util-lua.c

Go to the documentation of this file.

/* Copyright (C) 2014-2022 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */
 
/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 *
 * Common function for Lua
 */
 
#include "suricata-common.h"
#include "detect.h"
#include "pkt-var.h"
#include "conf.h"
 
#include "threads.h"
#include "threadvars.h"
#include "tm-threads.h"
 
#include "util-print.h"
 
#include "util-debug.h"
 
#include "output.h"
#include "app-layer-htp.h"
#include "app-layer.h"
#include "app-layer-parser.h"
#include "util-privs.h"
#include "util-buffer.h"
#include "util-proto-name.h"
#include "util-logopenfile.h"
 
#include "lua.h"
#include "lualib.h"
#include "lauxlib.h"
 
#include "util-lua.h"
#include "util-lua-sandbox.h"
#include "detect-lua-extensions.h"
 
lua_State *LuaGetState(void)
{
    lua_State *s = NULL;
    s = luaL_newstate();
    return s;
}
 
void LuaReturnState(lua_State *s)
{
    if (s != NULL) {
        /* clear the stack */
        while (lua_gettop(s) > 0) {
            lua_pop(s, 1);
        }
        lua_close(s);
    }
}
 
/* key for tv (threadvars) pointer */
const char lua_ext_key_tv[] = "suricata:lua:tv:ptr";
/* key for the invocation-generation counter pointer */
const char lua_ext_key_invocation_gen[] = "suricata:lua:invocation:gen";
/* key for tx pointer */
const char lua_ext_key_tx[] = "suricata:lua:tx:ptr";
/* key for tx id */
const char lua_ext_key_tx_id[] = "suricata:lua:tx_id";
/* key for p (packet) pointer */
const char lua_ext_key_p[] = "suricata:lua:pkt:ptr";
/* key for f (flow) pointer */
const char lua_ext_key_flow[] = "suricata:lua:flow:ptr";
/* key for direction */
const char lua_ext_key_direction[] = "suricata:lua:direction";
 
/* key for pa (packet alert) pointer */
const char lua_ext_key_pa[] = "suricata:lua:pkt:alert:ptr";
/* key for s (signature) pointer */
const char lua_ext_key_s[] = "suricata:lua:signature:ptr";
/* key for file pointer */
const char lua_ext_key_file[] = "suricata:lua:file:ptr";
/* key for DetectEngineThreadCtx pointer */
const char lua_ext_key_det_ctx[] = "suricata:lua:det_ctx:ptr";
 
/*
 * Registry context values are wrapped in a typed userdata instead of
 * being stored as bare lightuserdata. In unsandboxed states the registry
 * is script-writable, so a bare pointer can be moved between keys and
 * re-cast by the libs (type confusion/UAF). The type id is checked on
 * every read; a retyped value fails the check and yields NULL.
 */
typedef struct SCLuaRegValue_ {
    uint32_t type_id;
    void *ptr;
} SCLuaRegValue;
 
enum {
    SCLUA_REG_INVALID = 0,
    SCLUA_REG_TV,
    SCLUA_REG_PACKET,
    SCLUA_REG_TX,
    SCLUA_REG_FLOW,
    SCLUA_REG_PACKET_ALERT,
    SCLUA_REG_SIGNATURE,
    SCLUA_REG_FILE,
    SCLUA_REG_DET_CTX,
    SCLUA_REG_DETECT_LUA_DATA,
    SCLUA_REG_INVOCATION_GEN,
};
 
static void LuaStateSetReg(lua_State *luastate, const void *key, uint32_t type_id, void *ptr)
{
    lua_pushlightuserdata(luastate, (void *)key);
    if (ptr == NULL) {
        /* clear without allocating (this runs at state teardown, where the
         * sandbox allocator may be over its cap): NULL a typed slot in
         * place, drop anything else (a nil settable never inserts) */
        lua_gettable(luastate, LUA_REGISTRYINDEX);
        if (lua_type(luastate, -1) == LUA_TUSERDATA &&
                lua_rawlen(luastate, -1) == sizeof(SCLuaRegValue)) {
            SCLuaRegValue *v = (SCLuaRegValue *)lua_touserdata(luastate, -1);
            if (v != NULL && v->type_id == type_id) {
                v->ptr = NULL;
                lua_pop(luastate, 1);
                return;
            }
        }
        lua_pop(luastate, 1);
        lua_pushlightuserdata(luastate, (void *)key);
        lua_pushnil(luastate);
        lua_settable(luastate, LUA_REGISTRYINDEX);
        return;
    }
    /* the registry survives across match calls: when the slot already
     * holds a value of this type, update it in place instead of paying
     * a fresh GC allocation on every set (hot path) */
    lua_gettable(luastate, LUA_REGISTRYINDEX);
    if (lua_type(luastate, -1) == LUA_TUSERDATA &&
            lua_rawlen(luastate, -1) == sizeof(SCLuaRegValue)) {
        SCLuaRegValue *v = (SCLuaRegValue *)lua_touserdata(luastate, -1);
        if (v != NULL && v->type_id == type_id) {
            v->ptr = ptr;
            lua_pop(luastate, 1);
            return;
        }
    }
    lua_pop(luastate, 1);
    lua_pushlightuserdata(luastate, (void *)key);
    SCLuaRegValue *v = (SCLuaRegValue *)lua_newuserdata(luastate, sizeof(*v));
    v->type_id = type_id;
    v->ptr = ptr;
    lua_settable(luastate, LUA_REGISTRYINDEX);
}
 
