suricata
app-layer-ftp.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Eric Leblond <eric@regit.org>
23  * \author Jeff Lucovsky <jeff@lucovsky.org>
24  *
25  * App Layer Parser for FTP
26  */
27 
28 #include "suricata-common.h"
29 #include "app-layer-ftp.h"
30 #include "app-layer.h"
31 #include "app-layer-parser.h"
32 #include "app-layer-expectation.h"
33 #include "app-layer-detect-proto.h"
34 
35 #include "rust.h"
36 
37 #include "util-misc.h"
38 #include "util-mpm.h"
39 #include "util-validate.h"
40 
41 typedef struct FTPThreadCtx_ {
45 
46 #define FTP_MPM mpm_default_matcher
47 
48 static MpmCtx *ftp_mpm_ctx = NULL;
49 
50 // clang-format off
52  /* Parsed and handled */
53  { "PORT", FTP_COMMAND_PORT, 4 },
54  { "EPRT", FTP_COMMAND_EPRT, 4 },
55  { "AUTH TLS", FTP_COMMAND_AUTH_TLS, 8 },
56  { "PASV", FTP_COMMAND_PASV, 4 },
57  { "RETR", FTP_COMMAND_RETR, 4 },
58  { "EPSV", FTP_COMMAND_EPSV, 4 },
59  { "STOR", FTP_COMMAND_STOR, 4 },
60 
61  /* Parsed, but not handled */
62  { "ABOR", FTP_COMMAND_ABOR, 4 },
63  { "ACCT", FTP_COMMAND_ACCT, 4 },
64  { "ALLO", FTP_COMMAND_ALLO, 4 },
65  { "APPE", FTP_COMMAND_APPE, 4 },
66  { "CDUP", FTP_COMMAND_CDUP, 4 },
67  { "CHMOD", FTP_COMMAND_CHMOD, 5 },
68  { "CWD", FTP_COMMAND_CWD, 3 },
69  { "DELE", FTP_COMMAND_DELE, 4 },
70  { "HELP", FTP_COMMAND_HELP, 4 },
71  { "IDLE", FTP_COMMAND_IDLE, 4 },
72  { "LIST", FTP_COMMAND_LIST, 4 },
73  { "MAIL", FTP_COMMAND_MAIL, 4 },
74  { "MDTM", FTP_COMMAND_MDTM, 4 },
75  { "MKD", FTP_COMMAND_MKD, 3 },
76  { "MLFL", FTP_COMMAND_MLFL, 4 },
77  { "MODE", FTP_COMMAND_MODE, 4 },
78  { "MRCP", FTP_COMMAND_MRCP, 4 },
79  { "MRSQ", FTP_COMMAND_MRSQ, 4 },
80  { "MSAM", FTP_COMMAND_MSAM, 4 },
81  { "MSND", FTP_COMMAND_MSND, 4 },
82  { "MSOM", FTP_COMMAND_MSOM, 4 },
83  { "NLST", FTP_COMMAND_NLST, 4 },
84  { "NOOP", FTP_COMMAND_NOOP, 4 },
85  { "PASS", FTP_COMMAND_PASS, 4 },
86  { "PWD", FTP_COMMAND_PWD, 3 },
87  { "QUIT", FTP_COMMAND_QUIT, 4 },
88  { "REIN", FTP_COMMAND_REIN, 4 },
89  { "REST", FTP_COMMAND_REST, 4 },
90  { "RMD", FTP_COMMAND_RMD, 3 },
91  { "RNFR", FTP_COMMAND_RNFR, 4 },
92  { "RNTO", FTP_COMMAND_RNTO, 4 },
93  { "SITE", FTP_COMMAND_SITE, 4 },
94  { "SIZE", FTP_COMMAND_SIZE, 4 },
95  { "SMNT", FTP_COMMAND_SMNT, 4 },
96  { "STAT", FTP_COMMAND_STAT, 4 },
97  { "STOU", FTP_COMMAND_STOU, 4 },
98  { "STRU", FTP_COMMAND_STRU, 4 },
99  { "SYST", FTP_COMMAND_SYST, 4 },
100  { "TYPE", FTP_COMMAND_TYPE, 4 },
101  { "UMASK", FTP_COMMAND_UMASK, 5 },
102  { "USER", FTP_COMMAND_USER, 4 },
103  { NULL, FTP_COMMAND_UNKNOWN, 0 }
104 };
105 // clang-format on
106 
107 uint64_t ftp_config_memcap = 0;
108 uint32_t ftp_config_maxtx = 1024;
109 uint32_t ftp_max_line_len = 4096;
110 
111 SC_ATOMIC_DECLARE(uint64_t, ftp_memuse);
112 SC_ATOMIC_DECLARE(uint64_t, ftp_memcap);
113 
114 static FTPTransaction *FTPGetOldestTx(const FtpState *, FTPTransaction *);
115 
116 static void FTPParseMemcap(void)
117 {
118  const char *conf_val;
119 
120  /** set config values for memcap, prealloc and hash_size */
121  if ((ConfGet("app-layer.protocols.ftp.memcap", &conf_val)) == 1)
122  {
123  if (ParseSizeStringU64(conf_val, &ftp_config_memcap) < 0) {
124  SCLogError("Error parsing ftp.memcap "
125  "from conf file - %s. Killing engine",
126  conf_val);
127  exit(EXIT_FAILURE);
128  }
129  SCLogInfo("FTP memcap: %"PRIu64, ftp_config_memcap);
130  } else {
131  /* default to unlimited */
132  ftp_config_memcap = 0;
133  }
134 
135  SC_ATOMIC_INIT(ftp_memuse);
136  SC_ATOMIC_INIT(ftp_memcap);
137 
138  if ((ConfGet("app-layer.protocols.ftp.max-tx", &conf_val)) == 1) {
139  if (ParseSizeStringU32(conf_val, &ftp_config_maxtx) < 0) {
140  SCLogError("Error parsing ftp.max-tx "
141  "from conf file - %s.",
142  conf_val);
143  }
144  SCLogInfo("FTP max tx: %" PRIu32, ftp_config_maxtx);
145  }
146 
147  if ((ConfGet("app-layer.protocols.ftp.max-line-length", &conf_val)) == 1) {
148  if (ParseSizeStringU32(conf_val, &ftp_max_line_len) < 0) {
149  SCLogError("Error parsing ftp.max-line-length from conf file - %s.", conf_val);
150  }
151  SCLogConfig("FTP max line length: %" PRIu32, ftp_max_line_len);
152  }
153 }
154 
155 static void FTPIncrMemuse(uint64_t size)
156 {
157  (void)SC_ATOMIC_ADD(ftp_memuse, size);
158 }
159 
160 static void FTPDecrMemuse(uint64_t size)
161 {
162  (void)SC_ATOMIC_SUB(ftp_memuse, size);
163 }
164 
166 {
167  uint64_t tmpval = SC_ATOMIC_GET(ftp_memuse);
168  return tmpval;
169 }
170 
172 {
173  uint64_t tmpval = SC_ATOMIC_GET(ftp_memcap);
174  return tmpval;
175 }
176 
177 /**
178  * \brief Check if alloc'ing "size" would mean we're over memcap
179  *
180  * \retval 1 if in bounds
181  * \retval 0 if not in bounds
182  */
183 static int FTPCheckMemcap(uint64_t size)
184 {
185  if (ftp_config_memcap == 0 || size + SC_ATOMIC_GET(ftp_memuse) <= ftp_config_memcap)
186  return 1;
187  (void) SC_ATOMIC_ADD(ftp_memcap, 1);
188  return 0;
189 }
190 
191 static void *FTPCalloc(size_t n, size_t size)
192 {
193  if (FTPCheckMemcap((uint32_t)(n * size)) == 0) {
195  return NULL;
196  }
197 
198  void *ptr = SCCalloc(n, size);
199 
200  if (unlikely(ptr == NULL)) {
202  return NULL;
203  }
204 
205  FTPIncrMemuse((uint64_t)(n * size));
206  return ptr;
207 }
208 
209 static void *FTPRealloc(void *ptr, size_t orig_size, size_t size)
210 {
211  void *rptr = NULL;
212 
213  if (FTPCheckMemcap((uint32_t)(size - orig_size)) == 0) {
215  return NULL;
216  }
217 
218  rptr = SCRealloc(ptr, size);
219  if (rptr == NULL) {
221  return NULL;
222  }
223 
224  if (size > orig_size) {
225  FTPIncrMemuse(size - orig_size);
226  } else {
227  FTPDecrMemuse(orig_size - size);
228  }
229 
230  return rptr;
231 }
232 
233 static void FTPFree(void *ptr, size_t size)
234 {
235  SCFree(ptr);
236 
237  FTPDecrMemuse((uint64_t)size);
238 }
239 
240 static FTPString *FTPStringAlloc(void)
241 {
242  return FTPCalloc(1, sizeof(FTPString));
243 }
244 
245 static void FTPStringFree(FTPString *str)
246 {
247  if (str->str) {
248  FTPFree(str->str, str->len);
249  }
250 
251  FTPFree(str, sizeof(FTPString));
252 }
253 
254 static void *FTPLocalStorageAlloc(void)
255 {
256  /* needed by the mpm */
257  FTPThreadCtx *td = SCCalloc(1, sizeof(*td));
258  if (td == NULL) {
259  exit(EXIT_FAILURE);
260  }
261 
262  td->pmq = SCCalloc(1, sizeof(*td->pmq));
263  if (td->pmq == NULL) {
264  exit(EXIT_FAILURE);
265  }
266  PmqSetup(td->pmq);
267 
268  td->ftp_mpm_thread_ctx = SCCalloc(1, sizeof(MpmThreadCtx));
269  if (unlikely(td->ftp_mpm_thread_ctx == NULL)) {
270  exit(EXIT_FAILURE);
271  }
273  return td;
274 }
275 
276 static void FTPLocalStorageFree(void *ptr)
277 {
278  FTPThreadCtx *td = ptr;
279  if (td != NULL) {
280  if (td->pmq != NULL) {
281  PmqFree(td->pmq);
282  SCFree(td->pmq);
283  }
284 
285  if (td->ftp_mpm_thread_ctx != NULL) {
288  }
289 
290  SCFree(td);
291  }
292 }
293 static FTPTransaction *FTPTransactionCreate(FtpState *state)
294 {
295  SCEnter();
296  FTPTransaction *firsttx = TAILQ_FIRST(&state->tx_list);
297  if (firsttx && state->tx_cnt - firsttx->tx_id > ftp_config_maxtx) {
298  // FTP does not set events yet...
