|
|
@ -80,7 +80,6 @@ static int LuaGetFlowvar(lua_State *luastate)
|
|
|
|
Flow *f;
|
|
|
|
Flow *f;
|
|
|
|
FlowVar *fv;
|
|
|
|
FlowVar *fv;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
int flow_lock = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
lua_pushlightuserdata(luastate, (void *)&luaext_key_ld);
|
|
|
|
lua_pushlightuserdata(luastate, (void *)&luaext_key_ld);
|
|
|
@ -94,7 +93,7 @@ static int LuaGetFlowvar(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* need flow and lock hint */
|
|
|
|
/* need flow and lock hint */
|
|
|
|
f = LuaStateGetFlow(luastate, &flow_lock);
|
|
|
|
f = LuaStateGetFlow(luastate);
|
|
|
|
if (f == NULL) {
|
|
|
|
if (f == NULL) {
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
@ -120,15 +119,8 @@ static int LuaGetFlowvar(lua_State *luastate)
|
|
|
|
return 2;
|
|
|
|
return 2;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* lookup var */
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_RDLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
if (fv == NULL) {
|
|
|
|
if (fv == NULL) {
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_UNLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow var");
|
|
|
|
lua_pushstring(luastate, "no flow var");
|
|
|
|
return 2;
|
|
|
|
return 2;
|
|
|
@ -137,9 +129,6 @@ static int LuaGetFlowvar(lua_State *luastate)
|
|
|
|
LuaPushStringBuffer(luastate, (const uint8_t *)fv->data.fv_str.value,
|
|
|
|
LuaPushStringBuffer(luastate, (const uint8_t *)fv->data.fv_str.value,
|
|
|
|
(size_t)fv->data.fv_str.value_len);
|
|
|
|
(size_t)fv->data.fv_str.value_len);
|
|
|
|
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_UNLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
}
|
|
|
@ -154,7 +143,6 @@ int LuaSetFlowvar(lua_State *luastate)
|
|
|
|
uint8_t *buffer;
|
|
|
|
uint8_t *buffer;
|
|
|
|
DetectEngineThreadCtx *det_ctx;
|
|
|
|
DetectEngineThreadCtx *det_ctx;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
int flow_lock = 0;
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
lua_pushlightuserdata(luastate, (void *)&luaext_key_ld);
|
|
|
|
lua_pushlightuserdata(luastate, (void *)&luaext_key_ld);
|
|
|
@ -179,7 +167,7 @@ int LuaSetFlowvar(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* need flow and lock hint */
|
|
|
|
/* need flow and lock hint */
|
|
|
|
f = LuaStateGetFlow(luastate, &flow_lock);
|
|
|
|
f = LuaStateGetFlow(luastate);
|
|
|
|
if (f == NULL) {
|
|
|
|
if (f == NULL) {
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
@ -239,10 +227,7 @@ int LuaSetFlowvar(lua_State *luastate)
|
|
|
|
memcpy(buffer, str, len);
|
|
|
|
memcpy(buffer, str, len);
|
|
|
|
buffer[len] = '\0';
|
|
|
|
buffer[len] = '\0';
|
|
|
|
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FlowVarAddStr(f, idx, buffer, len);
|
|
|
|
FlowVarAddStr(f, idx, buffer, len);
|
|
|
|
else
|
|
|
|
|
|
|
|
FlowVarAddStrNoLock(f, idx, buffer, len);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//SCLogInfo("stored:");
|
|
|
|
//SCLogInfo("stored:");
|
|
|
|
//PrintRawDataFp(stdout,buffer,len);
|
|
|
|
//PrintRawDataFp(stdout,buffer,len);
|
|
|
@ -256,7 +241,6 @@ static int LuaGetFlowint(lua_State *luastate)
|
|
|
|
Flow *f;
|
|
|
|
Flow *f;
|
|
|
|
FlowVar *fv;
|
|
|
|
FlowVar *fv;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
int flow_lock = 0;
|
|
|
|
|
|
|
|
uint32_t number;
|
|
|
|
uint32_t number;
|
|
|
|
|
|
|
|
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
@ -271,7 +255,7 @@ static int LuaGetFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* need flow and lock hint */
|
|
|
|
/* need flow and lock hint */
|
|
|
|
f = LuaStateGetFlow(luastate, &flow_lock);
|
|
|
|
f = LuaStateGetFlow(luastate);
|
|
|
|
if (f == NULL) {
|
|
|
|
if (f == NULL) {
