suricata
app-layer-smtp.c File Reference
#include "suricata.h"
#include "suricata-common.h"
#include "debug.h"
#include "decode.h"
#include "threads.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer.h"
#include "app-layer-detect-proto.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-smtp.h"
#include "util-mpm.h"
#include "util-debug.h"
#include "util-byte.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-memcmp.h"
#include "flow-util.h"
#include "detect-engine.h"
#include "detect-engine-state.h"
#include "detect-parse.h"
#include "decode-events.h"
#include "conf.h"
#include "util-mem.h"
#include "util-misc.h"
#include "util-validate.h"
Include dependency graph for app-layer-smtp.c:

Go to the source code of this file.

Data Structures

struct  SMTPThreadCtx_
 

Macros

#define FILEDATA_CONTENT_LIMIT   100000
 
#define FILEDATA_CONTENT_INSPECT_MIN_SIZE   32768
 
#define FILEDATA_CONTENT_INSPECT_WINDOW   4096
 
#define SMTP_RAW_EXTRACTION_DEFAULT_VALUE   0
 
#define SMTP_MAX_REQUEST_AND_REPLY_LINE_LENGTH   510
 
#define SMTP_COMMAND_BUFFER_STEPS   5
 
#define SMTP_PARSER_STATE_COMMAND_MODE   0x00
 
#define SMTP_PARSER_STATE_COMMAND_DATA_MODE   0x01
 
#define SMTP_PARSER_STATE_PARSING_SERVER_RESPONSE   0x02
 
#define SMTP_PARSER_STATE_FIRST_REPLY_SEEN   0x04
 
#define SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY   0x08
 
#define SMTP_PARSER_STATE_PIPELINING_SERVER   0x10
 
#define SMTP_COMMAND_STARTTLS   1
 
#define SMTP_COMMAND_DATA   2
 
#define SMTP_COMMAND_BDAT   3
 
#define SMTP_COMMAND_DATA_MODE   4
 
#define SMTP_COMMAND_OTHER_CMD   5
 
#define SMTP_COMMAND_RSET   6
 
#define SMTP_EHLO_EXTENSION_PIPELINING
 
#define SMTP_EHLO_EXTENSION_SIZE
 
#define SMTP_EHLO_EXTENSION_DSN
 
#define SMTP_EHLO_EXTENSION_STARTTLS
 
#define SMTP_EHLO_EXTENSION_8BITMIME
 
#define SMTP_MPM   mpm_default_matcher
 

Typedefs

typedef struct SMTPThreadCtx_ SMTPThreadCtx
 

Enumerations

enum  SMTPCode {
  SMTP_REPLY_211, SMTP_REPLY_214, SMTP_REPLY_220, SMTP_REPLY_221,
  SMTP_REPLY_235, SMTP_REPLY_250, SMTP_REPLY_251, SMTP_REPLY_252,
  SMTP_REPLY_334, SMTP_REPLY_354, SMTP_REPLY_421, SMTP_REPLY_450,
  SMTP_REPLY_451, SMTP_REPLY_452, SMTP_REPLY_455, SMTP_REPLY_500,
  SMTP_REPLY_501, SMTP_REPLY_502, SMTP_REPLY_503, SMTP_REPLY_504,
  SMTP_REPLY_550, SMTP_REPLY_551, SMTP_REPLY_552, SMTP_REPLY_553,
  SMTP_REPLY_554, SMTP_REPLY_555
}
 

Functions

int SMTPProcessDataChunk (const uint8_t *chunk, uint32_t len, MimeDecParseState *state)
 
void * SMTPStateAlloc (void *orig_state, AppProto proto_orig)
 
void RegisterSMTPParsers (void)
 Register the SMTP Protocol parser. More...
 
void SMTPParserCleanup (void)
 Free memory allocated for global SMTP parser state. More...
 
void SMTPParserRegisterTests (void)
 

Variables

SCEnumCharMap smtp_decoder_event_table []
 
SCEnumCharMap smtp_reply_map []
 
SMTPConfig smtp_config = { 0, { 0, 0, 0, 0, 0 }, 0, 0, 0, 0, STREAMING_BUFFER_CONFIG_INITIALIZER}
 

Detailed Description

Macro Definition Documentation

◆ FILEDATA_CONTENT_INSPECT_MIN_SIZE

#define FILEDATA_CONTENT_INSPECT_MIN_SIZE   32768

Definition at line 64 of file app-layer-smtp.c.

◆ FILEDATA_CONTENT_INSPECT_WINDOW

#define FILEDATA_CONTENT_INSPECT_WINDOW   4096

Definition at line 66 of file app-layer-smtp.c.

◆ FILEDATA_CONTENT_LIMIT

#define FILEDATA_CONTENT_LIMIT   100000

Definition at line 62 of file app-layer-smtp.c.

◆ SMTP_COMMAND_BDAT

#define SMTP_COMMAND_BDAT   3

Definition at line 97 of file app-layer-smtp.c.

◆ SMTP_COMMAND_BUFFER_STEPS

#define SMTP_COMMAND_BUFFER_STEPS   5

Definition at line 72 of file app-layer-smtp.c.

◆ SMTP_COMMAND_DATA

#define SMTP_COMMAND_DATA   2

Definition at line 96 of file app-layer-smtp.c.

◆ SMTP_COMMAND_DATA_MODE

#define SMTP_COMMAND_DATA_MODE   4

Definition at line 102 of file app-layer-smtp.c.

◆ SMTP_COMMAND_OTHER_CMD

#define SMTP_COMMAND_OTHER_CMD   5

Definition at line 104 of file app-layer-smtp.c.

◆ SMTP_COMMAND_RSET

#define SMTP_COMMAND_RSET   6

Definition at line 105 of file app-layer-smtp.c.