299  return NULL;
300  }
301  FTPTransaction *tx = FTPCalloc(1, sizeof(*tx));
302  if (tx == NULL) {
303  return NULL;
304  }
305 
306  TAILQ_INSERT_TAIL(&state->tx_list, tx, next);
307  tx->tx_id = state->tx_cnt++;
308 
309  TAILQ_INIT(&tx->response_list);
310 
311  SCLogDebug("new transaction %p (state tx cnt %"PRIu64")", tx, state->tx_cnt);
312  return tx;
313 }
314 
315 static void FTPTransactionFree(FTPTransaction *tx)
316 {
317  SCEnter();
318 
319  if (tx->tx_data.de_state != NULL) {
320  DetectEngineStateFree(tx->tx_data.de_state);
321  }
322 
323  if (tx->request) {
324  FTPFree(tx->request, tx->request_length);
325  }
326 
327  FTPString *str = NULL;
328  while ((str = TAILQ_FIRST(&tx->response_list))) {
329  TAILQ_REMOVE(&tx->response_list, str, next);
330  FTPStringFree(str);
331  }
332 
333  if (tx->tx_data.events) {
335  }
336 
337  FTPFree(tx, sizeof(*tx));
338 }
339 
340 typedef struct FtpInput_ {
341  const uint8_t *buf;
342  int32_t consumed;
343  int32_t len;
344  int32_t orig_len;
346 
347 static AppLayerResult FTPGetLineForDirection(
348  FtpLineState *line, FtpInput *input, bool *current_line_truncated)
349 {
350  SCEnter();
351 
352  /* we have run out of input */
353  if (input->len <= 0)
354  return APP_LAYER_ERROR;
355 
356  uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
357 
358  if (lf_idx == NULL) {
359  if (!(*current_line_truncated) && (uint32_t)input->len >= ftp_max_line_len) {
360  *current_line_truncated = true;
361  line->buf = input->buf;
362  line->len = ftp_max_line_len;
363  line->delim_len = 0;
364  input->len = 0;
366  }
367  SCReturnStruct(APP_LAYER_INCOMPLETE(input->consumed, input->len + 1));
368  } else if (*current_line_truncated) {
369  // Whatever came in with first LF should also get discarded
370  *current_line_truncated = false;
371  line->len = 0;
372  line->delim_len = 0;
373  input->len = 0;
375  } else {
376  // There could be one chunk of command data that has LF but post the line limit
377  // e.g. input_len = 5077
378  // lf_idx = 5010
379  // max_line_len = 4096
380  uint32_t o_consumed = input->consumed;
381  input->consumed = (uint32_t)(lf_idx - input->buf + 1);
382  line->len = input->consumed - o_consumed;
383  input->len -= line->len;
384  line->lf_found = true;
385  DEBUG_VALIDATE_BUG_ON((input->consumed + input->len) != input->orig_len);
386  line->buf = input->buf + o_consumed;
387  if (line->len >= ftp_max_line_len) {
388  *current_line_truncated = true;
389  line->len = ftp_max_line_len;
391  }
392  if (input->consumed >= 2 && input->buf[input->consumed - 2] == 0x0D) {
393  line->delim_len = 2;
394  line->len -= 2;
395  } else {
396  line->delim_len = 1;
397  line->len -= 1;
398  }
400  }
401 }
402 
403 /**
404  * \brief This function is called to determine and set which command is being
405  * transferred to the ftp server
406  * \param thread context
407  * \param input input line of the command
408  * \param len of the command
409  * \param cmd_descriptor when the command has been parsed
410  *
411  * \retval 1 when the command is parsed, 0 otherwise
412  */
413 static int FTPParseRequestCommand(
414  FTPThreadCtx *td, FtpLineState *line, const FtpCommand **cmd_descriptor)
415 {
416  SCEnter();
417 
418  /* I don't like this pmq reset here. We'll devise a method later, that
419  * should make the use of the mpm very efficient */
420  PmqReset(td->pmq);
421  int mpm_cnt = mpm_table[FTP_MPM].Search(
422  ftp_mpm_ctx, td->ftp_mpm_thread_ctx, td->pmq, line->buf, line->len);
423  if (mpm_cnt) {
424  *cmd_descriptor = &FtpCommands[td->pmq->rule_id_array[0]];
425  SCReturnInt(1);
426  }
427 
428  *cmd_descriptor = NULL;
429  SCReturnInt(0);
430 }
431 
433  /** Need to look like a ExpectationData so DFree must
434  * be first field . */
435  void (*DFree)(void *);
436  uint64_t flow_id;
437  uint8_t *file_name;
438  uint16_t file_len;
439  uint8_t direction; /**< direction in which the data will flow */
441 };
442 
443 static void FtpTransferCmdFree(void *data)
444 {
445  struct FtpTransferCmd *cmd = (struct FtpTransferCmd *) data;
446  if (cmd == NULL)
447  return;
448  if (cmd->file_name) {
449  FTPFree(cmd->file_name, cmd->file_len + 1);
450  }
451  FTPFree(cmd, sizeof(struct FtpTransferCmd));
452 }
453 
454 static uint32_t CopyCommandLine(uint8_t **dest, FtpLineState *line)
455 {
456  if (likely(line->len)) {
457  uint8_t *where = FTPCalloc(line->len + 1, sizeof(char));
458  if (unlikely(where == NULL)) {
459  return 0;
460  }
461  memcpy(where, line->buf, line->len);
462 
463  /* Remove trailing newlines/carriage returns */
464  while (line->len && isspace((unsigned char)where[line->len - 1])) {
465  line->len--;
466  }
467 
468  where[line->len] = '\0';
469  *dest = where;
470  }
471  /* either 0 or actual */
472  return line->len ? line->len + 1 : 0;
473 }
474 
475 #include "util-print.h"
476 
477 /**
478  * \brief This function is called to retrieve a ftp request
479  * \param ftp_state the ftp state structure for the parser
480  *
481  * \retval APP_LAYER_OK when input was process successfully
482  * \retval APP_LAYER_ERROR when a unrecoverable error was encountered
483  */
484 static AppLayerResult FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserState *pstate,
485  StreamSlice stream_slice, void *local_data)
486 {
487  FTPThreadCtx *thread_data = local_data;
488 
489  SCEnter();
490  /* PrintRawDataFp(stdout, input,input_len); */
491 
492  FtpState *state = (FtpState *)ftp_state;
493  void *ptmp;
494 
495  const uint8_t *input = StreamSliceGetData(&stream_slice);
496  uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
497 
498  if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
500  } else if (input == NULL || input_len == 0) {
502  }
503 
504  FtpInput ftpi = { .buf = input, .len = input_len, .orig_len = input_len, .consumed = 0 };
505  FtpLineState line = { .buf = NULL, .len = 0, .delim_len = 0, .lf_found = false };
506 
507  uint8_t direction = STREAM_TOSERVER;
508  AppLayerResult res;
509  while (1) {
510  res = FTPGetLineForDirection(&line, &ftpi, &state->current_line_truncated_ts);
511  if (res.status == 1) {
512  return res;
513  } else if (res.status == -1) {
514  break;
515  }
516  const FtpCommand *cmd_descriptor;
517 
518  if (!FTPParseRequestCommand(thread_data, &line, &cmd_descriptor)) {
519  state->command = FTP_COMMAND_UNKNOWN;
520  continue;
521  }
522 
523  state->command = cmd_descriptor->command;
524  FTPTransaction *tx = FTPTransactionCreate(state);
525  if (unlikely(tx == NULL))
527  state->curr_tx = tx;
528 
529  tx->command_descriptor = cmd_descriptor;
530  tx->request_length = CopyCommandLine(&tx->request, &line);
532 
533  if (line.lf_found) {
534  state->current_line_truncated_ts = false;
535  }
536  if (tx->request_truncated) {
537  AppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, FtpEventRequestCommandTooLong);
538  }
539 
540  /* change direction (default to server) so expectation will handle
541  * the correct message when expectation will match.
542  * For ftp active mode, data connection direction is opposite to
543  * control direction.