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
@ -301,24 +285,15 @@ static int LuaGetFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* lookup var */
|
|
|
|
/* lookup var */
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_RDLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
if (fv == NULL) {
|
|
|
|
if (fv == NULL) {
|
|
|
|
SCLogDebug("fv NULL");
|
|
|
|
SCLogDebug("fv NULL");
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_UNLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow var");
|
|
|
|
lua_pushstring(luastate, "no flow var");
|
|
|
|
return 2;
|
|
|
|
return 2;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
number = fv->data.fv_int.value;
|
|
|
|
number = fv->data.fv_int.value;
|
|
|
|
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_UNLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* return value through luastate, as a luanumber */
|
|
|
|
/* return value through luastate, as a luanumber */
|
|
|
|
lua_pushnumber(luastate, (lua_Number)number);
|
|
|
|
lua_pushnumber(luastate, (lua_Number)number);
|
|
|
|
SCLogDebug("retrieved flow:%p idx:%u value:%u", f, idx, number);
|
|
|
|
SCLogDebug("retrieved flow:%p idx:%u value:%u", f, idx, number);
|
|
|
@ -334,7 +309,6 @@ int LuaSetFlowint(lua_State *luastate)
|
|
|
|
Flow *f;
|
|
|
|
Flow *f;
|
|
|
|
DetectEngineThreadCtx *det_ctx;
|
|
|
|
DetectEngineThreadCtx *det_ctx;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
int flow_lock = 0;
|
|
|
|
|
|
|
|
uint32_t number;
|
|
|
|
uint32_t number;
|
|
|
|
lua_Number luanumber;
|
|
|
|
lua_Number luanumber;
|
|
|
|
|
|
|
|
|
|
|
@ -361,7 +335,7 @@ int LuaSetFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* need flow and lock hint */
|
|
|
|
/* need flow and lock hint */
|
|
|
|
f = LuaStateGetFlow(luastate, &flow_lock);
|
|
|
|
f = LuaStateGetFlow(luastate);
|
|
|
|
if (f == NULL) {
|
|
|
|
if (f == NULL) {
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
@ -401,10 +375,7 @@ int LuaSetFlowint(lua_State *luastate)
|
|
|
|
return 2;
|
|
|
|
return 2;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FlowVarAddInt(f, idx, number);
|
|
|
|
FlowVarAddInt(f, idx, number);
|
|
|
|
else
|
|
|
|
|
|
|
|
FlowVarAddIntNoLock(f, idx, number);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
SCLogDebug("stored flow:%p idx:%u value:%u", f, idx, number);
|
|
|
|
SCLogDebug("stored flow:%p idx:%u value:%u", f, idx, number);
|
|
|
|
return 0;
|
|
|
|
return 0;
|
|
|
@ -417,7 +388,6 @@ static int LuaIncrFlowint(lua_State *luastate)
|
|
|
|
Flow *f;
|
|
|
|
Flow *f;
|
|
|
|
FlowVar *fv;
|
|
|
|
FlowVar *fv;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
int flow_lock = 0;
|
|
|
|
|
|
|
|
uint32_t number;
|
|
|
|
uint32_t number;
|
|
|
|
|
|
|
|
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
@ -432,7 +402,7 @@ static int LuaIncrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* need flow and lock hint */
|
|
|
|
/* need flow and lock hint */
|
|
|
|
f = LuaStateGetFlow(luastate, &flow_lock);
|
|
|
|
f = LuaStateGetFlow(luastate);
|
|
|
|
if (f == NULL) {
|
|
|
|
if (f == NULL) {
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
@ -462,9 +432,6 @@ static int LuaIncrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* lookup var */
|
|
|
|
/* lookup var */
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_RDLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
if (fv == NULL) {
|
|
|
|
if (fv == NULL) {
|
|
|
|
number = 1;
|
|
|
|
number = 1;
|
|
|
@ -475,9 +442,6 @@ static int LuaIncrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FlowVarAddIntNoLock(f, idx, number);
|
|
|
|
FlowVarAddIntNoLock(f, idx, number);
|
|
|
|
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_UNLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* return value through luastate, as a luanumber */
