suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Jeff Lucovsky <jeff@lucovsky.org>
23  */
24 
25 #ifndef __APP_LAYER_FTP_H__
26 #define __APP_LAYER_FTP_H__
27 
28 enum {
32 };
33 
34 typedef enum {
84 
85  /* must be last */
87  /** \todo more if missing.. */
89 
90 typedef struct FtpCommand_ {
92  const char *command_name_upper;
93  const char *command_name_lower;
94  const uint8_t command_length;
95 } FtpCommand;
96 extern const FtpCommand FtpCommands[FTP_COMMAND_MAX + 1];
97 
98 typedef uint32_t FtpRequestCommandArgOfs;
99 
100 typedef uint16_t FtpResponseCode;
101 
102 enum {
104 
108 
111 
112  /* must be last */
114 };
115 
116 /** used to hold the line state when we have fragmentation. */
117 typedef struct FtpLineState_ {
118  /** used to indicate if the current_line buffer is a malloced buffer. We
119  * use a malloced buffer, if a line is fragmented */
120  uint8_t *db;
121  uint32_t db_len;
123  /** we have see LF for the currently parsed line */
125 } FtpLineState;
126 
127 typedef struct FTPString_ {
128  uint8_t *str;
129  uint16_t len;
131 } FTPString;
132 
133 typedef struct FTPTransaction_ {
134  /** id of this tx, starting at 0 */
135  uint64_t tx_id;
136 
137  uint64_t detect_flags_ts;
138  uint64_t detect_flags_tc;
139 
140  /** indicates loggers done logging */
141  uint32_t logged;
142 
143  /* for the request */
144  uint32_t request_length;
145  uint8_t *request;
146 
147  /* for the command description */
149 
150  uint16_t dyn_port; /* dynamic port, if applicable */
151  bool done; /* transaction complete? */
152  bool active; /* active or passive mode */
153 
154  uint8_t direction;
155 
156  /* Handle multiple responses */
157  TAILQ_HEAD(, FTPString_) response_list;
158 
159  DetectEngineState *de_state;
160 
161  TAILQ_ENTRY(FTPTransaction_) next;
163 
164 /** FTP State for app layer parser */
165 typedef struct FtpState_ {
166  uint8_t *input;
167  int32_t input_len;
168  uint8_t direction;
169  bool active;
170 
172  TAILQ_HEAD(, FTPTransaction_) tx_list; /**< transaction list */
173  uint64_t tx_cnt;
174 
175  /* --parser details-- */
176  /** current line extracted by the parser from the call to FTPGetline() */
177  uint8_t *current_line;
178  /** length of the line in current_line. Doesn't include the delimiter */
179  uint32_t current_line_len;
180  uint8_t current_line_delimiter_len;
181 
182  /* 0 for toserver, 1 for toclient */
183  FtpLineState line_state[2];
184 
187  uint32_t port_line_len;
188  uint32_t port_line_size;
189  uint8_t *port_line;
190 
191  uint16_t dyn_port;
192  /* specifies which loggers are done logging */
193  uint32_t logged;
194 
195 } FtpState;
196 
197 enum {
200 };
201 
202 /** FTP Data State for app layer parser */
203 typedef struct FtpDataState_ {
204  uint8_t *input;
205  uint8_t *file_name;
208  int32_t input_len;
209  int16_t file_len;
211  uint8_t state;
212  uint8_t direction;
213 } FtpDataState;
214 
215 void RegisterFTPParsers(void);
216 void FTPParserRegisterTests(void);
217 void FTPAtExitPrintStats(void);
218 uint64_t FTPMemuseGlobalCounter(void);
219 uint64_t FTPMemcapGlobalCounter(void);
220 
221 #ifdef HAVE_LIBJANSSON
222 json_t *JsonFTPDataAddMetadata(const Flow *f);
223 #endif
224 
225 #endif /* __APP_LAYER_FTP_H__ */
226 
void RegisterFTPParsers(void)
uint8_t * input
struct HtpBodyChunk_ * next
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
Definition: app-layer-ftp.c:67
const uint8_t command_length
Definition: app-layer-ftp.h:94
uint64_t detect_flags_ts
struct FtpCommand_ FtpCommand
int16_t file_len
uint8_t * file_name
uint8_t * request
void FTPAtExitPrintStats(void)
#define TAILQ_HEAD(name, type)
Definition: queue.h:321
const char * command_name_lower
Definition: app-layer-ftp.h:93
uint8_t direction
struct FtpLineState_ FtpLineState
int32_t input_len
const char * command_name_upper
Definition: app-layer-ftp.h:92
FtpRequestCommand command
FTPTransaction * curr_tx
uint8_t * str
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:98
uint32_t db_len
uint64_t FTPMemuseGlobalCounter(void)
#define TAILQ_ENTRY(type)
Definition: queue.h:330
uint32_t request_length
uint8_t current_line_lf_seen
uint8_t direction
uint64_t FTPMemcapGlobalCounter(void)
struct FtpDataState_ FtpDataState
FtpRequestCommand
Definition: app-layer-ftp.h:34
uint64_t detect_flags_tc
DetectEngineState * de_state
uint8_t * db
const FtpCommand * command_descriptor
uint8_t * input
uint16_t len
int32_t input_len
void FTPParserRegisterTests(void)
Flow data structure.
Definition: flow.h:325
uint16_t FtpResponseCode
FileContainer * files
FtpRequestCommand command
Definition: app-layer-ftp.h:91
uint8_t current_line_db