Initial support for Lua script engine

Author: Felipe Zimmerle

CHANGES

@@ -2,6 +2,8 @@
 v3.0.????? - ?
 ---------------------------
 
+ - Adds initial support for Lua engine.
+ [Issue #994 - @zimmerle]
  - Adds support for @inspectFile operator.
  [Issue #999 - @zimmerle, @victorhora]
  - Adds support for RESOURCE variable collection.

src/Makefile.am

@@ -79,7 +79,7 @@ noinst_HEADERS = \
 
 
 ENGINES = \
-engines/lua.cc
+engine/lua.cc
 
 
 VARIABLES = \

src/engine/lua.cc

@@ -0,0 +1,377 @@
+/*
+ * ModSecurity, http://www.modsecurity.org/
+ * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ *
+ * You may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * If any of the files related to licensing are missing or if you have any
+ * other questions related to licensing please contact Trustwave Holdings, Inc.
+ * directly using the email address [email protected].
+ *
+*/
+
+
+#include"modsecurity/modsecurity.h"
+#include"src/engine/lua.h"
+#include"src/utils/string.h"
+#include"src/macro_expansion.h"
+#include"modsecurity/transaction.h"
+#include"modsecurity/collection/variable.h"
+#include"src/variables/variable.h"
+#include"src/variables/highest_severity.h"
+#include"src/utils/string.h"
+#include"src/actions/transformations/transformation.h"
+
+#include<vector>
+#include<string>
+#include<algorithm>
+#include<sstream>
+#include<iterator>
+#include<iostream>
+
+#include<stdio.h>
+#include<string.h>
+
+
+namespacemodsecurity{
+namespaceengine{
+
+
+boolLua::isCompatible(std::string script, Lua *l, std::string *error){
+ std::string lua(".lua");
+ std::string err;
+
+if (!(script.size() >= lua.size() &&
+ script.compare(script.size() - lua.size(), lua.size(), lua) == 0))
+{
+ error->assign("Expecting a Lua script: " + script);
+returnfalse;
+ }
+
+if (l->load(script, &err) == false){
+ error->assign("Problems load script: " + err);
+returnfalse;
+ }
+
+returntrue;
+}
+
+
+boolLua::load(std::string script, std::string *err){
+ lua_State *L = NULL;
+ L = luaL_newstate();
+luaL_openlibs(L);
+
+ m_scriptName = script;
+if (luaL_loadfile(L, script.c_str())){
+constchar *luaerr = lua_tostring(L, -1);
+ err->assign("Failed to compile script '" + script + "");
+if (luaerr){
+ err->append(": " + *luaerr);
+ }
+ err->append(".");
+lua_close(L);
+
+returnfalse;
+ }
+
+if (lua_dump(L, Lua::blob_keeper, (void *)&m_blob, 0)){
+constchar *luaerr = lua_tostring(L, -1);
+ err->assign("Failed to compile script '" + script + "");
+if (luaerr){
+ err->append(": " + *luaerr);
+ }
+ err->append(".");
+lua_close(L);
+
+returnfalse;
+ }
+
+
+lua_close(L);
+returntrue;
+}
+
+
+intLua::blob_keeper(lua_State *L, constvoid *p, size_t sz, void *ud){
+ LuaScriptBlob *lsb = static_cast<LuaScriptBlob *>(ud);
+ lsb->write(p, sz);
+return0;
+}
+
+
+constchar *Lua::blob_reader(lua_State *L, void *ud, size_t *size){
+ LuaScriptBlob *lsb = static_cast<LuaScriptBlob *>(ud);
+constchar *data = lsb->read(size);
+return data;
+}
+
+
+intLua::run(Transaction *t){
+ std::string luaRet;
+ lua_State *L = luaL_newstate();
+luaL_openlibs(L);
+
+luaL_newmetatable(L, "luaL_msc");
+lua_newtable(L);
+
+lua_pushlightuserdata(L, (void *)t);
+lua_setglobal(L, "__transaction");
+
+luaL_setfuncs(L, mscLuaLib, 0);
+lua_setglobal(L, "m");
+
+int rc = lua_load(L, Lua::blob_reader, &m_blob, m_scriptName.c_str(),
+NULL);
+if (rc != LUA_OK){
+ std::string e;
+ e.assign("Failed to execute lua script: " + m_scriptName + ". ");
+switch (rc){
+case LUA_ERRSYNTAX:
+ e.assign("Syntax error. ");
+break;
+case LUA_ERRMEM:
+ e.assign("Memory error. ");
+break;
+case LUA_ERRGCMM:
+ e.assign("Garbage Collector error. ");
+break;
+ }
+ e.append(lua_tostring(L, -1));
+ t->debug(2, e);
+returnfalse;
+ }
+
+if (lua_pcall(L, 0, 0, 0)){
+ std::string e;
+constchar *luaerr = lua_tostring(L, -1);
+ e.assign("Failed to execute lua script: " + m_scriptName \
+ + " (before main)");
+if (luaerr != NULL){
+ e.append(" - ");
+ e.append(luaerr);
+ }
+ t->debug(2, e);
+returnfalse;
+ }
+
+lua_setglobal(L, "modsec");
+
+lua_getglobal(L, "main");
+if (lua_pcall(L, 0, 1, 0)){
+ std::string e;
+constchar *luaerr = lua_tostring(L, -1);
+ e.assign("Failed to execute lua script: " + m_scriptName + " (main)");
+if (luaerr != NULL){
+ e.append(" - ");
+ e.append(luaerr);
+ }
+ t->debug(2, e);
+returnfalse;
+ }
+
+char *a = (char *)lua_tostring(L, -1);
+if (a != NULL){
+ luaRet.assign(a);
+ }
