suricata
util-lua-ssh.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 
19 /**
20  * \file
21  *
22  * \author Mats Klepsland <mats.klepsland@gmail.com>
23  *
24  */
25 
26 #include "suricata-common.h"
27 #include "debug.h"
28 #include "detect.h"
29 #include "pkt-var.h"
30 #include "conf.h"
31 
32 #include "threads.h"
33 #include "threadvars.h"
34 #include "tm-threads.h"
35 
36 #include "util-print.h"
37 #include "util-unittest.h"
38 
39 #include "util-debug.h"
40 
41 #include "output.h"
42 #include "app-layer.h"
43 #include "app-layer-parser.h"
44 #include "app-layer-ssh.h"
45 #include "util-privs.h"
46 #include "util-buffer.h"
47 #include "util-proto-name.h"
48 #include "util-logopenfile.h"
49 #include "util-time.h"
50 
51 #ifdef HAVE_LUA
52 
53 #include <lua.h>
54 #include <lualib.h>
55 #include <lauxlib.h>
56 
57 #include "util-lua.h"
58 #include "util-lua-common.h"
59 #include "util-lua-ssh.h"
60 
61 static int GetServerProtoVersion(lua_State *luastate, const Flow *f)
62 {
63  void *state = FlowGetAppState(f);
64  if (state == NULL)
65  return LuaCallbackError(luastate, "error: no app layer state");
66 
67  SshState *ssh_state = (SshState *)state;
68 
69  if (ssh_state->srv_hdr.proto_version == NULL)
70  return LuaCallbackError(luastate, "error: no server proto version");
71 
72  return LuaPushStringBuffer(luastate, ssh_state->srv_hdr.proto_version,
73  strlen((char *)ssh_state->srv_hdr.proto_version));
74 }
75 
76 static int SshGetServerProtoVersion(lua_State *luastate)
77 {
78  int r;
79 
80  if (!(LuaStateNeedProto(luastate, ALPROTO_SSH)))
81  return LuaCallbackError(luastate, "error: protocol not ssh");
82 
83  Flow *f = LuaStateGetFlow(luastate);
84  if (f == NULL)
85  return LuaCallbackError(luastate, "internal error: no flow");
86 
87  r = GetServerProtoVersion(luastate, f);
88 
89  return r;
90 }
91 
92 static int GetServerSoftwareVersion(lua_State *luastate, const Flow *f)
93 {
94  void *state = FlowGetAppState(f);
95  if (state == NULL)
96  return LuaCallbackError(luastate, "error: no app layer state");
97 
98  SshState *ssh_state = (SshState *)state;
99 
100  if (ssh_state->srv_hdr.software_version == NULL)
101  return LuaCallbackError(luastate, "error: no server software version");
102 
103  return LuaPushStringBuffer(luastate, ssh_state->srv_hdr.software_version,
104  strlen((char *)ssh_state->srv_hdr.software_version));
105 }
106 
107 static int SshGetServerSoftwareVersion(lua_State *luastate)
108 {
109  int r;
110 
111  if (!(LuaStateNeedProto(luastate, ALPROTO_SSH)))
112  return LuaCallbackError(luastate, "error: protocol not ssh");
113 
114  Flow *f = LuaStateGetFlow(luastate);
115  if (f == NULL)
116  return LuaCallbackError(luastate, "internal error: no flow");
117 
118  r = GetServerSoftwareVersion(luastate, f);
119 
120  return r;
121 }
122 
123 static int GetClientProtoVersion(lua_State *luastate, const Flow *f)
124 {
125  void *state = FlowGetAppState(f);
126  if (state == NULL)
127  return LuaCallbackError(luastate, "error: no app layer state");
128 
129  SshState *ssh_state = (SshState *)state;
130 
131  if (ssh_state->cli_hdr.proto_version == NULL)
132  return LuaCallbackError(luastate, "error: no client proto version");
133 
134  return LuaPushStringBuffer(luastate, ssh_state->cli_hdr.proto_version,
135  strlen((char *)ssh_state->cli_hdr.proto_version));
136 }
137 
138 static int SshGetClientProtoVersion(lua_State *luastate)
139 {
140  int r;
141 
142  if (!(LuaStateNeedProto(luastate, ALPROTO_SSH)))
143  return LuaCallbackError(luastate, "error: protocol not ssh");
144 
145  Flow *f = LuaStateGetFlow(luastate);
146  if (f == NULL)
147  return LuaCallbackError(luastate, "internal error: no flow");
148 
149  r = GetClientProtoVersion(luastate, f);
150 
151  return r;
152 }
153 
154 static int GetClientSoftwareVersion(lua_State *luastate, const Flow *f)
155 {
156  void *state = FlowGetAppState(f);
157  if (state == NULL)
158  return LuaCallbackError(luastate, "error: no app layer state");
159 
160  SshState *ssh_state = (SshState *)state;
161 
162  if (ssh_state->cli_hdr.software_version == NULL)
163  return LuaCallbackError(luastate, "error: no client software version");
164 
165  return LuaPushStringBuffer(luastate, ssh_state->cli_hdr.software_version,
166  strlen((char *)ssh_state->cli_hdr.software_version));
167 }
168 
169 static int SshGetClientSoftwareVersion(lua_State *luastate)
170 {
171  int r;
172 
173  if (!(LuaStateNeedProto(luastate, ALPROTO_SSH)))
174  return LuaCallbackError(luastate, "error: protocol not ssh");
175 
176  Flow *f = LuaStateGetFlow(luastate);
177  if (f == NULL)
178  return LuaCallbackError(luastate, "internal error: no flow");
179 
180  r = GetClientSoftwareVersion(luastate, f);
181 
182  return r;
183 }
184 
185 /** \brief register ssh lua extensions in a luastate */
186 int LuaRegisterSshFunctions(lua_State *luastate)
187 {
188  /* registration of the callbacks */
189  lua_pushcfunction(luastate, SshGetServerProtoVersion);
190  lua_setglobal(luastate, "SshGetServerProtoVersion");
191 
192  lua_pushcfunction(luastate, SshGetServerSoftwareVersion);
193  lua_setglobal(luastate, "SshGetServerSoftwareVersion");
194 
195  lua_pushcfunction(luastate, SshGetClientProtoVersion);
196  lua_setglobal(luastate, "SshGetClientProtoVersion");
197 
198  lua_pushcfunction(luastate, SshGetClientSoftwareVersion);
199  lua_setglobal(luastate, "SshGetClientSoftwareVersion");
200 
201  return 0;
202 }
203 
204 #endif /* HAVE_LUA */
SshHeader cli_hdr
Definition: app-layer-ssh.h:74
uint8_t * proto_version
Definition: app-layer-ssh.h:60
SshHeader srv_hdr
Definition: app-layer-ssh.h:73
uint8_t * software_version
Definition: app-layer-ssh.h:61
void * FlowGetAppState(const Flow *f)
Definition: flow.c:1068
Flow data structure.
Definition: flow.h:325