aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

applayer/ftp: convert to FAIL/PASS API

Browse Source
pull/5646/head
Shivani Bhardwaj 5 years ago committed by Victor Julien
parent 2e3d408e6f
commit b195ffbe18
1 changed files with 42 additions and 230 deletions
Show Stats Download Patch File Download Diff File

272
src/app-layer-ftp.c
Unescape Escape View File

@ -1433,7 +1433,6 @@ void FTPParserCleanup(void)
/** \test Send a get request in one chunk. */ /** \test Send a get request in one chunk. */
static int FTPParserTest01(void) static int FTPParserTest01(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf[] = "PORT 192,168,1,1,0,80\r\n"; uint8_t ftpbuf[] = "PORT 192,168,1,1,0,80\r\n";
uint32_t ftplen = sizeof(ftpbuf) - 1; /* minus the \0 */ uint32_t ftplen = sizeof(ftpbuf) - 1; /* minus the \0 */
@ -1443,49 +1442,28 @@ static int FTPParserTest01(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_EOF, ftpbuf, ftplen); STREAM_TOSERVER | STREAM_EOF, ftpbuf, ftplen);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: "); FAIL_IF(ftp_state->command != FTP_COMMAND_PORT);
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_PORT) {
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); PASS;
return result;
} }
/** \test Send a split get request. */ /** \test Send a split get request. */
static int FTPParserTest03(void) static int FTPParserTest03(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf1[] = "POR"; uint8_t ftpbuf1[] = "POR";
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
@ -1499,71 +1477,38 @@ static int FTPParserTest03(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_START, ftpbuf1, STREAM_TOSERVER | STREAM_START, ftpbuf1,
ftplen1); ftplen1);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER,
ftpbuf2, ftplen2); ftpbuf2, ftplen2);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_EOF, ftpbuf3, ftplen3); STREAM_TOSERVER | STREAM_EOF, ftpbuf3, ftplen3);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: ");
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_PORT) { FAIL_IF(ftp_state->command != FTP_COMMAND_PORT);
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
return result; PASS;
} }
/** \test See how it deals with an incomplete request. */ /** \test See how it deals with an incomplete request. */
static int FTPParserTest06(void) static int FTPParserTest06(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf1[] = "PORT"; uint8_t ftpbuf1[] = "PORT";
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
@ -1573,51 +1518,31 @@ static int FTPParserTest06(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_START | STREAM_EOF, STREAM_TOSERVER | STREAM_START | STREAM_EOF,
ftpbuf1, ftpbuf1,
ftplen1); ftplen1);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: ");
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_UNKNOWN) { FAIL_IF(ftp_state->command != FTP_COMMAND_UNKNOWN);
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_UNKNOWN, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); PASS;
return result;
} }
/** \test See how it deals with an incomplete request in multiple chunks. */ /** \test See how it deals with an incomplete request in multiple chunks. */
static int FTPParserTest07(void) static int FTPParserTest07(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf1[] = "PO"; uint8_t ftpbuf1[] = "PO";
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
@ -1629,63 +1554,35 @@ static int FTPParserTest07(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_START, ftpbuf1, STREAM_TOSERVER | STREAM_START, ftpbuf1,
ftplen1); ftplen1);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_EOF, ftpbuf2, ftplen2); STREAM_TOSERVER | STREAM_EOF, ftpbuf2, ftplen2);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: ");
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_PORT) { FAIL_IF(ftp_state->command != FTP_COMMAND_PORT);
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ",
FTP_COMMAND_PORT, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); PASS;
return result;
} }
/** \test Test case where chunks are smaller than the delim length and the /** \test Test case where chunks are smaller than the delim length and the
* last chunk is supposed to match the delim. */ * last chunk is supposed to match the delim. */
static int FTPParserTest10(void) static int FTPParserTest10(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf1[] = "PORT 1,2,3,4,5,6\r\n"; uint8_t ftpbuf1[] = "PORT 1,2,3,4,5,6\r\n";
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */ uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
