suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Jeff Lucovsky <jeff@lucovsky.org>
23  */
24 
25 #ifndef __APP_LAYER_FTP_H__
26 #define __APP_LAYER_FTP_H__
27 
28 enum {
32 };
33 
34 typedef enum {
84 
85  /* must be last */
87  /** \todo more if missing.. */
89 
90 typedef struct FtpCommand_ {
92  const char *command_name;
93  const uint8_t command_length;
94 } FtpCommand;
95 extern const FtpCommand FtpCommands[FTP_COMMAND_MAX + 1];
96 
97 typedef uint32_t FtpRequestCommandArgOfs;
98 
99 typedef uint16_t FtpResponseCode;
100 
101 enum {
103 
107 
110 
111  /* must be last */
113 };
114 
115 /** used to hold the line state when we have fragmentation. */
116 typedef struct FtpLineState_ {
117  /** used to indicate if the current_line buffer is a malloced buffer. We
118  * use a malloced buffer, if a line is fragmented */
119  uint8_t *db;
120  uint32_t db_len;
122  /** we have see LF for the currently parsed line */
124 } FtpLineState;
125 
126 typedef struct FTPString_ {
127  uint8_t *str;
128  uint16_t len;
130 } FTPString;
131 
132 typedef struct FTPTransaction_ {
133  /** id of this tx, starting at 0 */
134  uint64_t tx_id;
135 
136  uint64_t detect_flags_ts;
137  uint64_t detect_flags_tc;
138 
139  /** indicates loggers done logging */
140  uint32_t logged;
141 
142  /* for the request */
143  uint32_t request_length;
144  uint8_t *request;
145 
146  /* for the command description */
148 
149  uint16_t dyn_port; /* dynamic port, if applicable */
150  bool done; /* transaction complete? */
151  bool active; /* active or passive mode */
152 
153  uint8_t direction;
154 
155  /* Handle multiple responses */
156  TAILQ_HEAD(, FTPString_) response_list;
157 
158  DetectEngineState *de_state;
159 
160  TAILQ_ENTRY(FTPTransaction_) next;
162 
163 /** FTP State for app layer parser */
164 typedef struct FtpState_ {
165  const uint8_t *input;
166  int32_t input_len;
167  uint8_t direction;
168  bool active;
169 
171  TAILQ_HEAD(, FTPTransaction_) tx_list; /**< transaction list */
172  uint64_t tx_cnt;
173 
174  /* --parser details-- */
175  /** current line extracted by the parser from the call to FTPGetline() */
176  const uint8_t *current_line;
177  /** length of the line in current_line. Doesn't include the delimiter */
178  uint32_t current_line_len;
179  uint8_t current_line_delimiter_len;
180 
181  /* 0 for toserver, 1 for toclient */
182  FtpLineState line_state[2];
183 
186  uint32_t port_line_len;
187  uint32_t port_line_size;
188  uint8_t *port_line;
189 
190  uint16_t dyn_port;
191  /* specifies which loggers are done logging */
192  uint32_t logged;
193 
194 } FtpState;
195 
196 enum {
199 };
200 
201 /** FTP Data State for app layer parser */
202 typedef struct FtpDataState_ {
203  uint8_t *input;
204  uint8_t *file_name;
207  int32_t input_len;
208  int16_t file_len;
210  uint8_t state;
211  uint8_t direction;
212  uint64_t detect_flags_ts;
213  uint64_t detect_flags_tc;
214 } FtpDataState;
215 
216 void RegisterFTPParsers(void);
217 void FTPParserRegisterTests(void);
218 void FTPAtExitPrintStats(void);
219 void FTPParserCleanup(void);
220 uint64_t FTPMemuseGlobalCounter(void);
221 uint64_t FTPMemcapGlobalCounter(void);
222 
223 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
224 json_t *JsonFTPDataAddMetadata(const Flow *f);
225 
226 #endif /* __APP_LAYER_FTP_H__ */
227 
void FTPParserCleanup(void)
Free memory allocated for global SMTP parser state.
void RegisterFTPParsers(void)
struct HtpBodyChunk_ * next
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
Definition: app-layer-ftp.c:75
const uint8_t command_length
Definition: app-layer-ftp.h:93
uint64_t detect_flags_ts
struct FtpCommand_ FtpCommand
int16_t file_len
uint8_t * file_name
uint8_t * request
void FTPAtExitPrintStats(void)
const char * command_name
Definition: app-layer-ftp.h:92
#define TAILQ_HEAD(name, type)
Definition: queue.h:321
uint64_t detect_flags_tc
uint8_t direction
struct FtpLineState_ FtpLineState
int32_t input_len
FtpRequestCommand command
FTPTransaction * curr_tx
const uint8_t * input
uint8_t * str
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:97
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
uint32_t db_len
uint64_t FTPMemuseGlobalCounter(void)
#define TAILQ_ENTRY(type)
Definition: queue.h:330
uint32_t request_length
uint8_t current_line_lf_seen
json_t * JsonFTPDataAddMetadata(const Flow *f)
uint8_t direction
uint64_t FTPMemcapGlobalCounter(void)
struct FtpDataState_ FtpDataState
FtpRequestCommand
Definition: app-layer-ftp.h:34
uint64_t detect_flags_tc
DetectEngineState * de_state
uint8_t * db
uint64_t detect_flags_ts
const FtpCommand * command_descriptor
uint8_t * input
uint16_t len
int32_t input_len
void FTPParserRegisterTests(void)
Flow data structure.
Definition: flow.h:325
uint16_t FtpResponseCode
Definition: app-layer-ftp.h:99
FileContainer * files
FtpRequestCommand command
Definition: app-layer-ftp.h:91
uint8_t current_line_db