◆ SMTP_COMMAND_STARTTLS

#define SMTP_COMMAND_STARTTLS   1

Definition at line 95 of file app-layer-smtp.c.

◆ SMTP_EHLO_EXTENSION_8BITMIME

#define SMTP_EHLO_EXTENSION_8BITMIME

Definition at line 112 of file app-layer-smtp.c.

◆ SMTP_EHLO_EXTENSION_DSN

#define SMTP_EHLO_EXTENSION_DSN

Definition at line 110 of file app-layer-smtp.c.

◆ SMTP_EHLO_EXTENSION_PIPELINING

#define SMTP_EHLO_EXTENSION_PIPELINING

Definition at line 108 of file app-layer-smtp.c.

◆ SMTP_EHLO_EXTENSION_SIZE

#define SMTP_EHLO_EXTENSION_SIZE

Definition at line 109 of file app-layer-smtp.c.

◆ SMTP_EHLO_EXTENSION_STARTTLS

#define SMTP_EHLO_EXTENSION_STARTTLS

Definition at line 111 of file app-layer-smtp.c.

◆ SMTP_MAX_REQUEST_AND_REPLY_LINE_LENGTH

#define SMTP_MAX_REQUEST_AND_REPLY_LINE_LENGTH   510

Definition at line 70 of file app-layer-smtp.c.

◆ SMTP_MPM

#define SMTP_MPM   mpm_default_matcher

Definition at line 169 of file app-layer-smtp.c.

◆ SMTP_PARSER_STATE_COMMAND_DATA_MODE

#define SMTP_PARSER_STATE_COMMAND_DATA_MODE   0x01

Definition at line 79 of file app-layer-smtp.c.

◆ SMTP_PARSER_STATE_COMMAND_MODE

#define SMTP_PARSER_STATE_COMMAND_MODE   0x00

Definition at line 76 of file app-layer-smtp.c.

◆ SMTP_PARSER_STATE_FIRST_REPLY_SEEN

#define SMTP_PARSER_STATE_FIRST_REPLY_SEEN   0x04

Definition at line 85 of file app-layer-smtp.c.

◆ SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY

#define SMTP_PARSER_STATE_PARSING_MULTILINE_REPLY   0x08

Definition at line 87 of file app-layer-smtp.c.

◆ SMTP_PARSER_STATE_PARSING_SERVER_RESPONSE

#define SMTP_PARSER_STATE_PARSING_SERVER_RESPONSE   0x02

Definition at line 83 of file app-layer-smtp.c.

◆ SMTP_PARSER_STATE_PIPELINING_SERVER

#define SMTP_PARSER_STATE_PIPELINING_SERVER   0x10

Definition at line 89 of file app-layer-smtp.c.

◆ SMTP_RAW_EXTRACTION_DEFAULT_VALUE

#define SMTP_RAW_EXTRACTION_DEFAULT_VALUE   0

Definition at line 69 of file app-layer-smtp.c.

Typedef Documentation

◆ SMTPThreadCtx

typedef struct SMTPThreadCtx_ SMTPThreadCtx

Enumeration Type Documentation

◆ SMTPCode

enum SMTPCode
Enumerator
SMTP_REPLY_211 
SMTP_REPLY_214 
SMTP_REPLY_220 
SMTP_REPLY_221 
SMTP_REPLY_235 
SMTP_REPLY_250 
SMTP_REPLY_251 
SMTP_REPLY_252 
SMTP_REPLY_334 
SMTP_REPLY_354 
SMTP_REPLY_421 
SMTP_REPLY_450 
SMTP_REPLY_451 
SMTP_REPLY_452 
SMTP_REPLY_455 
SMTP_REPLY_500 
SMTP_REPLY_501 
SMTP_REPLY_502 
SMTP_REPLY_503 
SMTP_REPLY_504 
SMTP_REPLY_550 
SMTP_REPLY_551 
SMTP_REPLY_552 
SMTP_REPLY_553 
SMTP_REPLY_554 
SMTP_REPLY_555 

Definition at line 174 of file app-layer-smtp.c.

Function Documentation

◆ RegisterSMTPParsers()

void RegisterSMTPParsers ( void  )

Register the SMTP Protocol parser.

Definition at line 1782 of file app-layer-smtp.c.

References ALPROTO_SMTP, AppLayerProtoDetectConfProtoDetectionEnabled(), and AppLayerProtoDetectRegisterProtocol().

Referenced by AppLayerParserRegisterProtocolParsers().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ SMTPParserCleanup()

void SMTPParserCleanup ( void  )

Free memory allocated for global SMTP parser state.

Definition at line 1840 of file app-layer-smtp.c.

Referenced by AppLayerParserDeSetup().

Here is the caller graph for this function:

◆ SMTPParserRegisterTests()

void SMTPParserRegisterTests ( void  )

Definition at line 5308 of file app-layer-smtp.c.

References UtRegisterTest().

Here is the call graph for this function:

◆ SMTPProcessDataChunk()

◆ SMTPStateAlloc()

void* SMTPStateAlloc ( void *  orig_state,
AppProto  proto_orig 
)

Variable Documentation

◆ smtp_config

SMTPConfig smtp_config = { 0, { 0, 0, 0, 0, 0 }, 0, 0, 0, 0, STREAMING_BUFFER_CONFIG_INITIALIZER}

Definition at line 240 of file app-layer-smtp.c.

Referenced by SMTPProcessDataChunk().

◆ smtp_decoder_event_table

SCEnumCharMap smtp_decoder_event_table[]

Definition at line 113 of file app-layer-smtp.c.

◆ smtp_reply_map

SCEnumCharMap smtp_reply_map[]

Definition at line 206 of file app-layer-smtp.c.