544  */
545  if ((state->active && state->command == FTP_COMMAND_STOR) ||
546  (!state->active && state->command == FTP_COMMAND_RETR)) {
547  direction = STREAM_TOCLIENT;
548  }
549 
550  switch (state->command) {
551  case FTP_COMMAND_EPRT:
552  // fallthrough
553  case FTP_COMMAND_PORT:
554  if (line.len + 1 > state->port_line_size) {
555  /* Allocate an extra byte for a NULL terminator */
556  ptmp = FTPRealloc(state->port_line, state->port_line_size, line.len);
557  if (ptmp == NULL) {
558  if (state->port_line) {
559  FTPFree(state->port_line, state->port_line_size);
560  state->port_line = NULL;
561  state->port_line_size = 0;
562  state->port_line_len = 0;
563  }
565  }
566  state->port_line = ptmp;
567  state->port_line_size = line.len;
568  }
569  memcpy(state->port_line, line.buf, line.len);
570  state->port_line_len = line.len;
571  break;
572  case FTP_COMMAND_RETR:
573  // fallthrough
574  case FTP_COMMAND_STOR: {
575  /* Ensure that there is a negotiated dyn port and a file
576  * name -- need more than 5 chars: cmd [4], space, <filename>
577  */
578  if (state->dyn_port == 0 || line.len < 6) {
580  }
581  struct FtpTransferCmd *data = FTPCalloc(1, sizeof(struct FtpTransferCmd));
582  if (data == NULL)
584  data->DFree = FtpTransferCmdFree;
585  /*
586  * Min size has been checked in FTPParseRequestCommand
587  * SC_FILENAME_MAX includes the null
588  */
589  uint32_t file_name_len = MIN(SC_FILENAME_MAX - 1, line.len - 5);
590 #if SC_FILENAME_MAX > UINT16_MAX
591 #error SC_FILENAME_MAX is greater than UINT16_MAX
592 #endif
593  data->file_name = FTPCalloc(file_name_len + 1, sizeof(char));
594  if (data->file_name == NULL) {
595  FtpTransferCmdFree(data);
597  }
598  data->file_name[file_name_len] = 0;
599  data->file_len = (uint16_t)file_name_len;
600  memcpy(data->file_name, line.buf + 5, file_name_len);
601  data->cmd = state->command;
602  data->flow_id = FlowGetId(f);
603  data->direction = direction;
605  0, state->dyn_port, ALPROTO_FTPDATA, data);
606  if (ret == -1) {
607  FtpTransferCmdFree(data);
608  SCLogDebug("No expectation created.");
610  } else {
611  SCLogDebug("Expectation created [direction: %s, dynamic port %"PRIu16"].",
612  state->active ? "to server" : "to client",
613  state->dyn_port);
614  }
615 
616  /* reset the dyn port to avoid duplicate */
617  state->dyn_port = 0;
618  /* reset active/passive indicator */
619  state->active = false;
620  } break;
621  default:
622  break;
623  }
624  if (line.len >= ftp_max_line_len) {
625  ftpi.consumed = ftpi.len + 1;
626  break;
627  }
628  }
629 
631 }
632 
633 static int FTPParsePassiveResponse(FtpState *state, const uint8_t *input, uint32_t input_len)
634 {
635  uint16_t dyn_port = rs_ftp_pasv_response(input, input_len);
636  if (dyn_port == 0) {
637  return -1;
638  }
639  SCLogDebug("FTP passive mode (v4): dynamic port %"PRIu16"", dyn_port);
640  state->active = false;
641  state->dyn_port = dyn_port;
642  state->curr_tx->dyn_port = dyn_port;
643  state->curr_tx->active = false;
644 
645  return 0;
646 }
647 
648 static int FTPParsePassiveResponseV6(FtpState *state, const uint8_t *input, uint32_t input_len)
649 {
650  uint16_t dyn_port = rs_ftp_epsv_response(input, input_len);
651  if (dyn_port == 0) {
652  return -1;
653  }
654  SCLogDebug("FTP passive mode (v6): dynamic port %"PRIu16"", dyn_port);
655  state->active = false;
656  state->dyn_port = dyn_port;
657  state->curr_tx->dyn_port = dyn_port;
658  state->curr_tx->active = false;
659  return 0;
660 }
661 
662 /**
663  * \brief Handle preliminary replies -- keep tx open
664  * \retval bool True for a positive preliminary reply; false otherwise
665  *
666  * 1yz Positive Preliminary reply
667  *
668  * The requested action is being initiated; expect another
669  * reply before proceeding with a new command
670  */
671 static inline bool FTPIsPPR(const uint8_t *input, uint32_t input_len)
672 {
673  return input_len >= 4 && isdigit(input[0]) && input[0] == '1' &&
674  isdigit(input[1]) && isdigit(input[2]) && isspace(input[3]);
675 }
676 
677 /**
678  * \brief This function is called to retrieve a ftp response
679  * \param ftp_state the ftp state structure for the parser
680  * \param input input line of the command
681  * \param input_len length of the request
682  * \param output the resulting output
683  *
684  * \retval 1 when the command is parsed, 0 otherwise
685  */
686 static AppLayerResult FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstate,
687  StreamSlice stream_slice, void *local_data)
688 {
689  FtpState *state = (FtpState *)ftp_state;
690 
691  const uint8_t *input = StreamSliceGetData(&stream_slice);
692  uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
693 
694  if (unlikely(input_len == 0)) {
696  }
697  FtpInput ftpi = { .buf = input, .len = input_len, .orig_len = input_len, .consumed = 0 };
698  FtpLineState line = { .buf = NULL, .len = 0, .delim_len = 0, .lf_found = false };
699 
700  FTPTransaction *lasttx = TAILQ_FIRST(&state->tx_list);
701  AppLayerResult res;
702  while (1) {
703  res = FTPGetLineForDirection(&line, &ftpi, &state->current_line_truncated_tc);
704  if (res.status == 1) {
705  return res;
706  } else if (res.status == -1) {
707  break;
708  }
709  FTPTransaction *tx = FTPGetOldestTx(state, lasttx);
710  if (tx == NULL) {
711  tx = FTPTransactionCreate(state);
712  }
713  if (unlikely(tx == NULL)) {
715  }
716  lasttx = tx;
717  if (state->command == FTP_COMMAND_UNKNOWN || tx->command_descriptor == NULL) {
718  /* unknown */
720  }
721 
722  state->curr_tx = tx;
723  uint16_t dyn_port;
724  switch (state->command) {
726  if (line.len >= 4 && SCMemcmp("234 ", line.buf, 4) == 0) {
728  }
729  break;
730 
731  case FTP_COMMAND_EPRT:
732  dyn_port = rs_ftp_active_eprt(state->port_line, state->port_line_len);
733  if (dyn_port == 0) {
734  goto tx_complete;
735  }
736  state->dyn_port = dyn_port;
737  state->active = true;
738  tx->dyn_port = dyn_port;
739  tx->active = true;
740  SCLogDebug("FTP active mode (v6): dynamic port %" PRIu16 "", dyn_port);
741  break;
742 
743  case FTP_COMMAND_PORT:
744  dyn_port = rs_ftp_active_port(state->port_line, state->port_line_len);
745  if (dyn_port == 0) {
746  goto tx_complete;
747  }
748  state->dyn_port = dyn_port;
749  state->active = true;
750  tx->dyn_port = state->dyn_port;
751  tx->active = true;
752  SCLogDebug("FTP active mode (v4): dynamic port %" PRIu16 "", dyn_port);
753  break;
754 
755  case FTP_COMMAND_PASV:
756  if (line.len >= 4 && SCMemcmp("227 ", line.buf, 4) == 0) {
757  FTPParsePassiveResponse(ftp_state, line.buf, line.len);
758  }
759  break;
760 
761  case FTP_COMMAND_EPSV:
762  if (line.len >= 4 && SCMemcmp("229 ", line.buf, 4) == 0) {
763  FTPParsePassiveResponseV6(ftp_state, line.buf, line.len);
764  }
765  break;
766  default:
767  break;
768  }
769 
770  if (likely(line.len)) {
771  FTPString *response = FTPStringAlloc();
772  if (likely(response)) {
773  response->len = CopyCommandLine(&response->str, &line);
774  response->truncated = state->current_line_truncated_tc;
775  if (response->truncated) {
777  &tx->tx_data.events, FtpEventResponseCommandTooLong);
778  }
779  if (line.lf_found) {
780  state->current_line_truncated_tc = false;
781  }
782  TAILQ_INSERT_TAIL(&tx->response_list, response, next);
783  }
784  }
785 
786  /* Handle preliminary replies -- keep tx open */
787  if (FTPIsPPR(line.buf, line.len)) {
788  continue;
789  }
790  tx_complete:
791  tx->done = true;
792 
793  if (line.len >= ftp_max_line_len) {
794  ftpi.consumed = ftpi.len + 1;
795  break;
796  }
797  }
798 
800 }
801 
802 
803 #ifdef DEBUG
804 static SCMutex ftp_state_mem_lock = SCMUTEX_INITIALIZER;
805 static uint64_t ftp_state_memuse = 0;
806 static uint64_t ftp_state_memcnt = 0;
807 #endif
808 
809 static void *FTPStateAlloc(void *orig_state, AppProto proto_orig)
810 {
811  void *s = FTPCalloc(1, sizeof(FtpState));
812  if (unlikely(s == NULL))
813  return NULL;
814 
815  FtpState *ftp_state = (FtpState *) s;
816  TAILQ_INIT(&ftp_state->tx_list);
817 
818 #ifdef DEBUG
819  SCMutexLock(&ftp_state_mem_lock);
820  ftp_state_memcnt++;
821  ftp_state_memuse+=sizeof(FtpState);
822  SCMutexUnlock(&ftp_state_mem_lock);
823 #endif
824  return s;
825 }
826 
827 static void FTPStateFree(void *s)
828 {
829  FtpState *fstate = (FtpState *) s;
830  if (fstate->port_line != NULL)
831  FTPFree(fstate->port_line, fstate->port_line_size);
832 
833  FTPTransaction *tx = NULL;
834  while ((tx = TAILQ_FIRST(&fstate->tx_list))) {
835  TAILQ_REMOVE(&fstate->tx_list, tx, next);
836  SCLogDebug("[%s] state %p id %" PRIu64 ", Freeing %d bytes at %p",
838  tx->request);
839  FTPTransactionFree(tx);
840  }
841 
842  FTPFree(s, sizeof(FtpState));
843 #ifdef DEBUG
844  SCMutexLock(&ftp_state_mem_lock);
845  ftp_state_memcnt--;
846  ftp_state_memuse-=sizeof(FtpState);
847  SCMutexUnlock(&ftp_state_mem_lock);
848 #endif
849 }
850 
851 /**
852  * \brief This function returns the oldest open transaction; if none
853  * are open, then the oldest transaction is returned
854  * \param ftp_state the ftp state structure for the parser
855  * \param starttx the ftp transaction where to start looking
856  *
857  * \retval transaction pointer when a transaction was found; NULL otherwise.
