*/
#define ENCRYPTED_TRAFFIC "encrypted_traffic"
#define CHECK_ENCRYPTED "check_encrypted"
-#define INSPECT_TYPE "inspection_type"
#define INSPECT_TYPE_STATELESS "stateless"
#define INSPECT_TYPE_STATEFUL "stateful"
return FTPP_SUCCESS;
}
-/*
- * Function: ProcessInspectType(FTPTELNET_CONF_OPT *ConfOpt,
- * char *ErrorString, int ErrStrLen)
- *
- * Purpose: Process the type of inspection.
- * This sets the type of inspection for FTPTelnet to do.
- *
- * Arguments: GlobalConf => pointer to the global configuration
- * ErrorString => error string buffer
- * ErrStrLen => the length of the error string buffer
- *
- * Returns: int => an error code integer (0 = success,
- * >0 = non-fatal error, <0 = fatal error)
- *
- */
-static int ProcessInspectType(FTPTELNET_GLOBAL_CONF *GlobalConf,
- char *ErrorString, int ErrStrLen)
-{
- char *pcToken;
-
- pcToken = NextToken(CONF_SEPARATORS);
- if(pcToken == NULL)
- {
- snprintf(ErrorString, ErrStrLen,
- "No argument to token '%s'.", INSPECT_TYPE);
-
- return FTPP_FATAL_ERR;
- }
-
- if(!strcmp(INSPECT_TYPE_STATEFUL, pcToken))
- {
- GlobalConf->inspection_type = FTPP_UI_CONFIG_STATEFUL;
- }
- else if(!strcmp(INSPECT_TYPE_STATELESS, pcToken))
- {
- GlobalConf->inspection_type = FTPP_UI_CONFIG_STATELESS;
- }
- else
- {
- snprintf(ErrorString, ErrStrLen,
- "Invalid argument to token '%s'. Must be either "
- "'%s' or '%s'.", INSPECT_TYPE, INSPECT_TYPE_STATEFUL,
- INSPECT_TYPE_STATELESS);
-
- return FTPP_FATAL_ERR;
- }
-
- return FTPP_SUCCESS;
-}
-
/*
* Function: ProcessFTPGlobalConf(FTPTELNET_GLOBAL_CONF *GlobalConf,
* char *ErrorString, int ErrStrLen)
* non-fatal.
*
* The configuration options that are dealt with here are:
- * - inspection_type
- * Indicate whether to operate in stateful stateless mode
* - encrypted_traffic
* Detect and alert on encrypted sessions
* - check_after_encrypted
return iRet;
}
}
- else if(!strcmp(INSPECT_TYPE, pcToken))
- {
- iRet = ProcessInspectType(GlobalConf, ErrorString, ErrStrLen);
- if (iRet)
- {
- return iRet;
- }
- }
else
{
snprintf(ErrorString, ErrStrLen,
LogMessage("FTPTelnet Config:\n");
LogMessage(" GLOBAL CONFIG\n");
- LogMessage(" Inspection Type: %s\n",
- GlobalConf->inspection_type == FTPP_UI_CONFIG_STATELESS ?
- "stateless" : "stateful");
PrintConfOpt(&GlobalConf->encrypted, "Check for Encrypted Traffic");
LogMessage(" Continue to check encrypted data: %s\n",
GlobalConf->check_encrypted_data ? "YES" : "NO");
if (!Telnetsession)
{
- if (GlobalConf->inspection_type == FTPP_UI_CONFIG_STATEFUL)
- {
- return FTPP_NONFATAL_ERR;
- }
- else
- {
- return FTPP_INVALID_SESSION;
- }
+ return FTPP_NONFATAL_ERR;
}
if (Telnetsession->encr_state && !GlobalConf->check_encrypted_data)
#include "stream5/stream_api.h"
#include "ft_main.h"
-static THREAD_LOCAL FTP_SESSION Staticsession;
-
unsigned FtpFlowData::flow_id = 0;
unsigned TelnetFlowData::flow_id = 0;
return FTPP_NONFATAL_ERR;
}
-/*
- * Function: TelnetStatelesssessionInspection(Packet *p,
- * FTPTELNET_GLOBAL_CONF *GlobalConf,
- * TELNET_SESSION **Telnetsession,
- * FTPP_SI_INPUT *SiInput)
- *
- * Purpose: Initialize the session and server configurations for this
- * packet/stream. It is important to note in stateless mode that
- * we assume no knowledge of the state of a connection, other
- * than the knowledge that we can glean from an individual packet.
- * So in essence, each packet is it's own session and there
- * is no knowledge retained from one packet to another. If you
- * want to track a telnet session for real, use stateful mode.
- *
- * In this function, we set the session pointer (which includes
- * the correct server configuration). The actual processing to
- * find which IP is the server and which is the client, is done in
- * the InitServerConf() function.
