mirror of https://github.com/OISF/suricata
Adding FTP app layer parser and ftpbounce detection at L7
Pablo Rincon
17 years ago
committed by
Victor Julien
parent
d35dd1c4ea
commit
f2f9b83280
@ -0,0 +1,512 @@
|
||||
/**
|
||||
* Copyright (c) 2009 Open Information Security Foundation
|
||||
*
|
||||
* \file
|
||||
* \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
|
||||
*
|
||||
* App Layer Parser for FTP
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
#include "threads.h"
|
||||
|
||||
#include "util-print.h"
|
||||
#include "util-pool.h"
|
||||
|
||||
#include "stream-tcp-private.h"
|
||||
#include "stream-tcp-reassemble.h"
|
||||
#include "stream.h"
|
||||
|
||||
#include "app-layer-protos.h"
|
||||
#include "app-layer-parser.h"
|
||||
#include "app-layer-ftp.h"
|
||||
|
||||
#include "util-binsearch.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-debug.h"
|
||||
|
||||
/**
|
||||
* \brief This function is called to determine and set which command is being
|
||||
* transfered to the ftp server
|
||||
* \param ftp_state the ftp state structure for the parser
|
||||
* \param input input line of the command
|
||||
* \param len of the command
|
||||
*
|
||||
* \retval 1 when the command is parsed, 0 otherwise
|
||||
*/
|
||||
static int FTPParseRequestCommand(void *ftp_state, uint8_t *input,
|
||||
uint32_t input_len) {
|
||||
SCEnter();
|
||||
FtpState *fstate = (FtpState *)ftp_state;
|
||||
|
||||
char inputlower[5];
|
||||
|
||||
if (input_len >= 4) {
|
||||
memcpy(inputlower,input,5);
|
||||
int i = 0;
|
||||
for (; i < 4; i++)
|
||||
inputlower[i] = tolower(inputlower[i]);
|
||||
|
||||
if (memcmp(inputlower, "port", 4) == 0) {
|
||||
fstate->command = FTP_COMMAND_PORT;
|
||||
}
|
||||
/* else {
|
||||
* Add the ftp commands you need here
|
||||
* }
|
||||
*/
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief This function is called to retrieve the request line and parse it
|
||||
* \param ftp_state the ftp state structure for the parser
|
||||
* \param input input line of the command
|
||||
* \param input_len length of the request
|
||||
* \param output the resulting output
|
||||
*
|
||||
* \retval 1 when the command is parsed, 0 otherwise
|
||||
*/
|
||||
static int FTPParseRequestCommandLine(Flow *f, void *ftp_state, AppLayerParserState
|
||||
*pstate, uint8_t *input,uint32_t input_len,
|
||||
AppLayerParserResult *output) {
|
||||
SCEnter();
|
||||
//PrintRawDataFp(stdout, input,input_len);
|
||||
|
||||
FtpState *fstate = (FtpState *)ftp_state;
|
||||
uint16_t max_fields = 2;
|
||||
uint16_t u = 0;
|
||||
uint32_t offset = 0;
|
||||
|
||||
if (pstate == NULL)
|
||||
return -1;
|
||||
|
||||
for (u = pstate->parse_field; u < max_fields; u++) {
|
||||
//printf("FTPParseRequestCommandLine: u %" PRIu32 "\n", u);
|
||||
|
||||
switch(u) {
|
||||
case 0: /* REQUEST COMMAND */
|
||||
{
|
||||
const uint8_t delim[] = { 0x20, };
|
||||
int r = AlpParseFieldByDelimiter(output, pstate,
|
||||
FTP_FIELD_REQUEST_COMMAND, delim, sizeof(delim),
|
||||
input, input_len, &offset);
|
||||
//printf("FTPParseRequestCommandLine: r = %" PRId32 "\n", r);
|
||||
|
||||
if (r == 0) {
|
||||
pstate->parse_field = 0;
|
||||
return 0;
|
||||
}
|
||||
//printf("Command: [%s]..ofs: %u.. ", input, offset );
|
||||
fstate->arg_offset = offset;
|
||||
FTPParseRequestCommand(ftp_state, input, input_len);
|
||||
break;
|
||||
}
|
||||
case 1: /* REQUEST COMMAND ARG */
|
||||
{
|
||||
switch (fstate->command) {
|
||||
case FTP_COMMAND_PORT:
|
||||
/* We don't need to parse args, we are going to check
|
||||
* the ftpbounce condition directly from detect-ftpbounce
|
||||
*/
|
||||
if (fstate->port_line != NULL)
|
||||
free(fstate->port_line);
|
||||
fstate->port_line = malloc(input_len);
|
||||
if (fstate->port_line == NULL) {
|
||||
SCLogError(SC_ERR_MEM_ALLOC, "Error allocating"
|
||||
"memory");
|
||||
exit(EXIT_FAILURE);
|
||||
}
|
||||
fstate->port_line = memcpy(fstate->port_line, input,
|
||||
input_len);
|
||||
fstate->port_line_len = input_len;
|
||||
//printf("\n\nport line and args are set\n\n");
|
||||
break;
|
||||
default:
|
