util-lua-flowintlib.c

Go to the documentation of this file.

/* Copyright (C) 2025 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */
 
#include "suricata-common.h"
#include "app-layer-protos.h"
#include "flow-var.h"
#include "lauxlib.h"
#include "util-debug.h"
#include "util-lua-common.h"
#include "util-lua-flowintlib.h"
#include "util-lua.h"
#include "util-var-name.h"
#include "detect-lua.h"
#include "detect-lua-extensions.h"
 
static const char suricata_flowint_mt[] = "suricata:flowint:mt";
 
static DetectLuaData *GetLuaData(lua_State *luastate)
{
    return LuaStateGetDetectLuaData(luastate);
}
 
/**
 * \brief Register a flowvar.
 *
 * Ensures that a flowvar exists for the provided name, will be
 * created if needed.
 *
 * The flowvar ID is returned, however as this is most likely to be
 * used in the scripts "init" method, this ID is unlikely to be used.
 */
static int LuaFlowintRegister(lua_State *L)
{
    DetectLuaData *ld = GetLuaData(L);
    if (ld == NULL) {
        return luaL_error(L, "flowint API not available in this context");
    }
    if (!ld->register_in_init) {
        return luaL_error(L, "flowint.register() must be called from init()");
    }
    const char *name = luaL_checkstring(L, 1);
    /* check the limit first: a failed over-limit registration must not
     * leave a name store entry that nothing unregisters */
    if (ld->flowints >= DETECT_LUA_MAX_FLOWINTS) {
        return luaL_error(L, "too many flowints registered");
    }
    uint32_t *flowvar_id = SCLuaNewUserData(L, SCLUA_TUD_FLOWINT, sizeof(*flowvar_id));
    if (flowvar_id == NULL) {
        return luaL_error(L, "failed to allocate flowint");
    }
    *flowvar_id = VarNameStoreRegister(name, VAR_TYPE_FLOW_INT);
    if (*flowvar_id == 0) {
        return luaL_error(L, "failed to register flowint");
    }
    ld->flowint[ld->flowints++] = *flowvar_id;
 
    luaL_getmetatable(L, suricata_flowint_mt);
    lua_setmetatable(L, -2);
 
    return 1;
}
 
static int LuaFlowintGet(lua_State *L)
{
    const char *name = luaL_checkstring(L, 1);
    uint32_t *flowvar_id = SCLuaNewUserData(L, SCLUA_TUD_FLOWINT, sizeof(*flowvar_id));
    if (flowvar_id == NULL) {
        return luaL_error(L, "failed to allocate flowint");
    }
    *flowvar_id = VarNameStoreLookupByName(name, VAR_TYPE_FLOW_INT);
    if (*flowvar_id == 0) {
        return luaL_error(L, "flowvar does not exist");
    }
 
    luaL_getmetatable(L, suricata_flowint_mt);
    lua_setmetatable(L, -2);
 
    return 1;
}
 
static int LuaFlowintValue(lua_State *L)
{
    uint32_t *flowvar_id = SCLuaCheckUserData(L, 1, suricata_flowint_mt, SCLUA_TUD_FLOWINT);
    Flow *f = LuaStateGetFlow(L);
    if (f == NULL) {
        return LuaCallbackError(L, "flow is NULL");
    }
    FlowVar *fv = FlowVarGet(f, *flowvar_id);
    if (fv == NULL) {
        lua_pushnil(L);
    } else {
        lua_pushnumber(L, (lua_Number)fv->data.fv_int.value);
    }
    return 1;
}
 
static int LuaFlowintSet(lua_State *L)
{
    const lua_Integer value = luaL_checkinteger(L, 2);
    uint32_t *flowvar_id = SCLuaCheckUserData(L, 1, suricata_flowint_mt, SCLUA_TUD_FLOWINT);
    Flow *f = LuaStateGetFlow(L);
    if (f == NULL) {
        return luaL_error(L, "no flow");
    }
 
    /* the stored value is a uint32_t: reject what would truncate
     * instead of wrapping silently. Compare through int64_t: on ILP32
     * targets lua_Integer is 32 bits and (lua_Integer)UINT32_MAX wraps
     * to -1 */
    const int64_t v = (int64_t)value;
    if (v < 0 || (uint64_t)v > (uint64_t)UINT32_MAX) {
        return luaL_error(L, "value out of range: must be 0..4294967295");
    }
 
    FlowVarAddInt(f, *flowvar_id, (uint32_t)value);
 
    /* set() documents no result; claiming one hands back the last
     * argument (or the flow lock hint left by LuaStateGetFlow) */
    return 0;
}
 
static int LuaFlowintIncr(lua_State *L)
{
    uint32_t *flowvar_id = SCLuaCheckUserData(L, 1, suricata_flowint_mt, SCLUA_TUD_FLOWINT);
    Flow *f = LuaStateGetFlow(L);
    if (f == NULL) {
        return luaL_error(L, "no flow");
    }
 
    FlowVar *fv = FlowVarGet(f, *flowvar_id);
    uint32_t value;
    if (fv == NULL) {
        value = 1;
    } else {
        value = fv->data.fv_int.value;
        if (value < UINT32_MAX) {
            value++;
        }
    }
 
    FlowVarAddInt(f, *flowvar_id, value);
    lua_pushnumber(L, (lua_Number)value);
 
    return 1;
}
 
static int LuaFlowintDecr(lua_State *L)
{
    uint32_t *flowvar_id = SCLuaCheckUserData(L, 1, suricata_flowint_mt, SCLUA_TUD_FLOWINT);
    Flow *f = LuaStateGetFlow(L);
    if (f == NULL) {
        return luaL_error(L, "no flow");
    }
 
    FlowVar *fv = FlowVarGet(f, *flowvar_id);
    uint32_t value;
    if (fv == NULL) {
        value = 0;
    } else {
        value = fv->data.fv_int.value;
        if (value > 0) {
            value--;
        }
    }
 
    FlowVarAddInt(f, *flowvar_id, value);
    lua_pushnumber(L, (lua_Number)value);
 
    return 1;
}
 
static const luaL_Reg flowvarlib[] = {
    // clang-format off
    { "register", LuaFlowintRegister, },
    { "get", LuaFlowintGet },
    { NULL, NULL, },
    // clang-format on
};
 
static const luaL_Reg flowvarmt[] = {
    // clang-format off
    { "value", LuaFlowintValue, },
    { "set", LuaFlowintSet, },
    { "incr", LuaFlowintIncr, },
    { "decr", LuaFlowintDecr, },
    { NULL, NULL, },
    // clang-format on
};
 
int LuaLoadFlowintLib(lua_State *L)
{
    luaL_newmetatable(L, suricata_flowint_mt);
    lua_pushvalue(L, -1);
    lua_setfield(L, -2, "__index");
    luaL_setfuncs(L, flowvarmt, 0);
 
    luaL_newlib(L, flowvarlib);
    return 1;
}