61 int LuaCallbackError(
lua_State *luastate,
const char *
msg)
63 lua_pushnil(luastate);
64 lua_pushstring(luastate,
msg);
68 const char *LuaGetStringArgument(
lua_State *luastate,
int argc)
71 if (!lua_isstring(luastate, argc))
73 const char *
str = lua_tostring(luastate, argc);
81 void LuaPushTableKeyValueInt(
lua_State *luastate,
const char *key,
int value)
83 lua_pushstring(luastate, key);
84 lua_pushnumber(luastate, value);
85 lua_settable(luastate, -3);
92 void LuaPushTableKeyValueString(
lua_State *luastate,
const char *key,
const char *value)
94 lua_pushstring(luastate, key);
95 lua_pushstring(luastate, value ? value :
"(null)");
96 lua_settable(luastate, -3);
99 void LuaPushTableKeyValueArray(
lua_State *luastate,
const char *key,
const uint8_t *value,
size_t len)
101 lua_pushstring(luastate, key);
102 LuaPushStringBuffer(luastate, value,
len);
103 lua_settable(luastate, -3);
114 static int LuaCallbackStreamingBufferPushToStack(
lua_State *luastate,
const LuaStreamingBuffer *b)
117 lua_pushlstring (luastate, (
const char *)b->data, b->data_len);
129 static int LuaCallbackStreamingBuffer(
lua_State *luastate)
131 const LuaStreamingBuffer *b = LuaStateGetStreamingBuffer(luastate);
133 return LuaCallbackError(luastate,
"internal error: no buffer");
135 return LuaCallbackStreamingBufferPushToStack(luastate, b);
146 static int LuaCallbackPacketPayloadPushToStackFromPacket(
lua_State *luastate,
const Packet *p)
156 static int LuaCallbackPacketPayload(
lua_State *luastate)
158 const Packet *p = LuaStateGetPacket(luastate);
160 return LuaCallbackError(luastate,
"internal error: no packet");
162 return LuaCallbackPacketPayloadPushToStackFromPacket(luastate, p);
188 static int LuaCallbackTimeStringPushToStackFromPacket(
lua_State *luastate,
const Packet *p)
192 lua_pushstring (luastate, timebuf);
200 static int LuaCallbackPacketTimestamp(
lua_State *luastate)
202 const Packet *p = LuaStateGetPacket(luastate);
204 return LuaCallbackError(luastate,
"internal error: no packet");
206 return LuaCallbackTimestampPushToStack(luastate, p->
ts);
213 static int LuaCallbackPacketTimeString(
lua_State *luastate)
215 const Packet *p = LuaStateGetPacket(luastate);
217 return LuaCallbackError(luastate,
"internal error: no packet");
219 return LuaCallbackTimeStringPushToStackFromPacket(luastate, p);
232 static int LuaCallbackFlowTimestampsPushToStack(
235 lua_pushnumber(luastate, (
double)
SCTIME_SECS(startts));
236 lua_pushnumber(luastate, (
double)
SCTIME_SECS(lastts));
237 lua_pushnumber(luastate, (
double)
SCTIME_USECS(startts));
246 static int LuaCallbackFlowTimestamps(
lua_State *luastate)
248 Flow *flow = LuaStateGetFlow(luastate);
250 return LuaCallbackError(luastate,
"internal error: no flow");
253 return LuaCallbackFlowTimestampsPushToStack(luastate, flow->
startts, flow->
lastts);
264 static int LuaCallbackTimeStringPushToStackFromFlow(
lua_State *luastate,
const Flow *flow)
268 lua_pushstring (luastate, timebuf);
276 static int LuaCallbackFlowTimeString(
lua_State *luastate)
279 Flow *flow = LuaStateGetFlow(luastate);
281 return LuaCallbackError(luastate,
"internal error: no flow");
283 r = LuaCallbackTimeStringPushToStackFromFlow(luastate, flow);
296 static int LuaCallbackHasAlertsPushToStackFromFlow(
lua_State *luastate,
const Flow *flow)
307 static int LuaCallbackFlowHasAlerts(
lua_State *luastate)
310 Flow *flow = LuaStateGetFlow(luastate);
312 return LuaCallbackError(luastate,
"internal error: no flow");
314 r = LuaCallbackHasAlertsPushToStackFromFlow(luastate, flow);
328 static int LuaCallbackTuplePushToStackFromPacket(
lua_State *luastate,
const Packet *p)
336 lua_pushinteger(luastate, ipver);
340 char srcip[46] =
"", dstip[46] =
"";
349 lua_pushstring (luastate, srcip);
350 lua_pushstring (luastate, dstip);
