typedef void (*Set_file_name_func)(Flow* flow, uint8_t*, uint32_t);
typedef void (*Set_file_direction_func)(Flow* flow, bool);
- typedef int64_t (*Get_file_depth_func)(void);
+ typedef int64_t (*Get_file_depth_func)();
-typedef void (*Set_file_policy_func)(File_policy_callback_func);
-typedef void (*Enable_file_type_func)(File_type_callback_func);
-typedef void (*Enable_file_signature_func)(File_signature_callback_func);
-typedef void (*Enable_file_capture_func)(File_signature_callback_func);
-typedef void (*Set_file_action_log_func)(Log_file_action_func);
+typedef void (*Set_file_policy_func)();
+typedef void (*Enable_file_type_func)();
+typedef void (*Enable_file_signature_func)();
+typedef void (*Enable_file_capture_func)();
+typedef void (*Set_file_action_log_func)();
typedef int (*Set_log_buffers_func)(MAIL_LogState** log_state, MAIL_LogConfig* conf);
typedef int (*File_resume_block_add_file_func)(Packet* pkt, uint32_t file_sig,
FilePosition* position);
typedef File_Verdict (*Get_file_verdict_func)(Flow* flow);
typedef void (*Render_block_verdict_func)(void* ctx, Packet* p);
-typedef FileCaptureState (*Reserve_file_func)(Flow* flow, FileCaptureInfo** file_mem);
-typedef FileCaptureInfo* (*Get_file_func)(FileCaptureInfo* file_mem, uint8_t** buff, int* size);
-typedef void (*Release_file_func)(FileCaptureInfo* data);
-typedef size_t (*File_capture_size_func)(FileCaptureInfo* file_mem);
- typedef bool (*Is_file_service_enabled)(void);
+ typedef bool (*Is_file_service_enabled)();
typedef bool (*Check_paf_abort_func)(Flow* ssn);
typedef FilePosition (*GetFilePosition)(Packet* pkt);
typedef void (*Reset_mime_paf_state_func)(MimeDataPafInfo* data_info);
#ifndef FILE_CAPTURE_H
#define FILE_CAPTURE_H
+ // There are several steps for file capture:
+ // 1) To improve performance, file data are stored in file mempool first by
+ // calling file_capture_process() during file data processing.
+ // 2) If file capture is needed, file_capture_reserve() should be called to
+ // allow file data remains in mempool. Even if a session is closed, the file
+ // data will stay in the mempool.
+ // 3) Then file data can be read through file_capture_read()
+ // 4) Finally, fila data must be released from mempool file_capture_release()
+
#include "file_api.h"
#include "libs/file_lib.h"
+#include "file_mempool.h"
-struct FileCaptureInfo
+struct FileCaptureBlock
{
uint32_t length;
- /*
- * Initialize the file memory pool
- *
- * Arguments:
- * int64_t max_file_mem: memcap in bytes
- * int64_t block_size: file block size
- *
- * Returns: NONE
- */
+ FileCaptureBlock* next; /* next block of file data */
+};
+
+class FileCapture
+{
+public:
+ FileCapture();
+ void verifiy(FileContext* context);
- /*
- * Capture file data to local buffer
- * This is the main function call to enable file capture
- *
- * Arguments:
- * uint8_t *file_data: current file data
- * int data_size: current file data size
- * FilePosition position: position of file data
- *
- * Returns:
- * 0: successful
- * 1: fail to capture the file or file capture is disabled
- */
++
++ // this must be called during snort init
+ static void init_mempool(int64_t max_file_mem, int64_t block_size);
+
- /*
- * Stop file capture, memory resource will be released if not reserved
- *
- * Returns: NONE
- */
++ // Capture file data to local buffer
++ // This is the main function call to enable file capture
++ // Returns:
++ // 0: successful
++ // 1: fail to capture the file or file capture is disabled
+ FileCaptureState process_buffer(const uint8_t* file_data, int data_size,
+ FilePosition pos);
+
- /*
- * Preserve the file in memory until it is released
- *
- * Arguments:
- * Flow *ssnptr: flow pointer
- * FileCapture **file_mem: the pointer to store the memory block
- * that stores file and its metadata.
