Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lua packetlib/v1 #12506

Closed
wants to merge 5 commits into from
Closed

Lua packetlib/v1 #12506

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f1775e9
detect/lua: remove unused tls flag
victorjulien Jan 19, 2025
a168a26
detect/lua: minor code cleanup
victorjulien Jan 19, 2025
d5986b1
lua: add initial suricata.packet lib
victorjulien Jan 21, 2025
799b8f7
lua: remove old lua payload/packet calls
victorjulien Jan 21, 2025
1520855
detect/lua: register built-in libs also for open setup
victorjulien Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,6 +519,7 @@ noinst_HEADERS = \
util-lua-hassh.h \
util-lua-http.h \
util-lua-ja3.h \
util-lua-packet.h \
util-lua-sandbox.h \
util-lua-smtp.h \
util-lua-ssh.h \
Expand Down Expand Up @@ -1071,6 +1072,7 @@ libsuricata_c_a_SOURCES = \
util-lua-hassh.c \
util-lua-http.c \
util-lua-ja3.c \
util-lua-packet.c \
util-lua-sandbox.c \
util-lua-smtp.c \
util-lua-ssh.c \
Expand Down
27 changes: 5 additions & 22 deletions src/detect-lua.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,6 @@ void DetectLuaRegister(void)
#define FLAG_DATATYPE_DNS_RRNAME BIT_U32(15)
#define FLAG_DATATYPE_DNS_REQUEST BIT_U32(16)
#define FLAG_DATATYPE_DNS_RESPONSE BIT_U32(17)
#define FLAG_DATATYPE_TLS BIT_U32(18)
#define FLAG_DATATYPE_SSH BIT_U32(19)
#define FLAG_DATATYPE_SMTP BIT_U32(20)
#define FLAG_DATATYPE_DNP3 BIT_U32(21)
Expand Down Expand Up @@ -354,16 +353,6 @@ static int DetectLuaMatch (DetectEngineThreadCtx *det_ctx,
lua_getglobal(tlua->luastate, "match");
lua_newtable(tlua->luastate); /* stack at -1 */

if ((tlua->flags & FLAG_DATATYPE_PAYLOAD) && p->payload_len) {
lua_pushliteral(tlua->luastate, "payload"); /* stack at -2 */
LuaPushStringBuffer (tlua->luastate, (const uint8_t *)p->payload, (size_t)p->payload_len); /* stack at -3 */
lua_settable(tlua->luastate, -3);
}
if ((tlua->flags & FLAG_DATATYPE_PACKET) && GET_PKT_LEN(p)) {
lua_pushliteral(tlua->luastate, "packet"); /* stack at -2 */
LuaPushStringBuffer (tlua->luastate, (const uint8_t *)GET_PKT_DATA(p), (size_t)GET_PKT_LEN(p)); /* stack at -3 */
lua_settable(tlua->luastate, -3);
}
if (tlua->alproto == ALPROTO_HTTP1) {
HtpState *htp_state = p->flow->alstate;
if (htp_state != NULL && htp_state->connp != NULL) {
Expand Down Expand Up @@ -485,9 +474,8 @@ static void *DetectLuaThreadInit(void *data)

if (lua->allow_restricted_functions) {
luaL_openlibs(t->luastate);
} else {
SCLuaSbLoadLibs(t->luastate);
}
SCLuaSbLoadLibs(t->luastate);
Comment on lines -488 to +478
Copy link
Member

@jasonish jasonish Jan 30, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keep the if/else. In the case of allowing restricted libs it should look like:

    luaL_openlibs(luastate);
    SCLuaRequirefBuiltIns(luastate);

As SCLuaSbLoadLibs is going to override the requires, plus re-load in already loaded libs, then wipe the ones that are not allowed. SCLuaRequirefBuiltIns just augments the standard libs with ours.