353 lua_pushinteger(luastate, p->
proto);
354 if (p->
proto == IPPROTO_TCP || p->
proto == IPPROTO_UDP) {
355 lua_pushinteger(luastate, p->
sp);
356 lua_pushinteger(luastate, p->
dp);
358 }
else if (p->
proto == IPPROTO_ICMP || p->
proto == IPPROTO_ICMPV6) {
359 lua_pushinteger(luastate, p->
icmp_s.type);
360 lua_pushinteger(luastate, p->
icmp_s.code);
362 lua_pushinteger(luastate, 0);
363 lua_pushinteger(luastate, 0);
373 static int LuaCallbackTuple(
lua_State *luastate)
375 const Packet *p = LuaStateGetPacket(luastate);
377 return LuaCallbackError(luastate,
"internal error: no packet");
379 return LuaCallbackTuplePushToStackFromPacket(luastate, p);
391 static int LuaCallbackTuplePushToStackFromFlow(
lua_State *luastate,
const Flow *f)
399 lua_pushinteger(luastate, ipver);
403 char srcip[46] =
"", dstip[46] =
"";
405 PrintInet(AF_INET, (
const void *)&(f->
src.addr_data32[0]), srcip,
sizeof(srcip));
406 PrintInet(AF_INET, (
const void *)&(f->
dst.addr_data32[0]), dstip,
sizeof(dstip));
412 lua_pushstring (luastate, srcip);
413 lua_pushstring (luastate, dstip);
416 lua_pushinteger(luastate, f->
proto);
417 if (f->
proto == IPPROTO_TCP || f->
proto == IPPROTO_UDP) {
418 lua_pushinteger(luastate, f->
sp);
419 lua_pushinteger(luastate, f->
dp);
421 }
else if (f->
proto == IPPROTO_ICMP || f->
proto == IPPROTO_ICMPV6) {
422 lua_pushinteger(luastate, f->
icmp_s.type);
423 lua_pushinteger(luastate, f->
icmp_s.code);
425 lua_pushinteger(luastate, 0);
426 lua_pushinteger(luastate, 0);
436 static int LuaCallbackTupleFlow(
lua_State *luastate)
439 Flow *f = LuaStateGetFlow(luastate);
441 return LuaCallbackError(luastate,
"internal error: no flow");
443 r = LuaCallbackTuplePushToStackFromFlow(luastate, f);
456 static int LuaCallbackAppLayerProtoPushToStackFromFlow(
lua_State *luastate,
const AppProto alproto)
461 lua_pushstring(luastate,
string);
469 static int LuaCallbackAppLayerProtoFlow(
lua_State *luastate)
472 Flow *f = LuaStateGetFlow(luastate);
474 return LuaCallbackError(luastate,
"internal error: no flow");
476 r = LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->
alproto);
477 r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->
alproto_ts);
478 r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->
alproto_tc);
479 r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->
alproto_orig);
480 r += LuaCallbackAppLayerProtoPushToStackFromFlow(luastate, f->
alproto_expect);
493 static int LuaCallbackStatsPushToStackFromFlow(
lua_State *luastate,
const Flow *f)
506 static int LuaCallbackStatsFlow(
lua_State *luastate)
509 Flow *f = LuaStateGetFlow(luastate);
511 return LuaCallbackError(luastate,
"internal error: no flow");
513 r = LuaCallbackStatsPushToStackFromFlow(luastate, f);
526 static int LuaCallbackPushFlowIdToStackFromFlow(
lua_State *luastate,
const Flow *f)
528 int64_t
id = FlowGetId(f);
529 lua_pushinteger(luastate,
id);
537 static int LuaCallbackFlowId(
lua_State *luastate)
540 Flow *f = LuaStateGetFlow(luastate);
542 return LuaCallbackError(luastate,
"internal error: no flow");
544 r = LuaCallbackPushFlowIdToStackFromFlow(luastate, f);
557 static int LuaCallbackRuleIdsPushToStackFromSignature(
lua_State *luastate,
const Signature *s)
559 lua_pushinteger(luastate, s->
id);
560 lua_pushinteger(luastate, s->
rev);
561 lua_pushinteger(luastate, s->
gid);
572 static int LuaCallbackRuleIds(
lua_State *luastate)
575 const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
579 s = LuaStateGetSignature(luastate);
581 return LuaCallbackError(luastate,
"internal error: no packet alert or signature");
583 return LuaCallbackRuleIdsPushToStackFromSignature(luastate, s);
594 static int LuaCallbackRuleActionPushToStackFromSignature(
lua_State *luastate,
const Signature *s)
596 const char *action =
"";
607 lua_pushstring(luastate, action);
