...)
Definition: util-debug.h:284
union FlowAddress_::@115 address
uint8_t proto
Definition: decode.h:428
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:218
const char * AppProtoToString(AppProto alproto)
Maps the ALPROTO_*, to its string equivalent.
#define SCGetThreadIdLong(...)
Definition: threads.h:253
uint64_t txid
Definition: util-file.h:69
uint16_t name_len
Definition: util-file.h:66
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
uint32_t gid
Definition: detect.h:548
#define SCLogNoticeRaw(file, func, line,...)
Definition: util-debug.h:271
#define FILE_MD5
Definition: util-file.h:39
#define OUTPUT_STREAMING_FLAG_CLOSE
struct timeval lastts
Definition: flow.h:358
#define FILE_SHA1
Definition: util-file.h:41
char * class_msg
Definition: detect.h:575
#define FILE_STORED
Definition: util-file.h:47
const char * ConfigGetLogDirectory()
Definition: util-conf.c:36
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:217
struct Packet_::@41::@50 icmp_s
Port dp
Definition: flow.h:338
#define FLOW_IS_IPV6(f)
Definition: flow.h:136
uint64_t ts
FileState state
Definition: util-file.h:67
uint32_t rev
Definition: detect.h:549
uint32_t file_store_id
Definition: util-file.h:72
FlowAddress src
Definition: flow.h:329
char name[16]
Definition: threadvars.h:59
uint64_t FileTrackedSize(const File *file)
get the size of the file
Definition: util-file.c:294
const char * msg
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
struct timeval ts
Definition: decode.h:449
AppProto alproto
application level protocol
Definition: flow.h:409
uint16_t payload_len
Definition: decode.h:541
Flow data structure.
Definition: flow.h:325
#define OUTPUT_STREAMING_FLAG_TOSERVER
uint8_t * payload
Definition: decode.h:540
uint8_t * name
Definition: util-file.h:75
void CreateTimeString(const struct timeval *ts, char *str, size_t size)
Definition: util-time.c:245
uint32_t tosrcpktcnt
Definition: flow.h:461