858  */
859 static FTPTransaction *FTPGetOldestTx(const FtpState *ftp_state, FTPTransaction *starttx)
860 {
861  if (unlikely(!ftp_state)) {
862  SCLogDebug("NULL state object; no transactions available");
863  return NULL;
864  }
865  FTPTransaction *tx = starttx;
866  FTPTransaction *lasttx = NULL;
867  while(tx != NULL) {
868  /* Return oldest open tx */
869  if (!tx->done) {
870  SCLogDebug("Returning tx %p id %"PRIu64, tx, tx->tx_id);
871  return tx;
872  }
873  /* save for the end */
874  lasttx = tx;
875  tx = TAILQ_NEXT(tx, next);
876  }
877  /* All tx are closed; return last element */
878  if (lasttx)
879  SCLogDebug("Returning OLDEST tx %p id %"PRIu64, lasttx, lasttx->tx_id);
880  return lasttx;
881 }
882 
883 static void *FTPGetTx(void *state, uint64_t tx_id)
884 {
885  FtpState *ftp_state = (FtpState *)state;
886  if (ftp_state) {
887  FTPTransaction *tx = NULL;
888 
889  if (ftp_state->curr_tx == NULL)
890  return NULL;
891  if (ftp_state->curr_tx->tx_id == tx_id)
892  return ftp_state->curr_tx;
893 
894  TAILQ_FOREACH(tx, &ftp_state->tx_list, next) {
895  if (tx->tx_id == tx_id)
896  return tx;
897  }
898  }
899  return NULL;
900 }
901 
902 static AppLayerTxData *FTPGetTxData(void *vtx)
903 {
904  FTPTransaction *tx = (FTPTransaction *)vtx;
905  return &tx->tx_data;
906 }
907 
908 static AppLayerStateData *FTPGetStateData(void *vstate)
909 {
910  FtpState *s = (FtpState *)vstate;
911  return &s->state_data;
912 }
913 
914 static void FTPStateTransactionFree(void *state, uint64_t tx_id)
915 {
916  FtpState *ftp_state = state;
917  FTPTransaction *tx = NULL;
918  TAILQ_FOREACH(tx, &ftp_state->tx_list, next) {
919  if (tx_id < tx->tx_id)
920  break;
921  else if (tx_id > tx->tx_id)
922  continue;
923 
924  if (tx == ftp_state->curr_tx)
925  ftp_state->curr_tx = NULL;
926  TAILQ_REMOVE(&ftp_state->tx_list, tx, next);
927  FTPTransactionFree(tx);
928  break;
929  }
930 }
931 
932 static uint64_t FTPGetTxCnt(void *state)
933 {
934  uint64_t cnt = 0;
935  FtpState *ftp_state = state;
936  if (ftp_state) {
937  cnt = ftp_state->tx_cnt;
938  }
939  SCLogDebug("returning state %p %"PRIu64, state, cnt);
940  return cnt;
941 }
942 
943 static int FTPGetAlstateProgress(void *vtx, uint8_t direction)
944 {
945  SCLogDebug("tx %p", vtx);
946  FTPTransaction *tx = vtx;
947 
948  if (!tx->done) {
949  if (direction == STREAM_TOSERVER && tx->command_descriptor->command == FTP_COMMAND_PORT) {
950  return FTP_STATE_PORT_DONE;
951  }
952  return FTP_STATE_IN_PROGRESS;
953  }
954 
955  return FTP_STATE_FINISHED;
956 }
957 
958 static AppProto FTPUserProbingParser(
959  Flow *f, uint8_t direction, const uint8_t *input, uint32_t len, uint8_t *rdir)
960 {
961  if (f->alproto_tc == ALPROTO_POP3) {
962  // POP traffic begins by same "USER" pattern as FTP
963  return ALPROTO_FAILED;
964  }
965  return ALPROTO_FTP;
966 }
967 
968 static int FTPRegisterPatternsForProtocolDetection(void)
969 {
971  IPPROTO_TCP, ALPROTO_FTP, "220 (", 5, 0, STREAM_TOCLIENT) < 0) {
972  return -1;
973  }
975  IPPROTO_TCP, ALPROTO_FTP, "FEAT", 4, 0, STREAM_TOSERVER) < 0) {
976  return -1;
977  }
978  if (AppLayerProtoDetectPMRegisterPatternCSwPP(IPPROTO_TCP, ALPROTO_FTP, "USER ", 5, 0,
979  STREAM_TOSERVER, FTPUserProbingParser, 5, 5) < 0) {
980  return -1;
981  }
983  IPPROTO_TCP, ALPROTO_FTP, "PASS ", 5, 0, STREAM_TOSERVER) < 0) {
984  return -1;
985  }
987  IPPROTO_TCP, ALPROTO_FTP, "PORT ", 5, 0, STREAM_TOSERVER) < 0) {
988  return -1;
989  }
990 
991  return 0;
992 }
993 
994 
996 
997 /**
998  * \brief This function is called to retrieve a ftp request
999  * \param ftp_state the ftp state structure for the parser
1000  * \param output the resulting output
1001  *
1002  * \retval 1 when the command is parsed, 0 otherwise
1003  */
1004 static AppLayerResult FTPDataParse(Flow *f, FtpDataState *ftpdata_state,
1005  AppLayerParserState *pstate, StreamSlice stream_slice, void *local_data, uint8_t direction)
1006 {
1007  const uint8_t *input = StreamSliceGetData(&stream_slice);
1008  uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
1009  const bool eof = (direction & STREAM_TOSERVER)
1012 
1013  SCTxDataUpdateFileFlags(&ftpdata_state->tx_data, ftpdata_state->state_data.file_flags);
1014  if (ftpdata_state->tx_data.file_tx == 0)
1015  ftpdata_state->tx_data.file_tx = direction & (STREAM_TOSERVER | STREAM_TOCLIENT);
1016 
1017  /* we depend on detection engine for file pruning */
1018  const uint16_t flags = FileFlowFlagsToFlags(ftpdata_state->tx_data.file_flags, direction);
1019  int ret = 0;
1020 
1021  SCLogDebug("FTP-DATA input_len %u flags %04x dir %d/%s EOF %s", input_len, flags, direction,
1022  (direction & STREAM_TOSERVER) ? "toserver" : "toclient", eof ? "true" : "false");
1023 
1024  SCLogDebug("FTP-DATA flags %04x dir %d", flags, direction);
1025  if (input_len && ftpdata_state->files == NULL) {
1026  struct FtpTransferCmd *data =
1028  if (data == NULL) {
1030  }
1031 
1032  /* we shouldn't get data in the wrong dir. Don't set things up for this dir */
1033  if ((direction & data->direction) == 0) {
1034  // TODO set event for data in wrong direction
1035  SCLogDebug("input %u not for our direction (%s): %s/%s", input_len,
1036  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
1037  data->cmd == FTP_COMMAND_STOR ? "STOR" : "RETR",
1038  (data->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1040  }
1041 
1042  ftpdata_state->files = FileContainerAlloc();
1043  if (ftpdata_state->files == NULL) {
1046  }
1047 
1048  ftpdata_state->file_name = data->file_name;
1049  ftpdata_state->file_len = data->file_len;
1050  data->file_name = NULL;
1051  data->file_len = 0;
1052  f->parent_id = data->flow_id;
1053  ftpdata_state->command = data->cmd;
1054  switch (data->cmd) {
1055  case FTP_COMMAND_STOR:
1056  ftpdata_state->direction = data->direction;
1057  SCLogDebug("STOR data to %s",
1058  (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1059  break;
1060  case FTP_COMMAND_RETR:
1061  ftpdata_state->direction = data->direction;
1062  SCLogDebug("RETR data to %s",
1063  (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1064  break;
1065  default:
1066  break;
1067  }
1068 
1069  /* open with fixed track_id 0 as we can have just one
1070  * file per ftp-data flow. */
1071  if (FileOpenFileWithId(ftpdata_state->files, &sbcfg,
1072  0ULL, (uint8_t *) ftpdata_state->file_name,
1073  ftpdata_state->file_len,
1074  input, input_len, flags) != 0) {
1075  SCLogDebug("Can't open file");
1076  ret = -1;
1077  }
1079  ftpdata_state->tx_data.files_opened = 1;