||||
break;
|
||||
} /* end switch command specified args */
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pstate->parse_field = 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief This function is called to retrieve a ftp request
|
||||
* \param ftp_state the ftp state structure for the parser
|
||||
* \param input input line of the command
|
||||
* \param input_len length of the request
|
||||
* \param output the resulting output
|
||||
*
|
||||
* \retval 1 when the command is parsed, 0 otherwise
|
||||
*/
|
||||
static int FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserState *pstate, uint8_t
|
||||
*input, uint32_t input_len, AppLayerParserResult
|
||||
*output) {
|
||||
SCEnter();
|
||||
//printf("FTPParseRequest: ftp_state %p, state %p, input %p, input_len %" PRIu32 "\n", ftp_state, pstate, input, input_len);
|
||||
/* PrintRawDataFp(stdout, input,input_len); */
|
||||
|
||||
uint32_t offset = 0;
|
||||
|
||||
if (pstate == NULL)
|
||||
return -1;
|
||||
|
||||
//printf("FTPParseRequest: pstate->parse_field %" PRIu32 "\n", pstate->parse_field);
|
||||
|
||||
//PrintRawDataFp(stdout, pstate->store, pstate->store_len);
|
||||
|
||||
const uint8_t delim[] = { 0x0D, 0x0A };
|
||||
int r = AlpParseFieldByDelimiter(output, pstate, FTP_FIELD_REQUEST_LINE,
|
||||
delim, sizeof(delim), input, input_len,
|
||||
&offset);
|
||||
if (r == 0) {
|
||||
pstate->parse_field = 0;
|
||||
return 0;
|
||||
}
|
||||
if (pstate->store_len)
|
||||
PrintRawDataFp(stdout, pstate->store, pstate->store_len);
|
||||
|
||||
pstate->parse_field = 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief This function is called to retrieve a ftp response
|
||||
* \param ftp_state the ftp state structure for the parser
|
||||
* \param input input line of the command
|
||||
* \param input_len length of the request
|
||||
* \param output the resulting output
|
||||
*
|
||||
* \retval 1 when the command is parsed, 0 otherwise
|
||||
*/
|
||||
static int FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstate,
|
||||
uint8_t *input, uint32_t input_len,
|
||||
AppLayerParserResult *output) {
|
||||
SCEnter();
|
||||
//printf("FTPParseResponse: ftp_state %p, state %p, input %p, input_len %" PRIu32 "\n", ftp_state, pstate, input, input_len);
|
||||
//PrintRawDataFp(stdout, input,input_len);
|
||||
|
||||
uint32_t offset = 0;
|
||||
FtpState *fstate = (FtpState *)ftp_state;
|
||||
|
||||
if (pstate == NULL)
|
||||
return -1;
|
||||
|
||||
//printf("FTPParseRequest: pstate->parse_field %" PRIu32 "\n", pstate->parse_field);
|
||||
|
||||
const uint8_t delim[] = { 0x0D, 0x0A };
|
||||
int r = AlpParseFieldByDelimiter(output, pstate, FTP_FIELD_RESPONSE_LINE,
|
||||
delim, sizeof(delim), input, input_len,
|
||||
&offset);
|
||||
if (r == 0) {
|
||||
pstate->parse_field = 0;
|
||||
return 0;
|
||||
}
|
||||
char rcode[5];
|
||||
memcpy(rcode, input, 4);
|
||||
rcode[4] = '\0';
|
||||
fstate->response_code = atoi(rcode);
|
||||
SCLogDebug("Response: %u\n", fstate->response_code);
|
||||
|
||||
pstate->parse_field = 0;
|
||||
return 1;
|
||||
}
|
||||
|
||||
#ifdef DEBUG
|
||||
static SCMutex ftp_state_mem_lock = PTHREAD_MUTEX_INITIALIZER;
|
||||
static uint64_t ftp_state_memuse = 0;
|
||||
static uint64_t ftp_state_memcnt = 0;
|
||||
#endif
|
||||
|
||||
static void *FTPStateAlloc(void) {
|
||||
void *s = malloc(sizeof(FtpState));
|
||||
if (s == NULL)
|
||||
return NULL;
|
||||
|
||||
memset(s, 0, sizeof(FtpState));
|
||||
|
||||
#ifdef DEBUG
|
||||
SCMutexLock(&ftp_state_mem_lock);
|
||||
ftp_state_memcnt++;
|
||||
ftp_state_memuse+=sizeof(FtpState);
|
||||
SCMutexUnlock(&ftp_state_mem_lock);
|
||||
#endif
|
||||
return s;
|
||||
}
|
||||
|
||||
static void FTPStateFree(void *s) {
|
||||
free(s);
|
||||
#ifdef DEBUG
|
||||
SCMutexLock(&ftp_state_mem_lock);
|
||||
ftp_state_memcnt--;
|
||||
ftp_state_memuse-=sizeof(FtpState);
|
||||
SCMutexUnlock(&ftp_state_mem_lock);
|
||||
#endif
|
||||
}
|
||||
|
||||
|
||||
void RegisterFTPParsers(void) {
|
||||
AppLayerRegisterProto("ftp.request", ALPROTO_FTP, STREAM_TOSERVER,
|
||||
FTPParseRequest);
|
||||