618 static int LuaCallbackRuleAction(
lua_State *luastate)
621 const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
625 s = LuaStateGetSignature(luastate);
627 return LuaCallbackError(luastate,
"internal error: no packet alert or signature");
629 return LuaCallbackRuleActionPushToStackFromSignature(luastate, s);
640 static int LuaCallbackRuleMsgPushToStackFromSignature(
lua_State *luastate,
const Signature *s)
642 lua_pushstring(luastate, s->
msg);
653 static int LuaCallbackRuleMsg(
lua_State *luastate)
656 const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
660 s = LuaStateGetSignature(luastate);
662 return LuaCallbackError(luastate,
"internal error: no packet alert or signature");
664 return LuaCallbackRuleMsgPushToStackFromSignature(luastate, s);
675 static int LuaCallbackRuleClassPushToStackFromSignature(
lua_State *luastate,
const Signature *s)
678 lua_pushinteger(luastate, s->
prio);
689 static int LuaCallbackRuleClass(
lua_State *luastate)
692 const PacketAlert *pa = LuaStateGetPacketAlert(luastate);
696 s = LuaStateGetSignature(luastate);
698 return LuaCallbackError(luastate,
"internal error: no packet alert or signature");
700 return LuaCallbackRuleClassPushToStackFromSignature(luastate, s);
703 static int LuaCallbackLogPath(
lua_State *luastate)
707 return LuaCallbackError(luastate,
"internal error: no log dir");
709 return LuaPushStringBuffer(luastate, (
const uint8_t *)ld, strlen(ld));
712 static int LuaCallbackLogDebug(
lua_State *luastate)
714 const char *
msg = LuaGetStringArgument(luastate, 1);
716 return LuaCallbackError(luastate,
"1st argument missing, empty or wrong type");
721 static int LuaCallbackLogInfo(
lua_State *luastate)
723 const char *
msg = LuaGetStringArgument(luastate, 1);
725 return LuaCallbackError(luastate,
"1st argument missing, empty or wrong type");
728 lua_getstack(luastate, 1, &ar);
729 lua_getinfo(luastate,
"nSl", &ar);
730 const char *funcname = ar.name ? ar.name : ar.what;
735 static int LuaCallbackLogNotice(
lua_State *luastate)
737 const char *
msg = LuaGetStringArgument(luastate, 1);
739 return LuaCallbackError(luastate,
"1st argument missing, empty or wrong type");
742 lua_getstack(luastate, 1, &ar);
743 lua_getinfo(luastate,
"nSl", &ar);
744 const char *funcname = ar.name ? ar.name : ar.what;
749 static int LuaCallbackLogWarning(
lua_State *luastate)
751 const char *
msg = LuaGetStringArgument(luastate, 1);
753 return LuaCallbackError(luastate,
"1st argument missing, empty or wrong type");
756 lua_getstack(luastate, 1, &ar);
757 lua_getinfo(luastate,
"nSl", &ar);
758 const char *funcname = ar.name ? ar.name : ar.what;
763 static int LuaCallbackLogError(
lua_State *luastate)
765 const char *
msg = LuaGetStringArgument(luastate, 1);
767 return LuaCallbackError(luastate,
"1st argument missing, empty or wrong type");
769 lua_getstack(luastate, 1, &ar);
770 lua_getinfo(luastate,
"nSl", &ar);
771 const char *funcname = ar.name ? ar.name : ar.what;
786 static int LuaCallbackFileInfoPushToStackFromFile(
lua_State *luastate,
const File *file)
789 char *sha1ptr = NULL;
790 char *sha256ptr = NULL;
796 for (x = 0; x <
sizeof(file->
md5); x++) {
798 snprintf(one,
sizeof(one),
"%02x", file->
md5[x]);
799 strlcat(md5, one,
sizeof(md5));
806 for (x = 0; x <
sizeof(file->
sha1); x++) {
808 snprintf(one,
sizeof(one),
"%02x", file->
sha1[x]);
809 strlcat(sha1, one,
sizeof(sha1));
812 char sha256[65] =
"";
816 for (x = 0; x <
sizeof(file->
sha256); x++) {
818 snprintf(one,
sizeof(one),
"%02x", file->
sha256[x]);
819 strlcat(sha256, one,
sizeof(sha256));
823 lua_Integer tx_id = LuaStateGetTxId(luastate);
825 lua_pushinteger(luastate, tx_id);
826 lua_pushlstring(luastate, (
char *)file->
name, file->
name_len);
828 lua_pushstring (luastate,
835 lua_pushstring(luastate, md5ptr);