+
+ t->debug(9, "Returning from lua script: " + luaRet);
+
+lua_pop(L, 1);
+lua_close(L);
+
+if (luaRet.size() == 0){
+returnfalse;
+ }
+
+returntrue;
+}
+
+
+intLua::log(lua_State *L){
+ Transaction *t = NULL;
+constchar *text;
+int level;
+
+/* Retrieve parameters. */
+ level = luaL_checknumber(L, 1);
+ text = luaL_checkstring(L, 2);
+
+/* Retrieve msr. */
+lua_getglobal(L, "__transaction");
+ t = (Transaction *)lua_topointer(L, -1);
+
+/* Log message. */
+if (t != NULL){
+ t->debug(level, text);
+ }
+
+return0;
+}
+
+
+intLua::getvar(lua_State *L){
+char *varname = NULL;
+ Transaction *t = NULL;
+
+/* Retrieve parameters. */
+ varname = (char *)luaL_checkstring(L, 1);
+
+lua_getglobal(L, "__transaction");
+ t = (Transaction *)lua_topointer(L, -1);
+
+ std::string var = Variables::Variable::stringMatchResolve(t, varname);
+ var = applyTransformations(L, t, 2, var);
+
+if (var.size() == 0){
+lua_pushnil(L);
+return0;
+ }
+
+lua_pushlstring(L, var.c_str(), var.size());
+
+return1;
+}
+
+
+intLua::getvars(lua_State *L){
+char *varname = NULL;
+ Transaction *t = NULL;
+ std::vector<const collection::Variable *> l;
+int idx = 1;
+
+/* Retrieve parameters. */
+ varname = (char *)luaL_checkstring(L, 1);
+
+lua_getglobal(L, "__transaction");
+ t = (Transaction *)lua_topointer(L, -1);
+
+Variables::Variable::stringMatchResolveMulti(t, varname, &l);
+
+lua_newtable(L);
+for (auto i : l){
+lua_pushnumber(L, idx);
+lua_newtable(L);
+
+lua_pushstring(L, "name");
+lua_pushlstring(L, i->m_key.c_str(), i->m_key.size());
+lua_settable(L, -3);
+
+lua_pushstring(L, "value");
+lua_pushlstring(L, i->m_value.c_str(), i->m_value.size());
+lua_settable(L, -3);
+
+lua_settable(L, -3);
+ idx++;
+ }
+
+return1;
+}
+
+
+intLua::setvar(lua_State *L){
+ Transaction *t = NULL;
+constchar *var_value = NULL;
+constchar *var_name = NULL;
+ std::string vname;
+ std::string collection;
+ std::string variableName;
+int nargs = lua_gettop(L);
+char *chr = NULL;
+size_t pos;
+
+lua_getglobal(L, "__transaction");
+ t = (Transaction *)lua_topointer(L, -1);
+
+if (nargs != 2){
+ t->debug(8, "m.setvar: Failed m.setvar funtion must has 2 arguments");
+return -1;
+ }
+ var_value = luaL_checkstring(L, 2);
+ var_name = luaL_checkstring(L, 1);
+
+lua_pop(L, 2);
+
+if (var_value == NULL || var_name == NULL){
+return -1;
+ }
+
+ vname.assign(var_name);
+ pos = vname.find(".");
+if (pos != std::string::npos){
+ collection = std::string(vname, 0, pos);
+ collection = utils::string::toupper(collection);
+ variableName = std::string(vname, pos + 1,
+ std::string::npos);
+
+ } else{
+ t->debug(8, "m.setvar: Must specify a collection using dot character" \
+" - ie m.setvar(tx.myvar,mydata)");
+return -1;
+ }
+
+ t->m_collections.storeOrUpdateFirst(collection,
+ variableName, var_value);
+}
+
+
+std::string Lua::applyTransformations(lua_State *L, Transaction *t, int idx, std::string var){
+ std::string newVar = var;
+
+if (lua_isuserdata(L, idx) || lua_isnoneornil(L, idx)){
+return var;
+ }
+
+if (lua_istable(L, idx)){
+char *name = NULL;
+int i, n = lua_rawlen(L, idx);
+
+for (i = 1; i <= n; i++){
+lua_rawgeti(L, idx, i);
+ name = (char *)luaL_checkstring(L, -1);
+
+/* A "none" means start over */
+if (strcmp("none", name) == 0){
+ newVar = var;
+continue;
+ }
+
+ actions::transformations::Transformation *tfn = actions::transformations::Transformation::instantiate("t:" + std::string(name));
+// FIXME: transformation is not yet returning null. 
+if (tfn){
+ newVar = tfn->evaluate(newVar, t);
+ } else{
+ t->debug(1, "SecRuleScript: Invalid transformation function: " + std::string(name));
+ }
+ }
+
+return newVar;
+ }
+
+if (lua_isstring(L, idx)){
+char *name = (char *)luaL_checkstring(L, idx);
+
+ actions::transformations::Transformation *tfn = actions::transformations::Transformation::instantiate("t:" + std::string(name));
+// FIXME: transformation is not yet returning null. 
+if (tfn){
+ newVar = tfn->evaluate(newVar, t);
+ } else{
+ t->debug(1, "SecRuleScript: Invalid transformation function: " + std::string(name));
+ }
+return newVar;
+ }
+
+ t->debug(8, "SecRuleScript: Transformation parameter must be a " \
+"transformation name or array of transformation names, but found " \
+"" + std::string(lua_typename(L, idx)) + " (type " \
+ + std::to_string(lua_type(L, idx)) + ")");
+
+return newVar;
+}
+
+
+} // namespace engines
+} // namespace modsecurity