suricata
util-file.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2011 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  */
24 
25 #ifndef __UTIL_FILE_H__
26 #define __UTIL_FILE_H__
27 
28 #ifdef HAVE_NSS
29 #include <sechash.h>
30 #endif
31 
32 #include "conf.h"
33 
34 #include "util-streaming-buffer.h"
35 
36 #define FILE_TRUNCATED BIT_U16(0)
37 #define FILE_NOMAGIC BIT_U16(1)
38 #define FILE_NOMD5 BIT_U16(2)
39 #define FILE_MD5 BIT_U16(3)
40 #define FILE_NOSHA1 BIT_U16(4)
41 #define FILE_SHA1 BIT_U16(5)
42 #define FILE_NOSHA256 BIT_U16(6)
43 #define FILE_SHA256 BIT_U16(7)
44 #define FILE_LOGGED BIT_U16(8)
45 #define FILE_NOSTORE BIT_U16(9)
46 #define FILE_STORE BIT_U16(10)
47 #define FILE_STORED BIT_U16(11)
48 #define FILE_NOTRACK BIT_U16(12) /**< track size of file */
49 #define FILE_USE_DETECT BIT_U16(13) /**< use content_inspected tracker */
50 #define FILE_USE_TRACKID BIT_U16(14) /**< File::file_track_id field is in use */
51 #define FILE_HAS_GAPS BIT_U16(15)
52 
53 typedef enum FileState_ {
54  FILE_STATE_NONE = 0, /**< no state */
55  FILE_STATE_OPENED, /**< flow file is opened */
56  FILE_STATE_CLOSED, /**< flow file is completed,
57  there will be no more data. */
58  FILE_STATE_TRUNCATED, /**< flow file is not complete, but
59  there will be no more data. */
60  FILE_STATE_ERROR, /**< file is in an error state */
62 } FileState;
63 
64 typedef struct File_ {
65  uint16_t flags;
66  uint16_t name_len;
69  uint64_t txid; /**< tx this file is part of */
70  uint32_t file_track_id; /**< id used by protocol parser. Optional
71  * only used if FILE_USE_TRACKID flag set */
72  uint32_t file_store_id; /**< id used in store file name file.<id> */
73  int fd; /**< file descriptor for filestore, not
74  open if equal to -1 */
75  uint8_t *name;
76 #ifdef HAVE_MAGIC
77  char *magic;
78 #endif
79  struct File_ *next;
80 #ifdef HAVE_NSS
81  HASHContext *md5_ctx;
82  uint8_t md5[MD5_LENGTH];
83  HASHContext *sha1_ctx;
84  uint8_t sha1[SHA1_LENGTH];
85  HASHContext *sha256_ctx;
86  uint8_t sha256[SHA256_LENGTH];
87 #endif
88  uint64_t content_inspected; /**< used in pruning if FILE_USE_DETECT
89  * flag is set */
90  uint64_t content_stored;
91  uint64_t size;
92 } File;
93 
94 typedef struct FileContainer_ {
98 
101 
103 
105 
106 /**
107  * \brief Open a new File
108  *
109  * \param ffc flow container
110  * \param sbcfg buffer config
111  * \param name filename character array
112  * \param name_len filename len
113  * \param data initial data
114  * \param data_len initial data len
115  * \param flags open flags
116  *
117  * \retval ff flowfile object
118  *
119  * \note filename is not a string, so it's not nul terminated.
120  *
121  * If flags contains the FILE_USE_DETECT bit, the pruning code will
122  * consider not just the content_stored tracker, but also content_inspected.
123  * It's the responsibility of the API user to make sure this tracker is
124  * properly updated.
125  */
127  const uint8_t *name, uint16_t name_len,
128  const uint8_t *data, uint32_t data_len, uint16_t flags);
130  uint32_t track_id, const uint8_t *name, uint16_t name_len,
131  const uint8_t *data, uint32_t data_len, uint16_t flags);
132 
133 /**
134  * \brief Close a File
135  *
136  * \param ffc the container
137  * \param data final data if any
138  * \param data_len data len if any
139  * \param flags flags
140  *
141  * \retval 0 ok
142  * \retval -1 error
143  */
144 int FileCloseFile(FileContainer *, const uint8_t *data, uint32_t data_len,
145  uint16_t flags);
146 int FileCloseFileById(FileContainer *, uint32_t track_id,
147  const uint8_t *data, uint32_t data_len, uint16_t flags);
148 int FileCloseFilePtr(File *ff, const uint8_t *data,
149  uint32_t data_len, uint16_t flags);
150 
151 /**
152  * \brief Store a chunk of file data in the flow. The open "flowfile"
153  * will be used.