1080  } else {
1081  if (ftpdata_state->state == FTPDATA_STATE_FINISHED) {
1082  SCLogDebug("state is already finished");
1083  DEBUG_VALIDATE_BUG_ON(input_len); // data after state finished is a bug.
1085  }
1086  if ((direction & ftpdata_state->direction) == 0) {
1087  if (input_len) {
1088  // TODO set event for data in wrong direction
1089  }
1090  SCLogDebug("input %u not for us (%s): %s/%s", input_len,
1091  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
1092  ftpdata_state->command == FTP_COMMAND_STOR ? "STOR" : "RETR",
1093  (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1095  }
1096  if (input_len != 0) {
1097  ret = FileAppendData(ftpdata_state->files, &sbcfg, input, input_len);
1098  if (ret == -2) {
1099  ret = 0;
1100  SCLogDebug("FileAppendData() - file no longer being extracted");
1101  goto out;
1102  } else if (ret < 0) {
1103  SCLogDebug("FileAppendData() failed: %d", ret);
1104  ret = -2;
1105  goto out;
1106  }
1107  }
1108  }
1109 
1110  BUG_ON((direction & ftpdata_state->direction) == 0); // should be unreachable
1111  if (eof) {
1112  ret = FileCloseFile(ftpdata_state->files, &sbcfg, NULL, 0, flags);
1113  ftpdata_state->state = FTPDATA_STATE_FINISHED;
1114  SCLogDebug("closed because of eof: state now FTPDATA_STATE_FINISHED");
1115  }
1116 out:
1117  if (ret < 0) {
1119  }
1121 }
1122 
1123 static AppLayerResult FTPDataParseRequest(Flow *f, void *ftp_state, AppLayerParserState *pstate,
1124  StreamSlice stream_slice, void *local_data)
1125 {
1126  return FTPDataParse(f, ftp_state, pstate, stream_slice, local_data, STREAM_TOSERVER);
1127 }
1128 
1129 static AppLayerResult FTPDataParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstate,
1130  StreamSlice stream_slice, void *local_data)
1131 {
1132  return FTPDataParse(f, ftp_state, pstate, stream_slice, local_data, STREAM_TOCLIENT);
1133 }
1134 
1135 #ifdef DEBUG
1136 static SCMutex ftpdata_state_mem_lock = SCMUTEX_INITIALIZER;
1137 static uint64_t ftpdata_state_memuse = 0;
1138 static uint64_t ftpdata_state_memcnt = 0;
1139 #endif
1140 
1141 static void *FTPDataStateAlloc(void *orig_state, AppProto proto_orig)
1142 {
1143  void *s = FTPCalloc(1, sizeof(FtpDataState));
1144  if (unlikely(s == NULL))
1145  return NULL;
1146 
1147  FtpDataState *state = (FtpDataState *) s;
1149 
1150 #ifdef DEBUG
1151  SCMutexLock(&ftpdata_state_mem_lock);
1152  ftpdata_state_memcnt++;
1153  ftpdata_state_memuse+=sizeof(FtpDataState);
1154  SCMutexUnlock(&ftpdata_state_mem_lock);
1155 #endif
1156  return s;
1157 }
1158 
1159 static void FTPDataStateFree(void *s)
1160 {
1161  FtpDataState *fstate = (FtpDataState *) s;
1162 
1163  if (fstate->tx_data.de_state != NULL) {
1164  DetectEngineStateFree(fstate->tx_data.de_state);
1165  }
1166  if (fstate->file_name != NULL) {
1167  FTPFree(fstate->file_name, fstate->file_len + 1);
1168  }
1169 
1170  FileContainerFree(fstate->files, &sbcfg);
1171 
1172  FTPFree(s, sizeof(FtpDataState));
1173 #ifdef DEBUG
1174  SCMutexLock(&ftpdata_state_mem_lock);
1175  ftpdata_state_memcnt--;
1176  ftpdata_state_memuse-=sizeof(FtpDataState);
1177  SCMutexUnlock(&ftpdata_state_mem_lock);
1178 #endif
1179 }
1180 
1181 static AppLayerTxData *FTPDataGetTxData(void *vtx)
1182 {
1183  FtpDataState *ftp_state = (FtpDataState *)vtx;
1184  return &ftp_state->tx_data;
1185 }
1186 
1187 static AppLayerStateData *FTPDataGetStateData(void *vstate)
1188 {
1189  FtpDataState *ftp_state = (FtpDataState *)vstate;
1190  return &ftp_state->state_data;
1191 }
1192 
1193 static void FTPDataStateTransactionFree(void *state, uint64_t tx_id)
1194 {
1195  /* do nothing */
1196 }
1197 
1198 static void *FTPDataGetTx(void *state, uint64_t tx_id)
1199 {
1200  FtpDataState *ftp_state = (FtpDataState *)state;
1201  return ftp_state;
1202 }
1203 
1204 static uint64_t FTPDataGetTxCnt(void *state)
1205 {
1206  /* ftp-data is single tx */
1207  return 1;
1208 }
1209 
1210 static int FTPDataGetAlstateProgress(void *tx, uint8_t direction)
1211 {
1212  FtpDataState *ftpdata_state = (FtpDataState *)tx;
1213  if (direction == ftpdata_state->direction)
1214  return ftpdata_state->state;
1215  else
1216  return FTPDATA_STATE_FINISHED;
1217 }
1218 
1219 static AppLayerGetFileState FTPDataStateGetTxFiles(void *tx, uint8_t direction)
1220 {
1221  FtpDataState *ftpdata_state = (FtpDataState *)tx;
1222  AppLayerGetFileState files = { .fc = NULL, .cfg = &sbcfg };
1223 
1224  if (direction == ftpdata_state->direction)
1225  files.fc = ftpdata_state->files;
1226 
1227  return files;
1228 }
1229 
1230 static void FTPSetMpmState(void)
1231 {
1232  ftp_mpm_ctx = SCCalloc(1, sizeof(MpmCtx));
1233  if (unlikely(ftp_mpm_ctx == NULL)) {
1234  exit(EXIT_FAILURE);
1235  }
1236  MpmInitCtx(ftp_mpm_ctx, FTP_MPM);
1237 
1238  uint32_t i = 0;
1239  for (i = 0; i < sizeof(FtpCommands)/sizeof(FtpCommand) - 1; i++) {
1240  const FtpCommand *cmd = &FtpCommands[i];
1241  if (cmd->command_length == 0)
1242  continue;
1243 
1244  MpmAddPatternCI(ftp_mpm_ctx,
1245  (uint8_t *)cmd->command_name,
1246  cmd->command_length,
1247  0 /* defunct */, 0 /* defunct */,
1248  i /* id */, i /* rule id */ , 0 /* no flags */);
1249  }
1250 
1251  mpm_table[FTP_MPM].Prepare(ftp_mpm_ctx);
1252 
1253 }
1254 
1255 static void FTPFreeMpmState(void)
1256 {
1257  if (ftp_mpm_ctx != NULL) {
1258  mpm_table[FTP_MPM].DestroyCtx(ftp_mpm_ctx);
1259  SCFree(ftp_mpm_ctx);
1260  ftp_mpm_ctx = NULL;
1261  }
1262 }
1263 
1264 /** \brief FTP tx iterator, specialized for its linked list
1265  *
1266  * \retval txptr or NULL if no more txs in list
1267  */
1268 static AppLayerGetTxIterTuple FTPGetTxIterator(const uint8_t ipproto, const AppProto alproto,
1269  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
1270 {
1271  FtpState *ftp_state = (FtpState *)alstate;
1272  AppLayerGetTxIterTuple no_tuple = { NULL, 0, false };
1273  if (ftp_state) {
1274  FTPTransaction *tx_ptr;
1275  if (state->un.ptr == NULL) {
1276  tx_ptr = TAILQ_FIRST(&ftp_state->tx_list);
1277  } else {
1278  tx_ptr = (FTPTransaction *)state->un.ptr;
1279  }
1280  if (tx_ptr) {
1281  while (tx_ptr->tx_id < min_tx_id) {
1282  tx_ptr = TAILQ_NEXT(tx_ptr, next);
1283  if (!tx_ptr) {
1284  return no_tuple;
1285  }
1286  }
1287  if (tx_ptr->tx_id >= max_tx_id) {
1288  return no_tuple;
1289  }
1290  state->un.ptr = TAILQ_NEXT(tx_ptr, next);
1291  AppLayerGetTxIterTuple tuple = {
1292  .tx_ptr = tx_ptr,
1293  .tx_id = tx_ptr->tx_id,
1294  .has_next = (state->un.ptr != NULL),
1295  };
1296  return tuple;
1297  }
1298  }
1299  return no_tuple;
1300 }
1301 
1303 {
1304  const char *proto_name = "ftp";
1305  const char *proto_data_name = "ftp-data";
1306 
1307  /** FTP */
1308  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
1310  if (FTPRegisterPatternsForProtocolDetection() < 0 )
1311  return;
1313  }
1314 
1315  if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
1316  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOSERVER,
1317  FTPParseRequest);
1318  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOCLIENT,
1319  FTPParseResponse);
1320  AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_FTP, FTPStateAlloc, FTPStateFree);
1321  AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOSERVER | STREAM_TOCLIENT);
1322 
1323  AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_FTP, FTPStateTransactionFree);
1324 
1325  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_FTP, FTPGetTx);
1326  AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_FTP, FTPGetTxData);
1327  AppLayerParserRegisterGetTxIterator(IPPROTO_TCP, ALPROTO_FTP, FTPGetTxIterator);
1328  AppLayerParserRegisterStateDataFunc(IPPROTO_TCP, ALPROTO_FTP, FTPGetStateData);
1329 
1330  AppLayerParserRegisterLocalStorageFunc(IPPROTO_TCP, ALPROTO_FTP, FTPLocalStorageAlloc,
1331  FTPLocalStorageFree);
1332  AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_FTP, FTPGetTxCnt);
1333 
1334  AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_FTP, FTPGetAlstateProgress);
1335 
1338 
1340  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTPDATA, STREAM_TOSERVER,
1341  FTPDataParseRequest);
1342  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTPDATA, STREAM_TOCLIENT,
1343  FTPDataParseResponse);
1344  AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateAlloc, FTPDataStateFree);
1345  AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_FTPDATA, STREAM_TOSERVER | STREAM_TOCLIENT);
1346  AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateTransactionFree);
1347 
1348  AppLayerParserRegisterGetTxFilesFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateGetTxFiles);
1349 
1350  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetTx);
1351  AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetTxData);
1352  AppLayerParserRegisterStateDataFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetStateData);
1353 
1354  AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetTxCnt);
1355 
1356  AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetAlstateProgress);
1357 
1360 
1361  AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_FTP, ftp_get_event_info);
1362  AppLayerParserRegisterGetEventInfoById(IPPROTO_TCP, ALPROTO_FTP, ftp_get_event_info_by_id);
1363 
1366 
1367  sbcfg.buf_size = 4096;
1368  sbcfg.Calloc = FTPCalloc;
1369  sbcfg.Realloc = FTPRealloc;
1370  sbcfg.Free = FTPFree;
1371 
1372  FTPParseMemcap();
1373  } else {
1374  SCLogInfo("Parser disabled for %s protocol. Protocol detection still on.", proto_name);
1375  }
1376 
1377  FTPSetMpmState();
1378 
1379 #ifdef UNITTESTS
1381 #endif
1382 }
1383 
1384 /*
1385  * \brief Returns the ending offset of the next line from a multi-line buffer.
