]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
ftpdata: add tx detect flags
authorJason Ish <jason.ish@oisf.net>
Mon, 25 Nov 2019 22:56:50 +0000 (16:56 -0600)
committerJason Ish <jason.ish@oisf.net>
Wed, 27 Nov 2019 19:03:46 +0000 (13:03 -0600)
src/app-layer-ftp.c
src/app-layer-ftp.h

index 9d168cd7512c93824879a72c2ac3b10ba8f2058c..9574cf98f99feaba770e6cde5620a8952ec9274c 100644 (file)
@@ -1211,6 +1211,26 @@ static DetectEngineState *FTPDataGetTxDetectState(void *vtx)
     return ftp_state->de_state;
 }
 
+static void FTPDataSetTxDetectFlags(void *vtx, uint8_t dir, uint64_t flags)
+{
+    FtpDataState *ftp_state = (FtpDataState *)vtx;
+    if (dir & STREAM_TOSERVER) {
+        ftp_state->detect_flags_ts = flags;
+    } else {
+        ftp_state->detect_flags_tc = flags;
+    }
+}
+
+static uint64_t FTPDataGetTxDetectFlags(void *vtx, uint8_t dir)
+{
+    FtpDataState *ftp_state = (FtpDataState *)vtx;
+    if (dir & STREAM_TOSERVER) {
+        return ftp_state->detect_flags_ts;
+    } else {
+        return ftp_state->detect_flags_tc;
+    }
+}
+
 static void FTPDataStateTransactionFree(void *state, uint64_t tx_id)
 {
     /* do nothing */
@@ -1337,6 +1357,8 @@ void RegisterFTPParsers(void)
         AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateTransactionFree);
         AppLayerParserRegisterDetectStateFuncs(IPPROTO_TCP, ALPROTO_FTPDATA,
                 FTPDataGetTxDetectState, FTPDataSetTxDetectState);
+        AppLayerParserRegisterDetectFlagsFuncs(IPPROTO_TCP, ALPROTO_FTPDATA,
+                FTPDataGetTxDetectFlags, FTPDataSetTxDetectFlags);
 
         AppLayerParserRegisterGetFilesFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateGetFiles);
 
index 11c5f84e8cf1c45bba097bc909b69feca06ae824..7c8bab2d0bba1edf543583519d86025c058cac86 100644 (file)
@@ -209,6 +209,8 @@ typedef struct FtpDataState_ {
     FtpRequestCommand command;
     uint8_t state;
     uint8_t direction;
+    uint64_t detect_flags_ts;
+    uint64_t detect_flags_tc;
 } FtpDataState;
 
 void RegisterFTPParsers(void);