- * It will set NULL if no memory or fail to store
- *
- * Returns:
- * FileCaptureState:
- * FILE_CAPTURE_SUCCESS = 0,
- * FILE_CAPTURE_MIN,
- * FILE_CAPTURE_MAX,
- * FILE_CAPTURE_MEMCAP,
- * FILE_CAPTURE_FAIL
- */
++ // Stop file capture, memory resource will be released if not reserved
+ void stop();
+
- /*
- * Get the file that is reserved in memory
- *
- * Arguments:
- * FileCapture *file_mem: the memory block working on
- * uint8_t **buff: address to store buffer address
- * int *size: address to store size of file
- *
- * Returns:
- * the next memory block
- * NULL: end of file or fail to get file
- */
++ // Preserve the file in memory until it is released
+ FileCaptureState reserve_file(FileContext* context, FileCaptureBlock** file_mem);
+
- /*
- * Get the file size captured in the file buffer
- *
- * Arguments:
- * FileCapture *file_mem: the first memory block of file buffer
- *
- * Returns:
- * the size of file
- * 0: no memory or fail to get file
- */
++ // Get the file that is reserved in memory, this should be called repeatedly
++ // until NULL is returned to get the full file
++ // Returns:
++ // the next memory block
++ // NULL: end of file or fail to get file
+ FileCaptureBlock* read_file(FileCaptureBlock* file_mem, uint8_t** buff, int* size);
+
- /*
- * Release the file that is reserved in memory, this function might be
- * called in a different thread.
- */
++ // Get the file size captured in the file buffer
++ // Returns:
++ // the size of file
++ // 0: no memory or fail to get file
+ size_t capture_size(FileCapture* file_mem);
+
- /*Log file capture mempool usage*/
-
++ // Release the file that is reserved in memory, this function might be
++ // called in a different thread.
+ void release_file();
+
- /*
- * Exit file capture, release all file capture memory etc,
- * this must be called when snort exits
- */
++ // Log file capture mempool usage
+ static void print_mem_usage(void);
+
++ // Exit file capture, release all file capture memory etc,
++ // this must be called when snort exits
+ static void exit(void);
+
+private:
+
+ inline FileCaptureBlock* create_file_buffer(FileMemPool* file_mempool);
+ inline FileCaptureState save_to_file_buffer(FileMemPool* file_mempool,
+ const uint8_t* file_data, int data_size, int64_t max_size);
bool reserved;
- FileCaptureInfo* last; /* last block of file data */
- FileCaptureInfo* next; /* next block of file data */
uint64_t file_size; /*file_size*/
+ FileCaptureBlock* last; /* last block of file data */
+ FileCaptureBlock* head; /* first block of file data */
+ const uint8_t *current_data; /*current file data*/
+ uint32_t current_data_len;
+ FileCaptureState capture_state;
};
typedef struct _File_Capture_Stats
#ifndef POP_PAF_H
#define POP_PAF_H
- #include "snort_types.h"
+ // Protocol aware flushing for POP.
+
+ #include "main/snort_types.h"
#include "stream/stream_api.h"
#include "stream/stream_splitter.h"
-#include "file_api/file_api.h"
+#include "file_api/file_mime_process.h"
- /* Structure used to record expected server termination sequence */
+ // Structure used to record expected server termination sequence
enum PopExpectedResp
{
- POP_PAF_SINGLE_LINE_STATE, /* server response will end with \r\n */
- POP_PAF_MULTI_LINE_STATE, /* server response will end with \r\n.\r\n */
- POP_PAF_DATA_STATE, /* Indicated MIME will be contained in response */
- POP_PAF_HAS_ARG /* Intermediate state when parsing LIST */
+ POP_PAF_SINGLE_LINE_STATE, // server response will end with \r\n
+ POP_PAF_MULTI_LINE_STATE, // server response will end with \r\n.\r\n
+ POP_PAF_DATA_STATE, // Indicated MIME will be contained in response
+ POP_PAF_HAS_ARG // Intermediate state when parsing LIST
};
enum PopParseCmdState
projects / thirdparty / snort3.git / commitdiff