1386  *
1387  * "Buffer" refers to a FTP response in a single buffer containing multiple lines.
1388  * Here, "next line" is defined as terminating on
1389  * - Newline character
1390  * - Null character
1391  *
1392  * \param buffer Contains zero or more characters.
1393  * \param len Size, in bytes, of buffer.
1394  *
1395  * \retval Offset from the start of buffer indicating the where the
1396  * next "line ends". The characters between the input buffer and this
1397  * value comprise the line.
1398  *
1399  * NULL is found first or a newline isn't found, then UINT16_MAX is returned.
1400  */
1401 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
1402 {
1403  if (!buffer || *buffer == '\0') {
1404  return UINT16_MAX;
1405  }
1406 
1407  char *c = strchr(buffer, '\n');
1408  return c == NULL ? len : (uint16_t)(c - buffer + 1);
1409 }
1410 
1411 bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
1412 {
1413  const FtpDataState *ftp_state = (FtpDataState *)vtx;
1414  jb_open_object(jb, "ftp_data");
1415 
1416  if (ftp_state->file_name) {
1417  jb_set_string_from_bytes(jb, "filename", ftp_state->file_name, ftp_state->file_len);
1418  }
1419  switch (ftp_state->command) {
1420  case FTP_COMMAND_STOR:
1421  JB_SET_STRING(jb, "command", "STOR");
1422  break;
1423  case FTP_COMMAND_RETR:
1424  JB_SET_STRING(jb, "command", "RETR");
1425  break;
1426  default:
1427  break;
1428  }
1429  jb_close(jb);
1430  return true;
1431 }
1432 
1433 /**
1434  * \brief Free memory allocated for global FTP parser state.
1435  */
1437 {
1438  FTPFreeMpmState();
1439 }
1440 
1441 /* UNITTESTS */
1442 #ifdef UNITTESTS
1443 #include "stream-tcp.h"
1444 
1445 /** \test Send a get request in one chunk. */
1446 static int FTPParserTest01(void)
1447 {
1448  Flow f;
1449  uint8_t ftpbuf[] = "PORT 192,168,1,1,0,80\r\n";
1450  uint32_t ftplen = sizeof(ftpbuf) - 1; /* minus the \0 */
1451  TcpSession ssn;
1453 
1454  memset(&f, 0, sizeof(f));
1455  memset(&ssn, 0, sizeof(ssn));
1456 
1457  f.protoctx = (void *)&ssn;
1458  f.proto = IPPROTO_TCP;
1459  f.alproto = ALPROTO_FTP;
1460 
1461  StreamTcpInitConfig(true);
1462 
1463  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1464  STREAM_TOSERVER | STREAM_EOF, ftpbuf, ftplen);
1465  FAIL_IF(r != 0);
1466 
1467  FtpState *ftp_state = f.alstate;
1468  FAIL_IF_NULL(ftp_state);
1469  FAIL_IF(ftp_state->command != FTP_COMMAND_PORT);
1470 
1472  StreamTcpFreeConfig(true);
1473  PASS;
1474 }
1475 
1476 /** \test Supply RETR without a filename */
1477 static int FTPParserTest11(void)
1478 {
1479  Flow f;
1480  uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
1481  uint8_t ftpbuf2[] = "RETR\r\n";
1482  uint8_t ftpbuf3[] = "227 OK\r\n";
1483  TcpSession ssn;
1484 
1486 
1487  memset(&f, 0, sizeof(f));
1488  memset(&ssn, 0, sizeof(ssn));
1489 
1490  f.protoctx = (void *)&ssn;
1491  f.proto = IPPROTO_TCP;
1492  f.alproto = ALPROTO_FTP;
1493 
1494  StreamTcpInitConfig(true);
1495 
1496  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1497  STREAM_TOSERVER | STREAM_START, ftpbuf1,
1498  sizeof(ftpbuf1) - 1);
1499  FAIL_IF(r != 0);
1500 
1501  /* Response */
1502  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1503  STREAM_TOCLIENT,
1504  ftpbuf3,
1505  sizeof(ftpbuf3) - 1);
1506  FAIL_IF(r != 0);
1507 
1508  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1509  STREAM_TOSERVER, ftpbuf2,
1510  sizeof(ftpbuf2) - 1);
1511  FAIL_IF(r == 0);
1512 
1513  FtpState *ftp_state = f.alstate;
1514  FAIL_IF_NULL(ftp_state);
1515 
1516  FAIL_IF(ftp_state->command != FTP_COMMAND_RETR);
1517 
1519  StreamTcpFreeConfig(true);
1520  PASS;
1521 }
1522 
1523 /** \test Supply STOR without a filename */
1524 static int FTPParserTest12(void)
1525 {
1526  Flow f;
1527  uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
1528  uint8_t ftpbuf2[] = "STOR\r\n";
1529  uint8_t ftpbuf3[] = "227 OK\r\n";
1530  TcpSession ssn;
1531 
1533 
1534  memset(&f, 0, sizeof(f));
1535  memset(&ssn, 0, sizeof(ssn));
1536 
1537  f.protoctx = (void *)&ssn;
1538  f.proto = IPPROTO_TCP;
1539  f.alproto = ALPROTO_FTP;
1540 
1541  StreamTcpInitConfig(true);
1542 
1543  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1544  STREAM_TOSERVER | STREAM_START, ftpbuf1,
1545  sizeof(ftpbuf1) - 1);
1546  FAIL_IF(r != 0);
1547 
1548  /* Response */
1549  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1550  STREAM_TOCLIENT,
1551  ftpbuf3,
1552  sizeof(ftpbuf3) - 1);
1553  FAIL_IF(r != 0);
1554 
1555  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1556  STREAM_TOSERVER, ftpbuf2,
1557  sizeof(ftpbuf2) - 1);
1558  FAIL_IF(r == 0);
1559 
1560  FtpState *ftp_state = f.alstate;
1561  FAIL_IF_NULL(ftp_state);
1562 
1563  FAIL_IF(ftp_state->command != FTP_COMMAND_STOR);
1564 
1566  StreamTcpFreeConfig(true);
1567  PASS;
1568 }
1569 #endif /* UNITTESTS */
1570 
1572 {
1573 #ifdef UNITTESTS
1574  UtRegisterTest("FTPParserTest01", FTPParserTest01);
1575  UtRegisterTest("FTPParserTest11", FTPParserTest11);
1576  UtRegisterTest("FTPParserTest12", FTPParserTest12);
1577 #endif /* UNITTESTS */
1578 }
1579 
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:196
FTPTransaction_::request_truncated
bool request_truncated
Definition: app-layer-ftp.h:127
FTP_STATE_FINISHED
@ FTP_STATE_FINISHED
Definition: app-layer-ftp.h:33
PmqReset
void PmqReset(PrefilterRuleStore *pmq)
Reset a Pmq for reusage. Meant to be called after a single search.