AppLayerRegisterProto("ftp.response", ALPROTO_FTP, STREAM_TOCLIENT,
|
||||
FTPParseResponse);
|
||||
AppLayerRegisterParser("ftp.request_command_line", ALPROTO_FTP,
|
||||
FTP_FIELD_REQUEST_LINE, FTPParseRequestCommandLine,
|
||||
"ftp");
|
||||
AppLayerRegisterStateFuncs(ALPROTO_FTP, FTPStateAlloc, FTPStateFree);
|
||||
}
|
||||
|
||||
void FTPAtExitPrintStats(void) {
|
||||
#ifdef DEBUG
|
||||
SCMutexLock(&ftp_state_mem_lock);
|
||||
SCLogDebug("ftp_state_memcnt %"PRIu64", ftp_state_memuse %"PRIu64"",
|
||||
ftp_state_memcnt, ftp_state_memuse);
|
||||
SCMutexUnlock(&ftp_state_mem_lock);
|
||||
#endif
|
||||
}
|
||||
|
||||
/* UNITTESTS */
|
||||
#ifdef UNITTESTS
|
||||
|
||||
/** \test Send a get request in one chunk. */
|
||||
int FTPParserTest01(void) {
|
||||
int result = 1;
|
||||
Flow f;
|
||||
uint8_t ftpbuf[] = "PORT 192,168,1,1,0,80\r\n";
|
||||
uint32_t ftplen = sizeof(ftpbuf) - 1; /* minus the \0 */
|
||||
TcpSession ssn;
|
||||
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
f.protoctx = (void *)&ssn;
|
||||
|
||||
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_EOF, ftpbuf, ftplen, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
printf("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_PORT) {
|
||||
printf("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
end:
|
||||
return result;
|
||||
}
|
||||
|
||||
/** \test Send a splitted get request. */
|
||||
int FTPParserTest03(void) {
|
||||
int result = 1;
|
||||
Flow f;
|
||||
uint8_t ftpbuf1[] = "POR";
|
||||
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
|
||||
uint8_t ftpbuf2[] = "T 192,168,1";
|
||||
uint32_t ftplen2 = sizeof(ftpbuf2) - 1; /* minus the \0 */
|
||||
uint8_t ftpbuf3[] = "1,1,10,20\r\n";
|
||||
uint32_t ftplen3 = sizeof(ftpbuf3) - 1; /* minus the \0 */
|
||||
TcpSession ssn;
|
||||
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
f.protoctx = (void *)&ssn;
|
||||
|
||||
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_START, ftpbuf1, ftplen1, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, ftplen2, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_EOF, ftpbuf3, ftplen3, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
printf("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_PORT) {
|
||||
printf("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
end:
|
||||
return result;
|
||||
}
|
||||
|
||||
/** \test See how it deals with an incomplete request. */
|
||||
int FTPParserTest06(void) {
|
||||
int result = 1;
|
||||
Flow f;
|
||||
uint8_t ftpbuf1[] = "PORT";
|
||||
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
|
||||
TcpSession ssn;
|
||||
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
|
||||
f.protoctx = (void *)&ssn;
|
||||
|
||||
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_START|STREAM_EOF, ftpbuf1, ftplen1, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
printf("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_UNKNOWN) {
|
||||
printf("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_UNKNOWN, ftp_state->command);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
end:
|
||||
return result;
|
||||
}
|
||||
|
||||
/** \test See how it deals with an incomplete request in multiple chunks. */
|
||||
int FTPParserTest07(void) {
|
||||
int result = 1;
|
||||
Flow f;
|
||||
uint8_t ftpbuf1[] = "PO";
|
||||
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
|
||||
uint8_t ftpbuf2[] = "RT\r\n";
|
||||
uint32_t ftplen2 = sizeof(ftpbuf2) - 1; /* minus the \0 */
|
||||
TcpSession ssn;
|
||||
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
|
||||
f.protoctx = (void *)&ssn;
|
||||
|
||||
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_START, ftpbuf1, ftplen1, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER|STREAM_EOF, ftpbuf2, ftplen2, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
printf("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_UNKNOWN) {
|
||||
printf("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_UNKNOWN, ftp_state->command);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
end:
|
||||
return result;
|
||||
}
|