@ -1695,7 +1592,6 @@ static int FTPParserTest10(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
@ -1710,43 +1606,24 @@ static int FTPParserTest10(void)
else if (u == (ftplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF; else if (u == (ftplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF;
else flags = STREAM_TOSERVER; else flags = STREAM_TOSERVER;
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, flags, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, flags,
&ftpbuf1[u], 1); &ftpbuf1[u], 1);
if (r != 0) { FAIL_IF(r != 0);
SCLogDebug("toserver chunk %" PRIu32 " returned %" PRId32 ", expected 0: ", u, r);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
} }
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: ");
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_PORT) { FAIL_IF(ftp_state->command != FTP_COMMAND_PORT);
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); PASS;
return result;
} }
/** \test Supply RETR without a filename */ /** \test Supply RETR without a filename */
static int FTPParserTest11(void) static int FTPParserTest11(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n"; uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
uint8_t ftpbuf2[] = "RETR\r\n"; uint8_t ftpbuf2[] = "RETR\r\n";
@ -1758,75 +1635,42 @@ static int FTPParserTest11(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_START, ftpbuf1, STREAM_TOSERVER | STREAM_START, ftpbuf1,
sizeof(ftpbuf1) - 1); sizeof(ftpbuf1) - 1);
if (r != 0) { FAIL_IF(r != 0);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
/* Response */ /* Response */
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOCLIENT, STREAM_TOCLIENT,
ftpbuf3, ftpbuf3,
sizeof(ftpbuf3) - 1); sizeof(ftpbuf3) - 1);
if (r != 0) { FAIL_IF(r != 0);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER, ftpbuf2, STREAM_TOSERVER, ftpbuf2,
sizeof(ftpbuf2) - 1); sizeof(ftpbuf2) - 1);
if (r == 0) { FAIL_IF(r == 0);
SCLogDebug("parse should've failed");
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: ");
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_RETR) { FAIL_IF(ftp_state->command != FTP_COMMAND_RETR);
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ",
FTP_COMMAND_RETR, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); PASS;
return result;
} }
/** \test Supply STOR without a filename */ /** \test Supply STOR without a filename */
static int FTPParserTest12(void) static int FTPParserTest12(void)
{ {
int result = 1;
Flow f; Flow f;
uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n"; uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
uint8_t ftpbuf2[] = "STOR\r\n"; uint8_t ftpbuf2[] = "STOR\r\n";
@ -1838,69 +1682,37 @@ static int FTPParserTest12(void)
memset(&f, 0, sizeof(f)); memset(&f, 0, sizeof(f));
memset(&ssn, 0, sizeof(ssn)); memset(&ssn, 0, sizeof(ssn));
FLOW_INITIALIZE(&f);
f.protoctx = (void *)&ssn; f.protoctx = (void *)&ssn;
f.proto = IPPROTO_TCP; f.proto = IPPROTO_TCP;
f.alproto = ALPROTO_FTP; f.alproto = ALPROTO_FTP;
StreamTcpInitConfig(TRUE); StreamTcpInitConfig(TRUE);
FLOWLOCK_WRLOCK(&f);
int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER | STREAM_START, ftpbuf1, STREAM_TOSERVER | STREAM_START, ftpbuf1,
sizeof(ftpbuf1) - 1); sizeof(ftpbuf1) - 1);
if (r != 0) { FAIL_IF(r != 0);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
/* Response */ /* Response */
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOCLIENT, STREAM_TOCLIENT,
ftpbuf3, ftpbuf3,
sizeof(ftpbuf3) - 1); sizeof(ftpbuf3) - 1);
if (r != 0) { FAIL_IF(r != 0);
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FLOWLOCK_WRLOCK(&f);
r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
STREAM_TOSERVER, ftpbuf2, STREAM_TOSERVER, ftpbuf2,
sizeof(ftpbuf2) - 1); sizeof(ftpbuf2) - 1);
if (r == 0) { FAIL_IF(r == 0);
SCLogDebug("parse should've failed");
result = 0;
FLOWLOCK_UNLOCK(&f);
goto end;
}
FLOWLOCK_UNLOCK(&f);
FtpState *ftp_state = f.alstate; FtpState *ftp_state = f.alstate;
if (ftp_state == NULL) { FAIL_IF_NULL(ftp_state);
SCLogDebug("no ftp state: ");
result = 0;
goto end;
}
if (ftp_state->command != FTP_COMMAND_STOR) { FAIL_IF(ftp_state->command != FTP_COMMAND_STOR);
SCLogDebug("expected command %" PRIu32 ", got %" PRIu32 ": ",
FTP_COMMAND_STOR, ftp_state->command);
result = 0;
goto end;
}
end: AppLayerParserThreadCtxFree(alp_tctx);
if (alp_tctx != NULL)
AppLayerParserThreadCtxFree(alp_tctx);
StreamTcpFreeConfig(TRUE); StreamTcpFreeConfig(TRUE);
FLOW_DESTROY(&f); PASS;
return result;
} }
#endif /* UNITTESTS */ #endif /* UNITTESTS */

Write Preview
Loading…
Cancel
Save