suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  */
23 
24 #ifndef __APP_LAYER_FTP_H__
25 #define __APP_LAYER_FTP_H__
26 
27 enum {
31 };
32 
33 typedef enum {
83  /** \todo more if missing.. */
85 typedef uint32_t FtpRequestCommandArgOfs;
86 
87 typedef uint16_t FtpResponseCode;
88 
89 enum {
91 
95 
98 
99  /* must be last */
101 };
102 
103 /** used to hold the line state when we have fragmentation. */
104 typedef struct FtpLineState_ {
105  /** used to indicate if the current_line buffer is a malloced buffer. We
106  * use a malloced buffer, if a line is fragmented */
107  uint8_t *db;
108  uint32_t db_len;
110  /** we have see LF for the currently parsed line */
112 } FtpLineState;
113 
114 /** FTP State for app layer parser */
115 typedef struct FtpState_ {
116  uint8_t *input;
117  int32_t input_len;
118  uint8_t direction;
119  bool active;
120 
121  /* --parser details-- */
122  /** current line extracted by the parser from the call to FTPGetline() */
123  uint8_t *current_line;
124  /** length of the line in current_line. Doesn't include the delimiter */
127 
128  /* 0 for toserver, 1 for toclient */
129  FtpLineState line_state[2];
130 
133  uint32_t port_line_len;
134  uint32_t port_line_size;
135  uint8_t *port_line;
136 
137  uint16_t dyn_port;
138  /* specifies which loggers are done logging */
139  uint32_t logged;
140 
142 } FtpState;
143 
144 enum {
147 };
148 
149 /** FTP Data State for app layer parser */
150 typedef struct FtpDataState_ {
151  uint8_t *input;
152  uint8_t *file_name;
155  int32_t input_len;
156  int16_t file_len;
158  uint8_t state;
159  uint8_t direction;
160 } FtpDataState;
161 
162 void RegisterFTPParsers(void);
163 void FTPParserRegisterTests(void);
164 void FTPAtExitPrintStats(void);
165 uint64_t FTPMemuseGlobalCounter(void);
166 uint64_t FTPMemcapGlobalCounter(void);
167 
168 #ifdef HAVE_LIBJANSSON
169 json_t *JsonFTPDataAddMetadata(const Flow *f);
170 #endif
171 
172 #endif /* __APP_LAYER_FTP_H__ */
173 
void RegisterFTPParsers(void)
uint8_t * input
int16_t file_len
uint8_t * file_name
void FTPAtExitPrintStats(void)
FtpRequestCommand command
uint8_t direction
struct FtpState_ FtpState
struct FtpLineState_ FtpLineState
int32_t input_len
FtpRequestCommand command
DetectEngineState * de_state
uint8_t * port_line
uint16_t dyn_port
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:85
uint8_t * current_line
uint32_t logged
uint32_t db_len
uint64_t FTPMemuseGlobalCounter(void)
FtpRequestCommandArgOfs arg_offset
uint8_t current_line_lf_seen
uint32_t port_line_len
uint8_t direction
uint32_t port_line_size
uint64_t FTPMemcapGlobalCounter(void)
struct FtpDataState_ FtpDataState
FtpRequestCommand
Definition: app-layer-ftp.h:33
uint32_t current_line_len
DetectEngineState * de_state
uint8_t * db
uint8_t * input
int32_t input_len
void FTPParserRegisterTests(void)
Flow data structure.
Definition: flow.h:325
uint8_t current_line_delimiter_len
uint16_t FtpResponseCode
Definition: app-layer-ftp.h:87
FileContainer * files
uint8_t current_line_db