||||
|
||||
/** \test Test case where chunks are smaller than the delim length and the
|
||||
* last chunk is supposed to match the delim. */
|
||||
int FTPParserTest10(void) {
|
||||
int result = 1;
|
||||
Flow f;
|
||||
uint8_t ftpbuf1[] = "PORT 1,2,3,4,5,6\r\n";
|
||||
uint32_t ftplen1 = sizeof(ftpbuf1) - 1; /* minus the \0 */
|
||||
TcpSession ssn;
|
||||
int r = 0;
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
f.protoctx = (void *)&ssn;
|
||||
|
||||
uint32_t u;
|
||||
for (u = 0; u < ftplen1; u++) {
|
||||
uint8_t flags = 0;
|
||||
|
||||
if (u == 0) flags = STREAM_TOSERVER|STREAM_START;
|
||||
else if (u == (ftplen1 - 1)) flags = STREAM_TOSERVER|STREAM_EOF;
|
||||
else flags = STREAM_TOSERVER;
|
||||
|
||||
r = AppLayerParse(&f, ALPROTO_FTP, flags, &ftpbuf1[u], 1, FALSE);
|
||||
if (r != 0) {
|
||||
printf("toserver chunk %" PRIu32 " returned %" PRId32 ", expected 0: ", u, r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
printf("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_PORT) {
|
||||
printf("expected command %" PRIu32 ", got %" PRIu32 ": ", FTP_COMMAND_PORT, ftp_state->command);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
end:
|
||||
return result;
|
||||
}
|
||||
#endif /* UNITTESTS */
|
||||
|
||||
void FTPParserRegisterTests(void) {
|
||||
#ifdef UNITTESTS
|
||||
UtRegisterTest("FTPParserTest01", FTPParserTest01, 1);
|
||||
UtRegisterTest("FTPParserTest03", FTPParserTest03, 1);
|
||||
UtRegisterTest("FTPParserTest06", FTPParserTest06, 1);
|
||||
UtRegisterTest("FTPParserTest07", FTPParserTest07, 1);
|
||||
UtRegisterTest("FTPParserTest10", FTPParserTest10, 1);
|
||||
#endif /* UNITTESTS */
|
||||
}
|
||||
|
||||
@ -0,0 +1,85 @@
|
||||
#ifndef __APP_LAYER_FTP_H__
|
||||
#define __APP_LAYER_FTP_H__
|
||||
|
||||
typedef enum {
|
||||
FTP_COMMAND_UNKNOWN = 0,
|
||||
FTP_COMMAND_ABOR,
|
||||
FTP_COMMAND_ACCT,
|
||||
FTP_COMMAND_ALLO,
|
||||
FTP_COMMAND_APPE,
|
||||
FTP_COMMAND_CDUP,
|
||||
FTP_COMMAND_CHMOD,
|
||||
FTP_COMMAND_CWD,
|
||||
FTP_COMMAND_DELE,
|
||||
FTP_COMMAND_HELP,
|
||||
FTP_COMMAND_IDLE,
|
||||
FTP_COMMAND_LIST,
|
||||
FTP_COMMAND_MAIL,
|
||||
FTP_COMMAND_MDTM,
|
||||
FTP_COMMAND_MKD,
|
||||
FTP_COMMAND_MLFL,
|
||||
FTP_COMMAND_MODE,
|
||||
FTP_COMMAND_MRCP,
|
||||
FTP_COMMAND_MRSQ,
|
||||
FTP_COMMAND_MSAM,
|
||||
FTP_COMMAND_MSND,
|
||||
FTP_COMMAND_MSOM,
|
||||
FTP_COMMAND_NLST,
|
||||
FTP_COMMAND_NOOP,
|
||||
FTP_COMMAND_PASS,
|
||||
FTP_COMMAND_PASV,
|
||||
FTP_COMMAND_PORT,
|
||||
FTP_COMMAND_PWD,
|
||||
FTP_COMMAND_QUIT,
|
||||
FTP_COMMAND_REIN,
|
||||
FTP_COMMAND_REST,
|
||||
FTP_COMMAND_RETR,
|
||||
FTP_COMMAND_RMD,
|
||||
FTP_COMMAND_RNFR,
|
||||
FTP_COMMAND_RNTO,
|
||||
FTP_COMMAND_SITE,
|
||||
FTP_COMMAND_SIZE,
|
||||
FTP_COMMAND_SMNT,
|
||||
FTP_COMMAND_STAT,
|
||||
FTP_COMMAND_STOR,
|
||||
FTP_COMMAND_STOU,
|
||||
FTP_COMMAND_STRU,
|
||||
FTP_COMMAND_SYST,
|
||||
FTP_COMMAND_TYPE,
|
||||
FTP_COMMAND_UMASK,
|
||||
FTP_COMMAND_USER
|
||||
/** \todo more if missing.. */
|
||||
} FtpRequestCommand;
|
||||
typedef uint32_t FtpRequestCommandArgOfs;
|
||||
|
||||
typedef uint16_t FtpResponseCode;
|
||||
|
||||
enum {
|
||||
FTP_FIELD_NONE = 0,
|
||||
|
||||
FTP_FIELD_REQUEST_LINE,
|
||||
FTP_FIELD_REQUEST_COMMAND,
|
||||
FTP_FIELD_REQUEST_ARGS,
|
||||
|
||||
FTP_FIELD_RESPONSE_LINE,
|
||||
FTP_FIELD_REPONSE_CODE,
|
||||
|
||||
/* must be last */
|
||||
FTP_FIELD_MAX,
|
||||
};
|
||||
|
||||
/** FTP State for app layer parser */
|
||||
typedef struct FtpState_ {
|
||||
FtpRequestCommand command;
|
||||
FtpRequestCommandArgOfs arg_offset;
|
||||
FtpResponseCode response_code;
|
||||
uint8_t *port_line;
|
||||
uint32_t port_line_len;
|
||||
} FtpState;
|
||||
|
||||
void RegisterFTPParsers(void);
|
||||
void FTPParserRegisterTests(void);
|
||||
void FTPAtExitPrintStats(void);
|
||||
|
||||
#endif /* __APP_LAYER_FTP_H__ */
|
||||
|
||||
@ -0,0 +1,528 @@
|
||||
/**
|
||||
* Copyright(c) 2009 Open Information Security Foundation
|
||||
*
|
||||
* \file
|
||||
* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
|
||||
*
|
||||
* ftpbounce keyword, part of the detection engine.