154  *
155  * \param ffc the container
156  * \param data data chunk
157  * \param data_len data chunk len
158  *
159  * \retval 0 ok
160  * \retval -1 error
161  */
162 int FileAppendData(FileContainer *, const uint8_t *data, uint32_t data_len);
163 int FileAppendDataById(FileContainer *, uint32_t track_id,
164  const uint8_t *data, uint32_t data_len);
165 int FileAppendGAPById(FileContainer *ffc, uint32_t track_id,
166  const uint8_t *data, uint32_t data_len);
167 
168 /**
169  * \brief Tag a file for storing
170  *
171  * \param ff The file to store
172  */
173 int FileStore(File *);
174 
175 /**
176  * \brief Set the TX id for a file
177  *
178  * \param ff The file to store
179  * \param txid the tx id
180  */
181 int FileSetTx(File *, uint64_t txid);
182 void FileContainerSetTx(FileContainer *ffc, uint64_t tx_id);
183 
184 /**
185  * \brief disable file storage for a flow
186  *
187  * \param f *LOCKED* flow
188  */
189 void FileDisableStoring(struct Flow_ *, uint8_t);
190 
191 void FileDisableFilesize(Flow *f, uint8_t direction);
192 
193 /**
194  * \brief disable file storing for a transaction
195  *
196  * \param f flow
197  * \param tx_id transaction id
198  */
199 void FileDisableStoringForTransaction(Flow *f, uint8_t direction, uint64_t tx_id);
200 
201 void FlowFileDisableStoringForTransaction(struct Flow_ *f, uint64_t tx_id);
202 void FilePrune(FileContainer *ffc);
203 
204 void FileForceFilestoreEnable(void);
205 int FileForceFilestore(void);
206 void FileReassemblyDepthEnable(uint32_t size);
207 uint32_t FileReassemblyDepth(void);
208 
209 void FileDisableMagic(Flow *f, uint8_t);
210 void FileForceMagicEnable(void);
211 int FileForceMagic(void);
212 
213 void FileDisableMd5(Flow *f, uint8_t);
214 void FileForceMd5Enable(void);
215 int FileForceMd5(void);
216 
217 void FileDisableSha1(Flow *f, uint8_t);
218 void FileForceSha1Enable(void);
219 int FileForceSha1(void);
220 
221 void FileDisableSha256(Flow *f, uint8_t);
222 void FileForceSha256Enable(void);
223 int FileForceSha256(void);
224 
226 
227 void FileForceTrackingEnable(void);
228 
230 void FileStoreAllFilesForTx(FileContainer *, uint64_t);
231 void FileStoreFileById(FileContainer *fc, uint32_t);
232 
234 
235 uint64_t FileDataSize(const File *file);
236 uint64_t FileTrackedSize(const File *file);
237 
238 uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction);
239 
240 #endif /* __UTIL_FILE_H__ */
int FileOpenFileWithId(FileContainer *, const StreamingBufferConfig *, uint32_t track_id, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Definition: util-file.c:837
int FileForceMagic(void)
Definition: util-file.c:130
void FileContainerAdd(FileContainer *, File *)
Definition: util-file.c:487
void FileForceSha256Enable(void)
Definition: util-file.c:106
File * FileOpenFile(FileContainer *, const StreamingBufferConfig *, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Open a new File.
Definition: util-file.c:747
void FileForceTrackingEnable(void)
Definition: util-file.c:150
void FileStoreAllFiles(FileContainer *)
Definition: util-file.c:1272
uint64_t size
Definition: util-file.h:91
void FilePrune(FileContainer *ffc)
Definition: util-file.c:345
uint16_t FileFlowToFlags(const Flow *flow, uint8_t direction)
Definition: util-file.c:217
int FileForceSha1(void)
Definition: util-file.c:140
int FileForceFilestore(void)
Definition: util-file.c:111
int FileAppendGAPById(FileContainer *ffc, uint32_t track_id, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The file with &#39;track_id&#39; in the FileContainer...
