Lua scripting support

1 reply
53 views

I'm developing a custom IPS signature for FortiOS 7.4 and want to understand the Lua scripting support in custom IPS rules. Specifically:

(1) Can custom IPS rules written in Lua access the os and io modules?

(2) Are there any sandboxing restrictions on what Lua code can do in a custom IPS rule handler?

(3) Is the Lua state for IPS rules a shared state or per-session isolated state?

osoleimani

Staff

Hi lmgod,

Interesting questions. I checked the public FortiOS 7.4 IPS documentation, and the documented custom IPS mechanism is the F-SBID signature language, with protocol, payload, special, and application options. The public 7.4 documentation does not appear to document the Lua runtime environment, including access to “os” / “io”, sandbox restrictions, or Lua-state lifetime.

Because those details concern the IPS engine's internal execution environment, I would be cautious about assuming standard Lua behavior for a custom IPS handler without Fortinet-specific documentation confirming it.

FortiOS 7.4 — Custom IPS and Application Control Signature Syntax Guide

Hope this helps distinguish what is publicly documented from the IPS engine internals you're asking about.