LuaRegisterExtensions(t->luastate);

Expand Down Expand Up @@ -600,9 +588,8 @@ static int DetectLuaSetupPrime(DetectEngineCtx *de_ctx, DetectLuaData *ld, const
return -1;
if (ld->allow_restricted_functions) {
luaL_openlibs(luastate);
} else {
SCLuaSbLoadLibs(luastate);
}
SCLuaSbLoadLibs(luastate);

/* hackish, needed to allow unittests to pass buffers as scripts instead of files */
#ifdef UNITTESTS
Expand Down Expand Up @@ -853,8 +840,6 @@ static int DetectLuaSetupPrime(DetectEngineCtx *de_ctx, DetectLuaData *ld, const

ld->alproto = ALPROTO_TLS;

ld->flags |= FLAG_DATATYPE_TLS;

} else if (strncmp(k, "ssh", 3) == 0 && strcmp(v, "true") == 0) {

ld->alproto = ALPROTO_SSH;
Expand Down Expand Up @@ -901,20 +886,18 @@ static int DetectLuaSetupPrime(DetectEngineCtx *de_ctx, DetectLuaData *ld, const
*/
static int DetectLuaSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
DetectLuaData *lua = NULL;

/* First check if Lua rules are enabled, by default Lua in rules
* is disabled. */
int enabled = 0;
(void)ConfGetBool("security.lua.allow-rules", &enabled);
if (!enabled) {
SCLogError("Lua rules disabled by security configuration: security.lua.allow-rules");
goto error;
return -1;
}

lua = DetectLuaParse(de_ctx, str);
DetectLuaData *lua = DetectLuaParse(de_ctx, str);
if (lua == NULL)
goto error;
return -1;

/* Load lua sandbox configurations */
intmax_t lua_alloc_limit = DEFAULT_LUA_ALLOC_LIMIT;
Expand Down
2 changes: 2 additions & 0 deletions src/util-lua-builtins.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,14 @@
#include "util-lua-builtins.h"
#include "util-lua-hashlib.h"
#include "util-lua-dataset.h"
#include "util-lua-packet.h"

#include "lauxlib.h"

static const luaL_Reg builtins[] = {
{ "suricata.hashlib", SCLuaLoadHashlib },
{ "suricata.dataset", LuaLoadDatasetLib },
{ "suricata.packet", LuaLoadPacketLib },
{ NULL, NULL },
};

Expand Down
156 changes: 0 additions & 156 deletions src/util-lua-common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,90 +133,6 @@ static int LuaCallbackStreamingBuffer(lua_State *luastate)
return LuaCallbackStreamingBufferPushToStack(luastate, b);
}

/** \internal
* \brief fill lua stack with payload
* \param luastate the lua state
* \param p packet
* \retval cnt number of data items placed on the stack
*
* Places: payload (string)
*/
static int LuaCallbackPacketPayloadPushToStackFromPacket(lua_State *luastate, const Packet *p)
{
lua_pushlstring (luastate, (const char *)p->payload, p->payload_len);
return 1;
}

/** \internal
* \brief Wrapper for getting payload into a lua script
* \retval cnt number of items placed on the stack
*/
static int LuaCallbackPacketPayload(lua_State *luastate)
{
const Packet *p = LuaStateGetPacket(luastate);
if (p == NULL)
return LuaCallbackError(luastate, "internal error: no packet");

return LuaCallbackPacketPayloadPushToStackFromPacket(luastate, p);
}

/** \internal
* \brief fill lua stack with packet timestamp
* \param luastate the lua state
* \param p packet
* \retval cnt number of data items placed on the stack
*
* Places: seconds (number), microseconds (number)
*/
static int LuaCallbackTimestampPushToStack(lua_State *luastate, const SCTime_t ts)
{
lua_pushnumber(luastate, (double)SCTIME_SECS(ts));
lua_pushnumber(luastate, (double)SCTIME_USECS(ts));
return 2;
}

/** \internal
* \brief fill lua stack with header info
* \param luastate the lua state
* \param p packet
* \retval cnt number of data items placed on the stack
*
* Places: ts (string)
*/
static int LuaCallbackTimeStringPushToStackFromPacket(lua_State *luastate, const Packet *p)
{
char timebuf[64];
CreateTimeString(p->ts, timebuf, sizeof(timebuf));
lua_pushstring (luastate, timebuf);
return 1;
}