|
||||
*/
|
||||
|
||||
#include "suricata-common.h"
|
||||
#include "debug.h"
|
||||
#include "decode.h"
|
||||
#include "detect.h"
|
||||
#include "detect-parse.h"
|
||||
#include "detect-engine.h"
|
||||
#include "detect-engine-mpm.h"
|
||||
#include "detect-content.h"
|
||||
|
||||
#include "app-layer.h"
|
||||
#include "app-layer-ftp.h"
|
||||
#include "util-unittest.h"
|
||||
#include "util-debug.h"
|
||||
#include "flow.h"
|
||||
#include "flow-var.h"
|
||||
#include "threads.h"
|
||||
#include "detect-ftpbounce.h"
|
||||
|
||||
int DetectFtpbounceMatch(ThreadVars *, DetectEngineThreadCtx *, Packet *,
|
||||
Signature *, SigMatch *);
|
||||
int DetectFtpbounceALMatch(ThreadVars *, DetectEngineThreadCtx *, Flow *,
|
||||
uint8_t, void *, Signature *, SigMatch *);
|
||||
int DetectFtpbounceSetup(DetectEngineCtx *, Signature *, SigMatch *, char *);
|
||||
int DetectFtpbounceMatchArgs(uint8_t *payload, uint16_t payload_len,
|
||||
uint32_t ip_orig, uint16_t offset);
|
||||
void DetectFtpbounceRegisterTests(void);
|
||||
void DetectFtpbounceFree(void *);
|
||||
|
||||
/**
|
||||
* \brief Registration function for ftpbounce: keyword
|
||||
* \todo add support for no_stream and stream_only
|
||||
*/
|
||||
void DetectFtpbounceRegister(void)
|
||||
{
|
||||
sigmatch_table[DETECT_FTPBOUNCE].name = "ftpbounce";
|
||||
sigmatch_table[DETECT_FTPBOUNCE].Setup = DetectFtpbounceSetup;
|
||||
//sigmatch_table[DETECT_FTPBOUNCE].Match = DetectFtpbounceMatch;
|
||||
sigmatch_table[DETECT_FTPBOUNCE].Match = NULL;
|
||||
sigmatch_table[DETECT_FTPBOUNCE].AppLayerMatch = DetectFtpbounceALMatch;
|
||||
sigmatch_table[DETECT_FTPBOUNCE].Free = NULL;
|
||||
sigmatch_table[DETECT_FTPBOUNCE].RegisterTests = DetectFtpbounceRegisterTests;
|
||||
return;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief This function is used to match ftpbounce attacks
|
||||
*
|
||||
* \param payload Payload of the PORT command
|
||||
* \param payload_len Length of the payload
|
||||
* \param ip_orig IP source to check the ftpbounce condition
|
||||
* \param offset offset to the arguments of the PORT command
|
||||
*
|
||||
* \retval 1 if ftpbounce detected, 0 if not
|
||||
*/
|
||||
int DetectFtpbounceMatchArgs(uint8_t *payload, uint16_t payload_len,
|
||||
uint32_t ip_orig, uint16_t offset)
|
||||
{
|
||||
SCEnter();
|
||||
SCLogDebug("Checking ftpbounce condition");
|
||||
char *c = NULL;
|
||||
uint16_t i = 0;
|
||||
int octet = 0;
|
||||
int octet_ascii_len = 0;
|
||||
int noctet = 0;
|
||||
uint32_t ip = 0;
|
||||
/* PrintRawDataFp(stdout, payload, payload_len); */
|
||||
|
||||
if (payload_len < 7) {
|
||||
/* we need at least a differet ip address
|
||||
* in the format 1,2,3,4,x,y where x,y is the port
|
||||
* in two byte representation so let's look at
|
||||
* least for the IP octets in comma separated */
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (offset + 7 >= payload_len)
|
||||
return 0;
|
||||
|
||||
c =(char*) payload;
|
||||
if (c == NULL) {
|
||||
SCLogDebug("No payload to check");
|
||||
return 0;
|
||||
}
|
||||
|
||||
i = offset;
|
||||
/* Search for the first IP octect(Skips "PORT ") */
|
||||
while (i < payload_len && !isdigit(c[i])) i++;
|
||||
|
||||
for (;i < payload_len && octet_ascii_len < 4 ;i++) {
|
||||
if (isdigit(c[i])) {
|
||||
octet =(c[i] - '0') + octet * 10;
|
||||
octet_ascii_len++;
|
||||
} else {
|
||||
if (octet > 256) {
|
||||
SCLogDebug("Octet not in ip format");
|
||||
return 0;
|
||||
}
|
||||
|
||||
if (isspace(c[i]))
|
||||
while (i < payload_len && isspace(c[i]) ) i++;
|
||||
|
||||
if (i < payload_len && c[i] == ',') { /* we have an octet */
|
||||
noctet++;
|
||||
octet_ascii_len = 0;
|
||||
ip =(ip << 8) + octet;
|
||||
octet = 0;
|
