suricata
app-layer-ftp.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Eric Leblond <eric@regit.org>
23  * \author Jeff Lucovsky <jeff@lucovsky.org>
24  *
25  * App Layer Parser for FTP
26  */
27 
28 #include "suricata-common.h"
29 #include "app-layer-ftp.h"
30 #include "app-layer.h"
31 #include "app-layer-parser.h"
32 #include "app-layer-expectation.h"
33 #include "app-layer-detect-proto.h"
34 
35 #include "rust.h"
36 
37 #include "util-misc.h"
38 #include "util-mpm.h"
39 #include "util-validate.h"
40 
41 typedef struct FTPThreadCtx_ {
45 
46 #define FTP_MPM mpm_default_matcher
47 
48 static MpmCtx *ftp_mpm_ctx = NULL;
49 
50 // clang-format off
52  /* Parsed and handled */
53  { "PORT", FTP_COMMAND_PORT, 4 },
54  { "EPRT", FTP_COMMAND_EPRT, 4 },
55  { "AUTH TLS", FTP_COMMAND_AUTH_TLS, 8 },
56  { "PASV", FTP_COMMAND_PASV, 4 },
57  { "RETR", FTP_COMMAND_RETR, 4 },
58  { "EPSV", FTP_COMMAND_EPSV, 4 },
59  { "STOR", FTP_COMMAND_STOR, 4 },
60 
61  /* Parsed, but not handled */
62  { "ABOR", FTP_COMMAND_ABOR, 4 },
63  { "ACCT", FTP_COMMAND_ACCT, 4 },
64  { "ALLO", FTP_COMMAND_ALLO, 4 },
65  { "APPE", FTP_COMMAND_APPE, 4 },
66  { "CDUP", FTP_COMMAND_CDUP, 4 },
67  { "CHMOD", FTP_COMMAND_CHMOD, 5 },
68  { "CWD", FTP_COMMAND_CWD, 3 },
69  { "DELE", FTP_COMMAND_DELE, 4 },
70  { "HELP", FTP_COMMAND_HELP, 4 },
71  { "IDLE", FTP_COMMAND_IDLE, 4 },
72  { "LIST", FTP_COMMAND_LIST, 4 },
73  { "MAIL", FTP_COMMAND_MAIL, 4 },
74  { "MDTM", FTP_COMMAND_MDTM, 4 },
75  { "MKD", FTP_COMMAND_MKD, 3 },
76  { "MLFL", FTP_COMMAND_MLFL, 4 },
77  { "MODE", FTP_COMMAND_MODE, 4 },
78  { "MRCP", FTP_COMMAND_MRCP, 4 },
79  { "MRSQ", FTP_COMMAND_MRSQ, 4 },
80  { "MSAM", FTP_COMMAND_MSAM, 4 },
81  { "MSND", FTP_COMMAND_MSND, 4 },
82  { "MSOM", FTP_COMMAND_MSOM, 4 },
83  { "NLST", FTP_COMMAND_NLST, 4 },
84  { "NOOP", FTP_COMMAND_NOOP, 4 },
85  { "PASS", FTP_COMMAND_PASS, 4 },
86  { "PWD", FTP_COMMAND_PWD, 3 },
87  { "QUIT", FTP_COMMAND_QUIT, 4 },
88  { "REIN", FTP_COMMAND_REIN, 4 },
89  { "REST", FTP_COMMAND_REST, 4 },
90  { "RMD", FTP_COMMAND_RMD, 3 },
91  { "RNFR", FTP_COMMAND_RNFR, 4 },
92  { "RNTO", FTP_COMMAND_RNTO, 4 },
93  { "SITE", FTP_COMMAND_SITE, 4 },
94  { "SIZE", FTP_COMMAND_SIZE, 4 },
95  { "SMNT", FTP_COMMAND_SMNT, 4 },
96  { "STAT", FTP_COMMAND_STAT, 4 },
97  { "STOU", FTP_COMMAND_STOU, 4 },
98  { "STRU", FTP_COMMAND_STRU, 4 },
99  { "SYST", FTP_COMMAND_SYST, 4 },
100  { "TYPE", FTP_COMMAND_TYPE, 4 },
101  { "UMASK", FTP_COMMAND_UMASK, 5 },
102  { "USER", FTP_COMMAND_USER, 4 },
103  { NULL, FTP_COMMAND_UNKNOWN, 0 }
104 };
105 // clang-format on
106 
107 uint64_t ftp_config_memcap = 0;
108 uint32_t ftp_config_maxtx = 1024;
109 uint32_t ftp_max_line_len = 4096;
110 
111 SC_ATOMIC_DECLARE(uint64_t, ftp_memuse);
112 SC_ATOMIC_DECLARE(uint64_t, ftp_memcap);
113 
114 static FTPTransaction *FTPGetOldestTx(const FtpState *, FTPTransaction *);
115 
116 static void FTPParseMemcap(void)
117 {
118  const char *conf_val;
119 
120  /** set config values for memcap, prealloc and hash_size */