/** \internal
* \brief Wrapper for getting packet timestamp (as numbers) into a lua script
* \retval cnt number of items placed on the stack
*/
static int LuaCallbackPacketTimestamp(lua_State *luastate)
{
const Packet *p = LuaStateGetPacket(luastate);
if (p == NULL)
return LuaCallbackError(luastate, "internal error: no packet");

return LuaCallbackTimestampPushToStack(luastate, p->ts);
}

/** \internal
* \brief Wrapper for getting tuple info into a lua script
* \retval cnt number of items placed on the stack
*/
static int LuaCallbackPacketTimeString(lua_State *luastate)
{
const Packet *p = LuaStateGetPacket(luastate);
if (p == NULL)
return LuaCallbackError(luastate, "internal error: no packet");

return LuaCallbackTimeStringPushToStackFromPacket(luastate, p);
}

/** \internal
* \brief fill lua stack with flow timestamps
* \param luastate the lua state
Expand Down Expand Up @@ -314,69 +230,6 @@ static int LuaCallbackFlowHasAlerts(lua_State *luastate)
return r;
}

/** \internal
* \brief fill lua stack with header info
* \param luastate the lua state
* \param p packet
* \retval cnt number of data items placed on the stack
*
* Places: ipver (number), src ip (string), dst ip (string), protocol (number),
* sp or icmp type (number), dp or icmp code (number).
*/
static int LuaCallbackTuplePushToStackFromPacket(lua_State *luastate, const Packet *p)
{
int ipver = 0;
if (PacketIsIPv4(p)) {
ipver = 4;
} else if (PacketIsIPv6(p)) {
ipver = 6;
}
lua_pushinteger(luastate, ipver);
if (ipver == 0)
return 1;

char srcip[46] = "", dstip[46] = "";
if (PacketIsIPv4(p)) {
PrintInet(AF_INET, (const void *)GET_IPV4_SRC_ADDR_PTR(p), srcip, sizeof(srcip));
PrintInet(AF_INET, (const void *)GET_IPV4_DST_ADDR_PTR(p), dstip, sizeof(dstip));
} else if (PacketIsIPv6(p)) {
PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), srcip, sizeof(srcip));
PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), dstip, sizeof(dstip));
}

lua_pushstring (luastate, srcip);
lua_pushstring (luastate, dstip);

/* proto and ports (or type/code) */
lua_pushinteger(luastate, p->proto);
if (p->proto == IPPROTO_TCP || p->proto == IPPROTO_UDP) {
lua_pushinteger(luastate, p->sp);
lua_pushinteger(luastate, p->dp);

} else if (p->proto == IPPROTO_ICMP || p->proto == IPPROTO_ICMPV6) {
lua_pushinteger(luastate, p->icmp_s.type);
lua_pushinteger(luastate, p->icmp_s.code);
} else {
lua_pushinteger(luastate, 0);
lua_pushinteger(luastate, 0);
}

return 6;
}

/** \internal
* \brief Wrapper for getting tuple info into a lua script
* \retval cnt number of items placed on the stack
*/
static int LuaCallbackTuple(lua_State *luastate)
{
const Packet *p = LuaStateGetPacket(luastate);
if (p == NULL)
return LuaCallbackError(luastate, "internal error: no packet");

return LuaCallbackTuplePushToStackFromPacket(luastate, p);
}

/** \internal
* \brief fill lua stack with header info
* \param luastate the lua state
Expand Down Expand Up @@ -931,15 +784,6 @@ static int LuaCallbackThreadInfo(lua_State *luastate)
int LuaRegisterFunctions(lua_State *luastate)
{
/* registration of the callbacks */
lua_pushcfunction(luastate, LuaCallbackPacketPayload);
lua_setglobal(luastate, "SCPacketPayload");
lua_pushcfunction(luastate, LuaCallbackPacketTimestamp);
lua_setglobal(luastate, "SCPacketTimestamp");
lua_pushcfunction(luastate, LuaCallbackPacketTimeString);
lua_setglobal(luastate, "SCPacketTimeString");
lua_pushcfunction(luastate, LuaCallbackTuple);
lua_setglobal(luastate, "SCPacketTuple");

lua_pushcfunction(luastate, LuaCallbackFlowTimestamps);
lua_setglobal(luastate, "SCFlowTimestamps");
lua_pushcfunction(luastate, LuaCallbackFlowTimeString);
Expand Down
Loading
Loading