Definition: util-prefilter.c:102
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:466
FTPTransaction_::command_descriptor
const FtpCommand * command_descriptor
Definition: app-layer-ftp.h:130
len
uint8_t len
Definition: app-layer-dnp3.h:2
FTP_COMMAND_USER
@ FTP_COMMAND_USER
Definition: app-layer-ftp.h:84
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
FTP_COMMAND_STAT
@ FTP_COMMAND_STAT
Definition: app-layer-ftp.h:77
FTP_COMMAND_DELE
@ FTP_COMMAND_DELE
Definition: app-layer-ftp.h:46
FTPTransaction_::request
uint8_t * request
Definition: app-layer-ftp.h:126
AppLayerGetTxIterState::ptr
void * ptr
Definition: app-layer-parser.h:145
AppLayerProtoDetectPMRegisterPatternCI
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1684
FTPThreadCtx_
Definition: app-layer-ftp.c:41
FtpTransferCmd::flow_id
uint64_t flow_id
Definition: app-layer-ftp.c:436
StreamingBufferConfig_::buf_size
uint32_t buf_size
Definition: util-streaming-buffer.h:66
FTPDATA_STATE_IN_PROGRESS
@ FTPDATA_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:167
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:424
FTP_COMMAND_ALLO
@ FTP_COMMAND_ALLO
Definition: app-layer-ftp.h:40
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
FtpState_::active
bool active
Definition: app-layer-ftp.h:146
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
FtpCommands
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
Definition: app-layer-ftp.c:51
FileContainerAlloc
FileContainer * FileContainerAlloc(void)
allocate a FileContainer
Definition: util-file.c:497
FtpDataState_::state
uint8_t state
Definition: app-layer-ftp.h:179
StreamingBufferConfig_::Calloc
void *(* Calloc)(size_t n, size_t size)
Definition: util-streaming-buffer.h:69
MpmThreadCtx_
Definition: util-mpm.h:46
stream-tcp.h
FtpState
struct FtpState_ FtpState
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
AppLayerRequestProtocolTLSUpgrade
bool AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
Definition: app-layer-detect-proto.c:1842
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
AppLayerExpectationGetFlowId
FlowStorageId AppLayerExpectationGetFlowId(void)
Definition: app-layer-expectation.c:288
PrefilterRuleStore_
structure for storing potential rule matches
Definition: util-prefilter.h:34
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:190
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FTP_COMMAND_RNFR
@ FTP_COMMAND_RNFR
Definition: app-layer-ftp.h:72
Flow_::proto
uint8_t proto
Definition: flow.h:382
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:82
FtpState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:155
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:320
ALPROTO_POP3
@ ALPROTO_POP3
Definition: app-layer-protos.h:64
STREAMING_BUFFER_CONFIG_INITIALIZER
#define STREAMING_BUFFER_CONFIG_INITIALIZER
Definition: util-streaming-buffer.h:74
FileContainerFree
void FileContainerFree(FileContainer *ffc, const StreamingBufferConfig *cfg)
Free a FileContainer.
Definition: util-file.c:533
Flow_
Flow data structure.
Definition: flow.h:360
FTPTransaction_::done
bool done
Definition: app-layer-ftp.h:133
FTP_COMMAND_MSND
@ FTP_COMMAND_MSND
Definition: app-layer-ftp.h:59
FTP_COMMAND_EPSV
@ FTP_COMMAND_EPSV
Definition: app-layer-ftp.h:47
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:518
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:390
FTP_COMMAND_RNTO
@ FTP_COMMAND_RNTO
Definition: app-layer-ftp.h:73
FtpState_::current_line_truncated_tc
bool current_line_truncated_tc
Definition: app-layer-ftp.h:153
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:477
FTP_COMMAND_MODE
@ FTP_COMMAND_MODE
Definition: app-layer-ftp.h:55
FTPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:122
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
FTP_COMMAND_RMD
@ FTP_COMMAND_RMD
Definition: app-layer-ftp.h:71
FtpDataState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:178
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:165
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:300
FTP_COMMAND_ABOR
@ FTP_COMMAND_ABOR
Definition: app-layer-ftp.h:38
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
rust.h
MIN
#define MIN(x, y)
Definition: suricata-common.h:391
FTP_COMMAND_MKD
@ FTP_COMMAND_MKD
Definition: app-layer-ftp.h:53
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:133
FtpLineState_::buf
const uint8_t * buf
Definition: app-layer-ftp.h:105
FtpCommand_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:94
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:31
FTP_COMMAND_LIST
@ FTP_COMMAND_LIST
Definition: app-layer-ftp.h:50
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
FtpCommand_::command_name
const char * command_name
Definition: app-layer-ftp.h:93
FtpDataState_::file_len
int16_t file_len
Definition: app-layer-ftp.h:177
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
app-layer-ftp.h
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
Flow_::protoctx
void * protoctx
Definition: flow.h:450
FTPString_::len
uint32_t len
Definition: app-layer-ftp.h:113
FtpDataState_::direction
uint8_t direction
Definition: app-layer-ftp.h:180
FtpInput_::len
int32_t len
Definition: app-layer-ftp.c:343
SC_ELIMIT
@ SC_ELIMIT
Definition: util-error.h:31
FtpTransferCmd::file_len
uint16_t file_len
Definition: app-layer-ftp.c:438
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, ftp_memuse)
SC_ENOMEM
@ SC_ENOMEM
Definition: util-error.h:29
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1436
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
Definition: app-layer-ftp.c:1411
FTP_COMMAND_HELP
@ FTP_COMMAND_HELP
Definition: app-layer-ftp.h:48
FTP_COMMAND_SIZE
@ FTP_COMMAND_SIZE
Definition: app-layer-ftp.h:75
FTPString_::truncated
bool truncated
Definition: app-layer-ftp.h:114
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:210
ftp_max_line_len
uint32_t ftp_max_line_len
Definition: app-layer-ftp.c:109
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
FTP_COMMAND_CWD
@ FTP_COMMAND_CWD
Definition: app-layer-ftp.h:45
FTP_COMMAND_MSAM
@ FTP_COMMAND_MSAM
Definition: app-layer-ftp.h:58
FTP_COMMAND_SITE
@ FTP_COMMAND_SITE
Definition: app-layer-ftp.h:74
FtpState_
Definition: app-layer-ftp.h:145
app-layer-expectation.h
app-layer-detect-proto.h
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:461
FTPDATA_STATE_FINISHED
@ FTPDATA_STATE_FINISHED
Definition: app-layer-ftp.h:168
FTP_COMMAND_STOU
@ FTP_COMMAND_STOU
Definition: app-layer-ftp.h:79
APP_LAYER_INCOMPLETE
#define APP_LAYER_INCOMPLETE(c, n)
Definition: app-layer-parser.h:99
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:203
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:26
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
FtpState_::port_line
uint8_t * port_line
Definition: app-layer-ftp.h:159
AppLayerParserState_
Definition: app-layer-parser.c:129
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FTP_COMMAND_APPE
@ FTP_COMMAND_APPE
Definition: app-layer-ftp.h:41
FTPThreadCtx_::pmq
PrefilterRuleStore * pmq
Definition: app-layer-ftp.c:43
SC_FILENAME_MAX
#define SC_FILENAME_MAX
Definition: util-file.h:62
FtpState_::curr_tx
FTPTransaction * curr_tx
Definition: app-layer-ftp.h:148
FTP_COMMAND_TYPE
@ FTP_COMMAND_TYPE
Definition: app-layer-ftp.h:82
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
FtpDataState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:182
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:22
AppLayerParserRegisterLogger
void AppLayerParserRegisterLogger(uint8_t ipproto, AppProto alproto)
Definition: app-layer-parser.c:457
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
FTP_COMMAND_PORT
@ FTP_COMMAND_PORT
Definition: app-layer-ftp.h:65
FTP_COMMAND_MAX
@ FTP_COMMAND_MAX
Definition: app-layer-ftp.h:88
FTP_COMMAND_REIN
@ FTP_COMMAND_REIN
Definition: app-layer-ftp.h:68
FtpTransferCmd::cmd
FtpRequestCommand cmd
Definition: app-layer-ftp.c:440
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:411
AppLayerProtoDetectPMRegisterPatternCSwPP
int AppLayerProtoDetectPMRegisterPatternCSwPP(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction, ProbingParserFPtr PPFunc, uint16_t pp_min_depth, uint16_t pp_max_depth)
Definition: app-layer-detect-proto.c:1670
FtpLineState_::lf_found
bool lf_found
Definition: app-layer-ftp.h:108
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
FtpState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:163
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
FTPParserRegisterTests
void FTPParserRegisterTests(void)
Definition: app-layer-ftp.c:1571
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1302
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1836
AppLayerExpectationCreate
int AppLayerExpectationCreate(Flow *f, int direction, Port src, Port dst, AppProto alproto, void *data)
Definition: app-layer-expectation.c:219
AppLayerGetTxIterState
Definition: app-layer-parser.h:143
FtpCommand_
Definition: app-layer-ftp.h:92
FtpTransferCmd
Definition: app-layer-ftp.c:432
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
ftp_config_memcap
uint64_t ftp_config_memcap
Definition: app-layer-ftp.c:107
FTP_COMMAND_CHMOD
@ FTP_COMMAND_CHMOD
Definition: app-layer-ftp.h:44
AppLayerRegisterExpectationProto
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
Definition: app-layer-detect-proto.c:2108
MpmTableElmt_::Prepare
int(* Prepare)(struct MpmCtx_ *)
Definition: util-mpm.h:166
FTP_COMMAND_SYST
@ FTP_COMMAND_SYST
Definition: app-layer-ftp.h:81
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:555
FileOpenFileWithId
int FileOpenFileWithId(FileContainer *ffc, const StreamingBufferConfig *sbcfg, uint32_t track_id, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Open a new File.