- *
- * Arguments: p => pointer to the packet/stream
- * GlobalConf => pointer to the global configuration
- * session => double pointer to the session structure
- * SiInput => pointer to the session information
- *
- * Returns: int => return code indicating error or success
- *
- */
-static int TelnetStatelesssessionInspection(
- Packet*, FTPTELNET_GLOBAL_CONF *GlobalConf,
- TELNET_SESSION **session, FTPP_SI_INPUT *SiInput)
-{
- static THREAD_LOCAL TELNET_SESSION TelnetStaticsession;
-
- TelnetResetsession(&TelnetStaticsession);
-
- SiInput->pproto = FTPP_SI_PROTO_TELNET;
- TelnetStaticsession.telnet_conf = GlobalConf->telnet_config;
-
- *session = &TelnetStaticsession;
-
- return FTPP_SUCCESS;
-}
-
-
/*
* Function: TelnetsessionInspection(Packet *p,
* FTPTELNET_GLOBAL_CONF *GlobalConf,
* Reassembly module (which includes the server configuration) or the
* structure will be allocated and added to the stream pointer for the
* rest of the session.
- *
- * In stateless mode, we just use a static variable that is contained in
- * the function here.
*/
- if(GlobalConf->inspection_type == FTPP_UI_CONFIG_STATEFUL)
- {
- iRet = TelnetStatefulsessionInspection(p, GlobalConf, Telnetsession, SiInput);
- if (iRet)
- return iRet;
- }
- else
- {
- /* Assume stateless processing otherwise */
- iRet = TelnetStatelesssessionInspection(p, GlobalConf, Telnetsession, SiInput);
- if (iRet)
- return iRet;
- }
+ iRet = TelnetStatefulsessionInspection(p, GlobalConf, Telnetsession, SiInput);
+ if (iRet)
+ return iRet;
return FTPP_SUCCESS;
}
return FTPP_INVALID_PROTO;
}
-/*
- * Function: FTPStatelesssessionInspection(Packet *p,
- * FTPTELNET_GLOBAL_CONF *GlobalConf,
- * FTP_SESSION **Ftpsession,
- * FTPP_SI_INPUT *SiInput, int *piInspectMode)
- *
- * Purpose: Initialize the session and server configurations for this
- * packet/stream. It is important to note in stateless mode that
- * we assume no knowledge of the state of a connection, other than
- * the knowledge that we can glean from an individual packet. So
- * in essence, each packet is it's own session and there is no
- * knowledge retained from one packet to another. If you want to
- * track an FTP session for real, use stateful mode.
- *
- * In this function, we set the session pointer (which includes
- * the correct server configuration). The actual processing to find
- * which IP is the server and which is the client, is done in the
- * InitServerConf() function.
- *
- * Arguments: p => pointer to the Packet/session
- * GlobalConf => pointer to the global configuration
- * session => double pointer to the session structure
- * SiInput => pointer to the session information
- * piInspectMode => pointer so the inspection mode can be set
- *
- * Returns: int => return code indicating error or success
- *
- */
-static int FTPStatelesssessionInspection(Packet *p,
- FTPTELNET_GLOBAL_CONF *GlobalConf,
- FTP_SESSION **Ftpsession,
- FTPP_SI_INPUT *SiInput, int *piInspectMode)
-{
- FTP_CLIENT_PROTO_CONF *ClientConf;
- FTP_SERVER_PROTO_CONF *ServerConf;
- int iRet;
-
- FTPResetsession(&Staticsession);
-
- iRet = FTPInitConf(p, GlobalConf, &ClientConf, &ServerConf, SiInput, piInspectMode);
- if (iRet)
- return iRet;
-
- Staticsession.ft_ssn.proto = FTPP_SI_PROTO_FTP;
- Staticsession.client_conf = ClientConf;
- Staticsession.server_conf = ServerConf;
-
- SiInput->pproto = FTPP_SI_PROTO_FTP;
- *Ftpsession = &Staticsession;
-
- return FTPP_SUCCESS;
-}
-
-
/*
* Function: FTPsessionInspection(Packet *p,
* FTPTELNET_GLOBAL_CONF *GlobalConf,
* Reassembly module (which includes the server configuration) or the
* structure will be allocated and added to the stream pointer for the
* rest of the session.
- *
- * In stateless mode, we just use a static variable that is contained in
- * the function here.
*/
- if(GlobalConf->inspection_type == FTPP_UI_CONFIG_STATEFUL)
- {
- iRet = FTPStatefulsessionInspection(p, GlobalConf, Ftpsession, SiInput, piInspectMode);
- if (iRet)
- return iRet;
- }
- else
- {
- /* Assume stateless processing otherwise */
- iRet = FTPStatelesssessionInspection(p, GlobalConf, Ftpsession, SiInput, piInspectMode);
- if (iRet)
- return iRet;
- }
+ iRet = FTPStatefulsessionInspection(p, GlobalConf, Ftpsession, SiInput, piInspectMode);
+ if (iRet)
+ return iRet;
return FTPP_SUCCESS;
}
projects / thirdparty / snort3.git / commitdiff