|
|
|
|
/* return value through luastate, as a luanumber */
|
|
|
|
lua_pushnumber(luastate, (lua_Number)number);
|
|
|
|
lua_pushnumber(luastate, (lua_Number)number);
|
|
|
|
SCLogDebug("incremented flow:%p idx:%u value:%u", f, idx, number);
|
|
|
|
SCLogDebug("incremented flow:%p idx:%u value:%u", f, idx, number);
|
|
|
@ -493,7 +457,6 @@ static int LuaDecrFlowint(lua_State *luastate)
|
|
|
|
Flow *f;
|
|
|
|
Flow *f;
|
|
|
|
FlowVar *fv;
|
|
|
|
FlowVar *fv;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
DetectLuaData *ld;
|
|
|
|
int flow_lock = 0;
|
|
|
|
|
|
|
|
uint32_t number;
|
|
|
|
uint32_t number;
|
|
|
|
|
|
|
|
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
|
/* need luajit data for id -> idx conversion */
|
|
|
@ -508,7 +471,7 @@ static int LuaDecrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* need flow and lock hint */
|
|
|
|
/* need flow and lock hint */
|
|
|
|
f = LuaStateGetFlow(luastate, &flow_lock);
|
|
|
|
f = LuaStateGetFlow(luastate);
|
|
|
|
if (f == NULL) {
|
|
|
|
if (f == NULL) {
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushnil(luastate);
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
|
lua_pushstring(luastate, "no flow");
|
|
|
@ -538,9 +501,6 @@ static int LuaDecrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* lookup var */
|
|
|
|
/* lookup var */
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_RDLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
fv = FlowVarGet(f, idx);
|
|
|
|
if (fv == NULL) {
|
|
|
|
if (fv == NULL) {
|
|
|
|
number = 0;
|
|
|
|
number = 0;
|
|
|
@ -551,9 +511,6 @@ static int LuaDecrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
FlowVarAddIntNoLock(f, idx, number);
|
|
|
|
FlowVarAddIntNoLock(f, idx, number);
|
|
|
|
|
|
|
|
|
|
|
|
if (flow_lock == LUA_FLOW_NOT_LOCKED_BY_PARENT)
|
|
|
|
|
|
|
|
FLOWLOCK_UNLOCK(f);
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* return value through luastate, as a luanumber */
|
|
|
|
/* return value through luastate, as a luanumber */
|
|
|
|
lua_pushnumber(luastate, (lua_Number)number);
|
|
|
|
lua_pushnumber(luastate, (lua_Number)number);
|
|
|
|
SCLogDebug("decremented flow:%p idx:%u value:%u", f, idx, number);
|
|
|
|
SCLogDebug("decremented flow:%p idx:%u value:%u", f, idx, number);
|
|
|
@ -563,7 +520,7 @@ static int LuaDecrFlowint(lua_State *luastate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void LuaExtensionsMatchSetup(lua_State *lua_state, DetectLuaData *ld, DetectEngineThreadCtx *det_ctx,
|
|
|
|
void LuaExtensionsMatchSetup(lua_State *lua_state, DetectLuaData *ld, DetectEngineThreadCtx *det_ctx,
|
|
|
|
Flow *f, int flow_locked, Packet *p, uint8_t flags)
|
|
|
|
Flow *f, Packet *p, uint8_t flags)
|
|
|
|
{
|
|
|
|
{
|
|
|
|
SCLogDebug("det_ctx %p, f %p", det_ctx, f);
|
|
|
|
SCLogDebug("det_ctx %p, f %p", det_ctx, f);
|
|
|
|
|
|
|
|
|
|
|
@ -577,9 +534,9 @@ void LuaExtensionsMatchSetup(lua_State *lua_state, DetectLuaData *ld, DetectEngi
|
|
|
|
lua_pushlightuserdata(lua_state, (void *)det_ctx);
|
|
|
|
lua_pushlightuserdata(lua_state, (void *)det_ctx);
|
|
|
|
lua_settable(lua_state, LUA_REGISTRYINDEX);
|
|
|
|
lua_settable(lua_state, LUA_REGISTRYINDEX);
|
|
|
|
|
|
|
|
|
|
|
|
LuaStateSetFlow(lua_state, f, flow_locked);
|
|
|
|
LuaStateSetFlow(lua_state, f);
|
|
|
|
|
|
|
|
|
|
|
|
if (det_ctx->tx_id_set && flow_locked == LUA_FLOW_LOCKED_BY_PARENT) {
|
|
|
|
if (det_ctx->tx_id_set) {
|
|
|
|
if (f && f->alstate) {
|
|
|
|
if (f && f->alstate) {
|
|
|
|
void *txptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, det_ctx->tx_id);
|
|
|
|
void *txptr = AppLayerParserGetTx(f->proto, f->alproto, f->alstate, det_ctx->tx_id);
|
|
|
|
if (txptr) {
|
|
|
|
if (txptr) {
|
|
|
|