static void *LuaStateGetReg(lua_State *luastate, const void *key, uint32_t type_id)
{
    lua_pushlightuserdata(luastate, (void *)key);
    lua_gettable(luastate, LUA_REGISTRYINDEX);
    void *ptr = NULL;
    /* require the exact full-userdata shape before casting: a
     * lightuserdata or a foreign small userdata would otherwise be
     * re-read as SCLuaRegValue (OOB ptr on a size match) */
    if (lua_type(luastate, -1) == LUA_TUSERDATA &&
            lua_rawlen(luastate, -1) == sizeof(SCLuaRegValue)) {
        SCLuaRegValue *v = (SCLuaRegValue *)lua_touserdata(luastate, -1);
        if (v != NULL && v->type_id == type_id) {
            ptr = v->ptr;
        }
    }
    lua_pop(luastate, 1);
    return ptr;
}
 
/** \brief get tv pointer from the lua state */
ThreadVars *LuaStateGetThreadVars(lua_State *luastate)
{
    return (ThreadVars *)LuaStateGetReg(luastate, lua_ext_key_tv, SCLUA_REG_TV);
}
 
void LuaStateSetThreadVars(lua_State *luastate, ThreadVars *tv)
{
    /* every registry context write is one script invocation: the state's
     * invocation generation counts them, so a handle caching
     * invocation-local pointers can compare it as a generation (a tx
     * cannot be freed while a script call runs) */
    uint64_t *gen = LuaStateGetReg(luastate, lua_ext_key_invocation_gen, SCLUA_REG_INVOCATION_GEN);
    if (gen != NULL) {
        *gen += 1;
    }
    LuaStateSetReg(luastate, lua_ext_key_tv, SCLUA_REG_TV, (void *)tv);
}
 
/* publish the state's invocation counter: the slot holds the counter's
 * address, not the counter - the value stays C-owned (sandbox context
 * or output ctx), so a script cannot forge a generation; a swapped or
 * cleared slot reads as 0 and no cursor is ever trusted */
void LuaStateSetInvocationGen(lua_State *luastate, uint64_t *gen)
{
    LuaStateSetReg(luastate, lua_ext_key_invocation_gen, SCLUA_REG_INVOCATION_GEN, (void *)gen);
}
 
/** \brief get the current invocation generation for this state */
uint64_t LuaStateGetInvocationGen(lua_State *luastate)
{
    uint64_t *gen = LuaStateGetReg(luastate, lua_ext_key_invocation_gen, SCLUA_REG_INVOCATION_GEN);
    return (gen != NULL) ? *gen : 0;
}
 
/** \brief get packet pointer from the lua state */
Packet *LuaStateGetPacket(lua_State *luastate)
{
    return (Packet *)LuaStateGetReg(luastate, lua_ext_key_p, SCLUA_REG_PACKET);
}
 
void LuaStateSetPacket(lua_State *luastate, Packet *p)
{
    LuaStateSetReg(luastate, lua_ext_key_p, SCLUA_REG_PACKET, (void *)p);
}
 
/** \brief get tx pointer from the lua state */
void *LuaStateGetTX(lua_State *luastate)
{
    return LuaStateGetReg(luastate, lua_ext_key_tx, SCLUA_REG_TX);
}
 
/** \brief get tx id from the lua state */
uint64_t LuaStateGetTxId(lua_State *luastate)
{
    lua_pushlightuserdata(luastate, (void *)&lua_ext_key_tx_id);
    lua_gettable(luastate, LUA_REGISTRYINDEX);
    uint64_t tx_id = lua_tointeger(luastate, -1);
    lua_pop(luastate, 1);
    return tx_id;
}
void LuaStateSetTX(lua_State *luastate, void *txptr, const uint64_t tx_id)
{
    LuaStateSetReg(luastate, lua_ext_key_tx, SCLUA_REG_TX, txptr);
    if (txptr == NULL) {
        return; /* cleared: the id is read together with the slot */
    }
 
    lua_pushlightuserdata(luastate, (void *)&lua_ext_key_tx_id);
    lua_pushinteger(luastate, tx_id);
    lua_settable(luastate, LUA_REGISTRYINDEX);
}
 
Flow *LuaStateGetFlow(lua_State *luastate)
{
    Flow *f = (Flow *)LuaStateGetReg(luastate, lua_ext_key_flow, SCLUA_REG_FLOW);
 
    return f;
}
 
void LuaStateSetFlow(lua_State *luastate, Flow *f)
{
    /* flow */
    LuaStateSetReg(luastate, lua_ext_key_flow, SCLUA_REG_FLOW, (void *)f);
}
 