836 lua_pushstring(luastate, sha1ptr);
837 lua_pushstring(luastate, sha256ptr);
845 static int LuaCallbackFileInfo(
lua_State *luastate)
847 const File *file = LuaStateGetFile(luastate);
849 return LuaCallbackError(luastate,
"internal error: no file");
851 return LuaCallbackFileInfoPushToStackFromFile(luastate, file);
862 static int LuaCallbackFileStatePushToStackFromFile(
lua_State *luastate,
const File *file)
864 const char *state =
"UNKNOWN";
865 switch (file->
state) {
885 lua_pushstring (luastate, state);
894 static int LuaCallbackFileState(
lua_State *luastate)
896 const File *file = LuaStateGetFile(luastate);
898 return LuaCallbackError(luastate,
"internal error: no file");
900 return LuaCallbackFileStatePushToStackFromFile(luastate, file);
914 lua_pushinteger (luastate, (lua_Integer)tid);
915 lua_pushstring (luastate,
tv->
name);
924 static int LuaCallbackThreadInfo(
lua_State *luastate)
928 return LuaCallbackError(luastate,
"internal error: no tv");
930 return LuaCallbackThreadInfoPushToStackFromThreadVars(luastate,
tv);
933 int LuaRegisterFunctions(
lua_State *luastate)
936 lua_pushcfunction(luastate, LuaCallbackPacketPayload);
937 lua_setglobal(luastate,
"SCPacketPayload");
938 lua_pushcfunction(luastate, LuaCallbackPacketTimestamp);
939 lua_setglobal(luastate,
"SCPacketTimestamp");
940 lua_pushcfunction(luastate, LuaCallbackPacketTimeString);
941 lua_setglobal(luastate,
"SCPacketTimeString");
942 lua_pushcfunction(luastate, LuaCallbackTuple);
943 lua_setglobal(luastate,
"SCPacketTuple");
945 lua_pushcfunction(luastate, LuaCallbackFlowTimestamps);
946 lua_setglobal(luastate,
"SCFlowTimestamps");
947 lua_pushcfunction(luastate, LuaCallbackFlowTimeString);
948 lua_setglobal(luastate,
"SCFlowTimeString");
949 lua_pushcfunction(luastate, LuaCallbackTupleFlow);
950 lua_setglobal(luastate,
"SCFlowTuple");
951 lua_pushcfunction(luastate, LuaCallbackAppLayerProtoFlow);
952 lua_setglobal(luastate,
"SCFlowAppLayerProto");
953 lua_pushcfunction(luastate, LuaCallbackStatsFlow);
954 lua_setglobal(luastate,
"SCFlowStats");
955 lua_pushcfunction(luastate, LuaCallbackFlowHasAlerts);
956 lua_setglobal(luastate,
"SCFlowHasAlerts");
957 lua_pushcfunction(luastate, LuaCallbackFlowId);
958 lua_setglobal(luastate,
"SCFlowId");
960 lua_pushcfunction(luastate, LuaCallbackStreamingBuffer);
961 lua_setglobal(luastate,
"SCStreamingBuffer");
963 lua_pushcfunction(luastate, LuaCallbackLogPath);
964 lua_setglobal(luastate,
"SCLogPath");
966 lua_pushcfunction(luastate, LuaCallbackLogDebug);
967 lua_setglobal(luastate,
"SCLogDebug");
968 lua_pushcfunction(luastate, LuaCallbackLogInfo);
969 lua_setglobal(luastate,
"SCLogInfo");
970 lua_pushcfunction(luastate, LuaCallbackLogNotice);
971 lua_setglobal(luastate,
"SCLogNotice");
972 lua_pushcfunction(luastate, LuaCallbackLogWarning);
973 lua_setglobal(luastate,
"SCLogWarning");
974 lua_pushcfunction(luastate, LuaCallbackLogError);
975 lua_setglobal(luastate,
"SCLogError");
978 lua_pushcfunction(luastate, LuaCallbackRuleIds);
979 lua_setglobal(luastate,
"SCRuleIds");
980 lua_pushcfunction(luastate, LuaCallbackRuleAction);
981 lua_setglobal(luastate,
"SCRuleAction");
982 lua_pushcfunction(luastate, LuaCallbackRuleMsg);
983 lua_setglobal(luastate,
"SCRuleMsg");
984 lua_pushcfunction(luastate, LuaCallbackRuleClass);
985 lua_setglobal(luastate,
"SCRuleClass");
987 lua_pushcfunction(luastate, LuaCallbackFileInfo);
988 lua_setglobal(luastate,
"SCFileInfo");
989 lua_pushcfunction(luastate, LuaCallbackFileState);
990 lua_setglobal(luastate,
"SCFileState");
992 lua_pushcfunction(luastate, LuaCallbackThreadInfo);
993 lua_setglobal(luastate,
"SCThreadInfo");
1000 Flow *flow = LuaStateGetFlow(luastate);
1002 return LuaCallbackError(luastate,
"internal error: no flow");
1006 return (alproto == flow_alproto);