||||
} else {
|
||||
SCLogDebug("Unrecognized character '%c'", c[i]);
|
||||
return 0;
|
||||
}
|
||||
if (noctet == 4) {
|
||||
/* Different IP than src, ftp bounce scan */
|
||||
if (ip != ntohl(ip_orig)) {
|
||||
SCLogDebug("Different ip, so Matched ip:%d <-> ip_orig:%d",
|
||||
ip, ip_orig);
|
||||
return 1;
|
||||
}
|
||||
SCLogDebug("Same ip, so no match here");
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
}
|
||||
SCLogDebug("No match");
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief This function is used to check matches from the FTP App Layer Parser
|
||||
*
|
||||
* \param t pointer to thread vars
|
||||
* \param det_ctx pointer to the pattern matcher thread
|
||||
* \param p pointer to the current packet
|
||||
* \param m pointer to the sigmatch but we don't use it since ftpbounce
|
||||
* has no options
|
||||
* \retval 0 no match
|
||||
* \retval 1 match
|
||||
*/
|
||||
int DetectFtpbounceALMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
|
||||
Flow *f, uint8_t flags, void *state, Signature *s,
|
||||
SigMatch *m)
|
||||
{
|
||||
SCEnter();
|
||||
FtpState *ftp_state =(FtpState *)state;
|
||||
if (ftp_state == NULL) {
|
||||
SCLogDebug("no ftp state, no match");
|
||||
SCReturnInt(0);
|
||||
}
|
||||
|
||||
int ret = 0;
|
||||
SCMutexLock(&f->m);
|
||||
|
||||
if (ftp_state->command == FTP_COMMAND_PORT) {
|
||||
ret = DetectFtpbounceMatchArgs(ftp_state->port_line,
|
||||
ftp_state->port_line_len, f->src.address.address_un_data32[0],
|
||||
ftp_state->arg_offset);
|
||||
}
|
||||
SCMutexUnlock(&f->m);
|
||||
|
||||
SCReturnInt(ret);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief This function is used to match ftpbounce attacks
|
||||
*
|
||||
* \param t pointer to thread vars
|
||||
* \param det_ctx pointer to the pattern matcher thread
|
||||
* \param p pointer to the current packet
|
||||
* \param m pointer to the sigmatch but we don't use it since ftpbounce
|
||||
* has no options
|
||||
* \retval 0 no match, 1 if match
|
||||
*/
|
||||
int DetectFtpbounceMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
|
||||
Packet *p, Signature *s, SigMatch *m)
|
||||
{
|
||||
SCEnter();
|
||||
uint16_t offset = 0;
|
||||
if (!(PKT_IS_TCP(p)))
|
||||
return 0;
|
||||
|
||||
SigMatch *sm = SigMatchGetLastSM(s, DETECT_CONTENT);
|
||||
if (sm == NULL)
|
||||
return 0;
|
||||
|
||||
DetectContentData *co = sm->ctx;
|
||||
if (co == NULL)
|
||||
return 0;
|
||||
|
||||
MpmMatch *mm = det_ctx->mtc.match[co->id].top;
|
||||
SCLogDebug("Starting Offset: %u",mm->offset + co->content_len);
|
||||
|
||||
offset = mm->offset + co->content_len;
|
||||
SCLogDebug("Payload: \"%s\"\nLen: %u Offset: %u\n", p->payload,
|
||||
p->payload_len, offset);
|
||||
|
||||
return DetectFtpbounceMatchArgs(p->payload, p->payload_len,
|
||||
p->src.addr_data32[0], offset);
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief this function is used to add the parsed ftpbounce
|
||||
*
|
||||
* \param de_ctx pointer to the Detection Engine Context
|
||||
* \param s pointer to the Current Signature
|
||||
* \param m pointer to the Current SigMatch
|
||||
* \param ftpbouncestr pointer to the user provided ftpbounce options
|
||||
* currently there are no options.
|
||||
*
|
||||
* \retval 0 on Success
|
||||
* \retval -1 on Failure
|
||||
*/
|
||||
int DetectFtpbounceSetup(DetectEngineCtx *de_ctx, Signature *s, SigMatch *m,
|
||||
char *ftpbouncestr)
|
||||
{
|
||||
SigMatch *sm = NULL;
|
||||
|
||||
sm = SigMatchAlloc();
|
||||
if (sm == NULL)
|
||||
return -1;
|
||||
|
||||
sm->type = DETECT_FTPBOUNCE;
|
||||
|
||||
// if (s != NULL)
|
||||
// s->flags |= SIG_FLAG_APPLAYER;
|
||||
|
||||
/* We don't need to allocate any data for ftpbounce here.