/** \brief get packet alert pointer from the lua state */
PacketAlert *LuaStateGetPacketAlert(lua_State *luastate)
{
    return (PacketAlert *)LuaStateGetReg(luastate, lua_ext_key_pa, SCLUA_REG_PACKET_ALERT);
}
 
void LuaStateSetPacketAlert(lua_State *luastate, PacketAlert *pa)
{
    LuaStateSetReg(luastate, lua_ext_key_pa, SCLUA_REG_PACKET_ALERT, (void *)pa);
}
 
/** \brief get signature pointer from the lua state */
Signature *LuaStateGetSignature(lua_State *luastate)
{
    return (Signature *)LuaStateGetReg(luastate, lua_ext_key_s, SCLUA_REG_SIGNATURE);
}
 
void LuaStateSetSignature(lua_State *luastate, const Signature *s)
{
    LuaStateSetReg(luastate, lua_ext_key_s, SCLUA_REG_SIGNATURE, (void *)s);
}
 
/** \brief get file pointer from the lua state */
File *LuaStateGetFile(lua_State *luastate)
{
    return (File *)LuaStateGetReg(luastate, lua_ext_key_file, SCLUA_REG_FILE);
}
 
void LuaStateSetFile(lua_State *luastate, File *file)
{
    LuaStateSetReg(luastate, lua_ext_key_file, SCLUA_REG_FILE, (void *)file);
}
 
/** \brief get DetectEngineThreadCtx pointer from the lua state */
DetectEngineThreadCtx *LuaStateGetDetCtx(lua_State *luastate)
{
    return (DetectEngineThreadCtx *)LuaStateGetReg(
            luastate, lua_ext_key_det_ctx, SCLUA_REG_DET_CTX);
}
 
void LuaStateSetDetCtx(lua_State *luastate, DetectEngineThreadCtx *det_ctx)
{
    LuaStateSetReg(luastate, lua_ext_key_det_ctx, SCLUA_REG_DET_CTX, (void *)det_ctx);
}
 
/** \brief get the per-rule DetectLuaData */
DetectLuaData *LuaStateGetDetectLuaData(lua_State *luastate)
{
    return (DetectLuaData *)LuaStateGetReg(luastate, luaext_key_ld, SCLUA_REG_DETECT_LUA_DATA);
}
 
void LuaStateSetDetectLuaData(lua_State *luastate, DetectLuaData *ld)
{
    LuaStateSetReg(luastate, luaext_key_ld, SCLUA_REG_DETECT_LUA_DATA, (void *)ld);
}
 
/** \brief get packet pointer from the lua state */
int LuaStateGetDirection(lua_State *luastate)
{
    lua_pushlightuserdata(luastate, (void *)&lua_ext_key_direction);
    lua_gettable(luastate, LUA_REGISTRYINDEX);
    int dir = lua_toboolean(luastate, -1);
    lua_pop(luastate, 1);
    return dir;
}
 
void LuaStateSetDirection(lua_State *luastate, int direction)
{
    lua_pushlightuserdata(luastate, (void *)&lua_ext_key_direction);
    lua_pushboolean(luastate, direction);
    lua_settable(luastate, LUA_REGISTRYINDEX);
}
 
/** \brief dump stack from lua state to screen */
void LuaPrintStack(lua_State *state) {
    int size = lua_gettop(state);
    int i;
 
    for (i = 1; i <= size; i++) {
        int type = lua_type(state, i);
        printf("Stack size=%d, level=%d, type=%d, ", size, i, type);
 
        switch (type) {
            case LUA_TFUNCTION:
                printf("function %s", lua_tostring(state, i) ? "true" : "false");
                break;
            case LUA_TBOOLEAN:
                printf("bool %s", lua_toboolean(state, i) ? "true" : "false");
                break;
            case LUA_TNUMBER:
                printf("number %g", lua_tonumber(state, i));
                break;
            case LUA_TSTRING:
                printf("string `%s'", lua_tostring(state, i));
                break;
            case LUA_TTABLE:
                printf("table `%s'", lua_tostring(state, i));
                break;
            default:
                printf("other %s", lua_typename(state, type));
                break;
 
        }
        printf("\n");
    }
}
 
int LuaPushStringBuffer(lua_State *luastate, const uint8_t *input, size_t input_len)
{
    /* a NULL buffer is outside the lua_pushlstring contract even with
     * zero length; push the empty string instead (and clamp the length,
     * a NULL input has no content of its own) */
    if (input == NULL) {
        input = (const uint8_t *)"";
        input_len = 0;
    }
    lua_pushlstring(luastate, (char *)input, input_len);
    return 1;
}
 
int LuaPushInteger(lua_State *luastate, lua_Integer n)
{
    lua_pushinteger(luastate, n);
    return 1;
}