Definition: util-file.c:984
AppLayerParserRegisterGetTxFilesFunc
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, uint8_t))
Definition: app-layer-parser.c:438
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1761
FtpDataState
struct FtpDataState_ FtpDataState
FTP_COMMAND_ACCT
@ FTP_COMMAND_ACCT
Definition: app-layer-ftp.h:39
FileAppendData
int FileAppendData(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The last file in the FileContainer will be us...
Definition: util-file.c:783
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:171
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:168
FTP_COMMAND_MRSQ
@ FTP_COMMAND_MRSQ
Definition: app-layer-ftp.h:57
FtpInput
struct FtpInput_ FtpInput
FtpDataState_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:181
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:378
FtpInput_::orig_len
int32_t orig_len
Definition: app-layer-ftp.c:344
DetectEngineStateFree
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:169
FtpTransferCmd::direction
uint8_t direction
Definition: app-layer-ftp.c:439
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:279
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:499
APP_LAYER_OK
#define APP_LAYER_OK
Definition: app-layer-parser.h:87
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1364
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
SCReturnStruct
#define SCReturnStruct(x)
Definition: util-debug.h:291
FTPTransaction_::request_length
uint32_t request_length
Definition: app-layer-ftp.h:125
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
util-mpm.h
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:792
flags
uint8_t flags
Definition: decode-gre.h:0
FTP_COMMAND_NOOP
@ FTP_COMMAND_NOOP
Definition: app-layer-ftp.h:62
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1266
FtpLineState_
Definition: app-layer-ftp.h:102
FTP_COMMAND_CDUP
@ FTP_COMMAND_CDUP
Definition: app-layer-ftp.h:43
suricata-common.h
ftp_config_maxtx
uint32_t ftp_config_maxtx
Definition: app-layer-ftp.c:108
FTP_COMMAND_PASS
@ FTP_COMMAND_PASS
Definition: app-layer-ftp.h:63
AppLayerDecoderEventsSetEventRaw
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:91
FtpState_::port_line_len
uint32_t port_line_len
Definition: app-layer-ftp.h:157
FtpState_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:161
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
AppLayerParserRegisterStateDataFunc
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
Definition: app-layer-parser.c:577
FtpTransferCmd::DFree
void(* DFree)(void *)
Definition: app-layer-ftp.c:435
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:567
Flow_::parent_id
int64_t parent_id
Definition: flow.h:439
FTP_COMMAND_MRCP
@ FTP_COMMAND_MRCP
Definition: app-layer-ftp.h:56
FtpDataState_
Definition: app-layer-ftp.h:172
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:173
FTP_COMMAND_PWD
@ FTP_COMMAND_PWD
Definition: app-layer-ftp.h:66
util-validate.h
FTP_COMMAND_STRU
@ FTP_COMMAND_STRU
Definition: app-layer-ftp.h:80
StreamingBufferConfig_
Definition: util-streaming-buffer.h:65
FTP_COMMAND_UNKNOWN
@ FTP_COMMAND_UNKNOWN
Definition: app-layer-ftp.h:37
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FTP_COMMAND_MAIL
@ FTP_COMMAND_MAIL
Definition: app-layer-ftp.h:51
FTP_COMMAND_UMASK
@ FTP_COMMAND_UMASK
Definition: app-layer-ftp.h:83
FtpLineState_::delim_len
uint8_t delim_len
Definition: app-layer-ftp.h:107
str
#define str(s)
Definition: suricata-common.h:291
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:510
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:150
FlowFreeStorageById
void FlowFreeStorageById(Flow *f, FlowStorageId id)
Definition: flow-storage.c:55
FileCloseFile
int FileCloseFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *data, uint32_t data_len, uint16_t flags)
Close a File.
Definition: util-file.c:1080
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alstate
void * alstate
Definition: flow.h:485
StreamingBufferConfig_::Free
void(* Free)(void *ptr, size_t size)
Definition: util-streaming-buffer.h:71
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:533
FtpState_::tx_cnt
uint64_t tx_cnt
Definition: app-layer-ftp.h:150
FtpState_::current_line_truncated_ts
bool current_line_truncated_ts
Definition: app-layer-ftp.h:152
sc_errno
thread_local SCError sc_errno
Definition: util-error.c:31
FTP_STATE_IN_PROGRESS
@ FTP_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:31
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:72
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
FTP_COMMAND_IDLE
@ FTP_COMMAND_IDLE
Definition: app-layer-ftp.h:49
FTP_STATE_PORT_DONE
@ FTP_STATE_PORT_DONE
Definition: app-layer-ftp.h:32
FtpLineState_::len
uint32_t len
Definition: app-layer-ftp.h:106
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:488
APP_LAYER_ERROR
#define APP_LAYER_ERROR
Definition: app-layer-parser.h:91
FtpState_::port_line_size
uint32_t port_line_size
Definition: app-layer-ftp.h:158
FTP_COMMAND_RETR
@ FTP_COMMAND_RETR
Definition: app-layer-ftp.h:70
PmqFree
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
Definition: util-prefilter.c:126
FTP_MPM
#define FTP_MPM
Definition: app-layer-ftp.c:46
FTPTransaction_::tx_id
uint64_t tx_id
Definition: app-layer-ftp.h:120
FTPTransaction_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:132
FTPTransaction_::active
bool active
Definition: app-layer-ftp.h:134
FTP_COMMAND_STOR
@ FTP_COMMAND_STOR
Definition: app-layer-ftp.h:78
FtpDataState_::files
FileContainer * files
Definition: app-layer-ftp.h:175
likely
#define likely(expr)
Definition: util-optimize.h:32
FTP_COMMAND_MSOM
@ FTP_COMMAND_MSOM
Definition: app-layer-ftp.h:60
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:58
FTP_COMMAND_EPRT
@ FTP_COMMAND_EPRT
Definition: app-layer-ftp.h:85
FTPString_
Definition: app-layer-ftp.h:111
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
MpmCtx_
Definition: util-mpm.h:88
TcpSession_
Definition: stream-tcp-private.h:283
JsonGetNextLineFromBuffer
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
Definition: app-layer-ftp.c:1401
util-misc.h
FtpRequestCommand
FtpRequestCommand
Definition: app-layer-ftp.h:36
FileFlowFlagsToFlags
uint16_t FileFlowFlagsToFlags(const uint16_t flow_file_flags, uint8_t direction)
Definition: util-file.c:233
FTPTransaction_
Definition: app-layer-ftp.h:118
FTPThreadCtx
struct FTPThreadCtx_ FTPThreadCtx
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1771
Flow_::alproto_tc
AppProto alproto_tc
Definition: flow.h:461
FtpInput_::buf
const uint8_t * buf
Definition: app-layer-ftp.c:341
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:459
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FTP_COMMAND_REST
@ FTP_COMMAND_REST
Definition: app-layer-ftp.h:69
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
AppLayerGetTxIterState::un
union AppLayerGetTxIterState::@11 un
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:259
SCMemcmp
#define SCMemcmp(a, b, c)
Definition: util-memcmp.h:290
FTP_COMMAND_PASV
@ FTP_COMMAND_PASV
Definition: app-layer-ftp.h:64
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1936
FTP_COMMAND_AUTH_TLS
@ FTP_COMMAND_AUTH_TLS
Definition: app-layer-ftp.h:42
SCMutex
#define SCMutex
Definition: threads-debug.h:114
FTPString_::str
uint8_t * str
Definition: app-layer-ftp.h:112
FTPThreadCtx_::ftp_mpm_thread_ctx
MpmThreadCtx * ftp_mpm_thread_ctx
Definition: app-layer-ftp.c:42
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
FtpInput_::consumed
int32_t consumed
Definition: app-layer-ftp.c:342
FTP_COMMAND_NLST
@ FTP_COMMAND_NLST
Definition: app-layer-ftp.h:61
PmqSetup
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
Definition: util-prefilter.c:37
FTP_COMMAND_MDTM
@ FTP_COMMAND_MDTM
Definition: app-layer-ftp.h:52
FTP_COMMAND_SMNT
@ FTP_COMMAND_SMNT
Definition: app-layer-ftp.h:76
FTP_COMMAND_QUIT
@ FTP_COMMAND_QUIT
Definition: app-layer-ftp.h:67
StreamingBufferConfig_::Realloc
void *(* Realloc)(void *ptr, size_t orig_size, size_t size)
Definition: util-streaming-buffer.h:70
FtpDataState_::file_name
uint8_t * file_name
Definition: app-layer-ftp.h:174
FtpInput_
Definition: app-layer-ftp.c:340
FTP_COMMAND_MLFL
@ FTP_COMMAND_MLFL
Definition: app-layer-ftp.h:54
FtpTransferCmd::file_name
uint8_t * file_name
Definition: app-layer-ftp.c:437
app-layer.h
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38