Definition: util-file.c:709
void FileDisableSha256(Flow *f, uint8_t)
disable file sha256 calc for this flow
Definition: util-file.c:1114
void FileTruncateAllOpenFiles(FileContainer *)
Definition: util-file.c:1285
uint64_t content_inspected
Definition: util-file.h:88
int fd
Definition: util-file.h:73
FileState_
Definition: util-file.h:53
struct File_ * next
Definition: util-file.h:79
void FileContainerFree(FileContainer *)
Free a FileContainer.
Definition: util-file.c:416
void FileForceFilestoreEnable(void)
Definition: util-file.c:86
struct File_ File
struct FileContainer_ FileContainer
StreamingBuffer * sb
Definition: util-file.h:68
FileContainer * FileContainerAlloc(void)
allocate a FileContainer
Definition: util-file.c:380
uint16_t flags
Definition: util-file.h:65
void FileContainerRecycle(FileContainer *)
Recycle a FileContainer.
Definition: util-file.c:397
void FileForceMd5Enable(void)
Definition: util-file.c:96
File * tail
Definition: util-file.h:96
uint64_t txid
Definition: util-file.h:69
void FileStoreAllFilesForTx(FileContainer *, uint64_t)
Definition: util-file.c:1257
void FileForceHashParseCfg(ConfNode *)
Function to parse forced file hashing configuration.
Definition: util-file.c:158
uint16_t name_len
Definition: util-file.h:66
int FileStore(File *)
Tag a file for storing.
Definition: util-file.c:502
File * head
Definition: util-file.h:95
void FileDisableStoring(struct Flow_ *, uint8_t)
disable file storage for a flow
Definition: util-file.c:973
int FileCloseFilePtr(File *ff, const uint8_t *data, uint32_t data_len, uint16_t flags)
Definition: util-file.c:850
int FileCloseFileById(FileContainer *, uint32_t track_id, const uint8_t *data, uint32_t data_len, uint16_t flags)
Definition: util-file.c:948
void FileDisableFilesize(Flow *f, uint8_t direction)
disable file size tracking for this flow
Definition: util-file.c:1153
uint64_t FileTrackedSize(const File *file)
get the size of the file
Definition: util-file.c:294
Definition: conf.h:32
int FileAppendDataById(FileContainer *, uint32_t track_id, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The file with &#39;track_id&#39; in the FileContainer...
Definition: util-file.c:678
void FlowFileDisableStoringForTransaction(struct Flow_ *f, uint64_t tx_id)
void FileDisableSha1(Flow *f, uint8_t)
disable file sha1 calc for this flow
Definition: util-file.c:1075
int FileForceSha256(void)
Definition: util-file.c:145
void FileForceMagicEnable(void)
Definition: util-file.c:91
void FileDisableMd5(Flow *f, uint8_t)
disable file md5 calc for this flow
Definition: util-file.c:1036
uint16_t tx_id
void FileForceSha1Enable(void)
Definition: util-file.c:101
uint32_t FileReassemblyDepth(void)
Definition: util-file.c:122
uint64_t FileDataSize(const File *file)
get the size of the file data
Definition: util-file.c:277
FileState state
Definition: util-file.h:67
uint32_t file_store_id
Definition: util-file.h:72
uint64_t content_stored
Definition: util-file.h:90
uint32_t file_track_id
Definition: util-file.h:70
void FileDisableStoringForTransaction(Flow *f, uint8_t direction, uint64_t tx_id)
disable file storing for a transaction
Definition: util-file.c:1211
void FileStoreFileById(FileContainer *fc, uint32_t)
flag a file with id "file_id" to be stored.
Definition: util-file.c:1242
void FileContainerSetTx(FileContainer *ffc, uint64_t tx_id)
Definition: util-file.c:522
void FileDisableMagic(Flow *f, uint8_t)
disable file magic lookups for this flow
Definition: util-file.c:1005
int FileAppendData(FileContainer *, const uint8_t *data, uint32_t data_len)
Store a chunk of file data in the flow. The open "flowfile" will be used.
Definition: util-file.c:654
void FileReassemblyDepthEnable(uint32_t size)
Definition: util-file.c:116
int FileForceMd5(void)
Definition: util-file.c:135
int FileCloseFile(FileContainer *, const uint8_t *data, uint32_t data_len, uint16_t flags)
Close a File.
Definition: util-file.c:932
enum FileState_ FileState
#define SHA1_LENGTH
Definition: util-crypt.h:45
Flow data structure.
Definition: flow.h:327
uint8_t * name
Definition: util-file.h:75
int FileSetTx(File *, uint64_t txid)
Set the TX id for a file.
Definition: util-file.c:514