|
||||
*
|
||||
* TODO: As a suggestion, maybe we can add a flag in the flow
|
||||
* to set the stream as "bounce detected" for fast Match.
|
||||
* When you do a ftp bounce attack you usually use the same
|
||||
* communication control stream to "setup" various destinations
|
||||
* whithout breaking the connection, so I guess we can make it a bit faster
|
||||
* with a flow flag set lookup in the Match function.
|
||||
*/
|
||||
sm->ctx = NULL;
|
||||
|
||||
SigMatchAppend(s, m, sm);
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef UNITTESTS
|
||||
|
||||
/**
|
||||
* \test DetectFtpbounceTestSetup01 is a test for the Setup ftpbounce
|
||||
*/
|
||||
int DetectFtpbounceTestSetup01(void)
|
||||
{
|
||||
int res = 0;
|
||||
DetectEngineCtx *de_ctx = NULL;
|
||||
SigMatch *m = NULL;
|
||||
Signature *s = SigAlloc();
|
||||
if (s == NULL)
|
||||
return 0;
|
||||
|
||||
/* ftpbounce doesn't accept options so the str is NULL */
|
||||
res = !DetectFtpbounceSetup(de_ctx, s, m, NULL);
|
||||
res &= s->match != NULL && s->match->type & DETECT_FTPBOUNCE;
|
||||
|
||||
SigFree(s);
|
||||
return res;
|
||||
}
|
||||
|
||||
#include "stream-tcp-reassemble.h"
|
||||
|
||||
/**
|
||||
* \test Check the ftpbounce match, send a get request in three chunks
|
||||
* + more data.
|
||||
* \brief This test tests the ftpbounce condition match, based on the
|
||||
* ftp layer parser
|
||||
*/
|
||||
static int DetectFtpbounceTestALMatch02(void) {
|
||||
int result = 0;
|
||||
|
||||
uint8_t ftpbuf1[] = { 'P','O' };
|
||||
uint32_t ftplen1 = sizeof(ftpbuf1);
|
||||
uint8_t ftpbuf2[] = { 'R', 'T' };
|
||||
uint32_t ftplen2 = sizeof(ftpbuf2);
|
||||
uint8_t ftpbuf3[] = { ' ', '8','0',',','5' };
|
||||
uint32_t ftplen3 = sizeof(ftpbuf3);
|
||||
uint8_t ftpbuf4[] = "8,0,33,10,20\r\n";
|
||||
uint32_t ftplen4 = sizeof(ftpbuf4);
|
||||
|
||||
TcpSession ssn;
|
||||
Flow f;
|
||||
Packet p;
|
||||
Signature *s = NULL;
|
||||
ThreadVars th_v;
|
||||
DetectEngineThreadCtx *det_ctx;
|
||||
|
||||
memset(&th_v, 0, sizeof(th_v));
|
||||
memset(&p, 0, sizeof(p));
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
|
||||
p.src.family = AF_INET;
|
||||
p.dst.family = AF_INET;
|
||||
p.src.addr_data32[0] = 0x01020304;
|
||||
f.src.address.address_un_data32[0]=0x01020304;
|
||||
p.payload = NULL;
|
||||
p.payload_len = 0;
|
||||
p.proto = IPPROTO_TCP;
|
||||
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
f.protoctx =(void *)&ssn;
|
||||
p.flow = &f;
|
||||
p.flowflags |= FLOW_PKT_TOSERVER;
|
||||
ssn.alproto = ALPROTO_FTP;
|
||||
|
||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
||||
if (de_ctx == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
de_ctx->flags |= DE_QUIET;
|
||||
|
||||
s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any "
|
||||
"(msg:\"Ftp Bounce\"; ftpbounce; sid:1;)");
|
||||
if (s == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
DetectEngineThreadCtxInit(&th_v,(void *)de_ctx,(void *)&det_ctx);
|
||||
|
||||
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf1,
|
||||
ftplen1, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f,ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, ftplen2, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f,ALPROTO_FTP, STREAM_TOSERVER, ftpbuf3, ftplen3, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f,ALPROTO_FTP, STREAM_TOSERVER, ftpbuf4, ftplen4, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 4 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
SCLogDebug("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_PORT) {
|
||||
SCLogDebug("expected command port not detected");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* do detect */
|
||||
SigMatchSignatures(&th_v, de_ctx, det_ctx, &p);
|
||||
|
||||
if (!(PacketAlertCheck(&p, 1))) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
result = 1;
|
||||
end:
|
||||
SigGroupCleanup(de_ctx);
|
||||
SigCleanSignatures(de_ctx);
|
||||
|
||||
DetectEngineThreadCtxDeinit(&th_v,(void *)det_ctx);
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/**
|
||||
* \test Check the ftpbounce match
|
||||
* \brief This test tests the ftpbounce condition match, based on
|
||||
* the ftp layer parser
|
||||
*/
|
||||
static int DetectFtpbounceTestALMatch03(void) {
|
||||
int result = 0;
|
||||
|
||||
uint8_t ftpbuf1[] = { 'P','O' };
|
||||
uint32_t ftplen1 = sizeof(ftpbuf1);
|
||||
uint8_t ftpbuf2[] = { 'R', 'T' };
|
||||
uint32_t ftplen2 = sizeof(ftpbuf2);
|
||||
uint8_t ftpbuf3[] = { ' ', '1',',','2',',' };
|
||||
uint32_t ftplen3 = sizeof(ftpbuf3);
|
||||
uint8_t ftpbuf4[] = "3,4,10,20\r\n";
|
||||
uint32_t ftplen4 = sizeof(ftpbuf4);
|
||||
|
||||
TcpSession ssn;
|
||||
Flow f;
|
||||
Packet p;
|
||||
Signature *s = NULL;
|
||||
ThreadVars th_v;
|
||||
DetectEngineThreadCtx *det_ctx;
|
||||
|
||||
memset(&th_v, 0, sizeof(th_v));
|
||||
memset(&p, 0, sizeof(p));
|
||||
memset(&f, 0, sizeof(f));
|
||||
memset(&ssn, 0, sizeof(ssn));
|
||||
|
||||
p.src.family = AF_INET;
|
||||
p.dst.family = AF_INET;
|
||||
p.src.addr_data32[0] = 0x04030201;
|
||||
f.src.address.address_un_data32[0]=0x04030201;
|
||||
p.payload = NULL;
|
||||
p.payload_len = 0;
|
||||
p.proto = IPPROTO_TCP;
|
||||
|
||||
StreamL7DataPtrInit(&ssn,StreamL7GetStorageSize());
|
||||
f.protoctx =(void *)&ssn;
|
||||
p.flow = &f;
|
||||
p.flowflags |= FLOW_PKT_TOSERVER;
|
||||
ssn.alproto = ALPROTO_FTP;
|
||||
|
||||
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
||||
if (de_ctx == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
de_ctx->flags |= DE_QUIET;
|
||||
|
||||
s = de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any "
|
||||
"(msg:\"Ftp Bounce\"; ftpbounce; sid:1;)");
|
||||
if (s == NULL) {
|
||||
goto end;
|
||||
}
|
||||
|
||||
SigGroupBuild(de_ctx);
|
||||
DetectEngineThreadCtxInit(&th_v,(void *)de_ctx,(void *)&det_ctx);
|
||||
|
||||
int r = AppLayerParse(&f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf1,
|
||||
ftplen1, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f,ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, ftplen2, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f,ALPROTO_FTP, STREAM_TOSERVER, ftpbuf3, ftplen3, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
r = AppLayerParse(&f,ALPROTO_FTP, STREAM_TOSERVER, ftpbuf4, ftplen4, FALSE);
|
||||
if (r != 0) {
|
||||
SCLogDebug("toserver chunk 4 returned %" PRId32 ", expected 0: ", r);
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
FtpState *ftp_state = ssn.aldata[AlpGetStateIdx(ALPROTO_FTP)];
|
||||
if (ftp_state == NULL) {
|
||||
SCLogDebug("no ftp state: ");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
if (ftp_state->command != FTP_COMMAND_PORT) {
|
||||
SCLogDebug("expected command port not detected");
|
||||
result = 0;
|
||||
goto end;
|
||||
}
|
||||
|
||||
/* do detect */
|
||||
SigMatchSignatures(&th_v, de_ctx, det_ctx, &p);
|
||||
|
||||
/* It should not match */
|
||||
if (!(PacketAlertCheck(&p, 1))) {
|
||||
result = 1;
|
||||
} else {
|
||||
SCLogDebug("It should not match here!");
|
||||
}
|
||||
|
||||
end:
|
||||
SigGroupCleanup(de_ctx);
|
||||
SigCleanSignatures(de_ctx);
|
||||
|
||||
DetectEngineThreadCtxDeinit(&th_v,(void *)det_ctx);
|
||||
DetectEngineCtxFree(de_ctx);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
#endif /* UNITTESTS */
|
||||
|
||||
/**
|
||||
* \brief this function registers unit tests for DetectFtpbounce
|
||||
*/
|
||||
void DetectFtpbounceRegisterTests(void)
|
||||
{
|
||||
#ifdef UNITTESTS
|
||||
UtRegisterTest("DetectFtpbounceTestSetup01", DetectFtpbounceTestSetup01, 1);
|
||||
UtRegisterTest("DetectFtpbounceTestALMatch02",
|
||||
DetectFtpbounceTestALMatch02, 1);
|
||||
UtRegisterTest("DetectFtpbounceTestALMatch03",
|
||||
DetectFtpbounceTestALMatch03, 1);
|
||||
#endif /* UNITTESTS */
|
||||
}
|
||||
@ -0,0 +1,8 @@
|
||||
#ifndef __DETECT_FTPBOUNCE_H__
|
||||
#define __DETECT_FTPBOUNCE_H__
|
||||
|
||||
/* prototypes */
|
||||
void DetectFtpbounceRegister (void);
|
||||
|
||||
#endif /* __DETECT_FTPBOUNCE_H__ */
|
||||
|
||||
Loading…
Reference in New Issue