121  if ((ConfGet("app-layer.protocols.ftp.memcap", &conf_val)) == 1)
122  {
123  if (ParseSizeStringU64(conf_val, &ftp_config_memcap) < 0) {
124  SCLogError("Error parsing ftp.memcap "
125  "from conf file - %s. Killing engine",
126  conf_val);
127  exit(EXIT_FAILURE);
128  }
129  SCLogInfo("FTP memcap: %"PRIu64, ftp_config_memcap);
130  } else {
131  /* default to unlimited */
132  ftp_config_memcap = 0;
133  }
134 
135  SC_ATOMIC_INIT(ftp_memuse);
136  SC_ATOMIC_INIT(ftp_memcap);
137 
138  if ((ConfGet("app-layer.protocols.ftp.max-tx", &conf_val)) == 1) {
139  if (ParseSizeStringU32(conf_val, &ftp_config_maxtx) < 0) {
140  SCLogError("Error parsing ftp.max-tx "
141  "from conf file - %s.",
142  conf_val);
143  }
144  SCLogInfo("FTP max tx: %" PRIu32, ftp_config_maxtx);
145  }
146 
147  if ((ConfGet("app-layer.protocols.ftp.max-line-length", &conf_val)) == 1) {
148  if (ParseSizeStringU32(conf_val, &ftp_max_line_len) < 0) {
149  SCLogError("Error parsing ftp.max-line-length from conf file - %s.", conf_val);
150  }
151  SCLogConfig("FTP max line length: %" PRIu32, ftp_max_line_len);
152  }
153 }
154 
155 static void FTPIncrMemuse(uint64_t size)
156 {
157  (void) SC_ATOMIC_ADD(ftp_memuse, size);
158  return;
159 }
160 
161 static void FTPDecrMemuse(uint64_t size)
162 {
163  (void) SC_ATOMIC_SUB(ftp_memuse, size);
164  return;
165 }
166 
168 {
169  uint64_t tmpval = SC_ATOMIC_GET(ftp_memuse);
170  return tmpval;
171 }
172 
174 {
175  uint64_t tmpval = SC_ATOMIC_GET(ftp_memcap);
176  return tmpval;
177 }
178 
179 /**
180  * \brief Check if alloc'ing "size" would mean we're over memcap
181  *
182  * \retval 1 if in bounds
183  * \retval 0 if not in bounds
184  */
185 static int FTPCheckMemcap(uint64_t size)
186 {
187  if (ftp_config_memcap == 0 || size + SC_ATOMIC_GET(ftp_memuse) <= ftp_config_memcap)
188  return 1;
189  (void) SC_ATOMIC_ADD(ftp_memcap, 1);
190  return 0;
191 }
192 
193 static void *FTPCalloc(size_t n, size_t size)
194 {
195  if (FTPCheckMemcap((uint32_t)(n * size)) == 0)
196  return NULL;
197 
198  void *ptr = SCCalloc(n, size);
199 
200  if (unlikely(ptr == NULL))
201  return NULL;
202 
203  FTPIncrMemuse((uint64_t)(n * size));
204  return ptr;
205 }
206 
207 static void *FTPRealloc(void *ptr, size_t orig_size, size_t size)
208 {
209  void *rptr = NULL;
210 
211  if (FTPCheckMemcap((uint32_t)(size - orig_size)) == 0)
212  return NULL;
213 
214  rptr = SCRealloc(ptr, size);
215  if (rptr == NULL)
216  return NULL;
217 
218  if (size > orig_size) {
219  FTPIncrMemuse(size - orig_size);
220  } else {
221  FTPDecrMemuse(orig_size - size);
222  }
223 
224  return rptr;
225 }
226 
227 static void FTPFree(void *ptr, size_t size)
228 {
229  SCFree(ptr);
230 
231  FTPDecrMemuse((uint64_t)size);
232 }
233 
234 static FTPString *FTPStringAlloc(void)
235 {
236  return FTPCalloc(1, sizeof(FTPString));
237 }
238 
239 static void FTPStringFree(FTPString *str)
240 {
241  if (str->str) {
242  FTPFree(str->str, str->len);
243  }
244 
245  FTPFree(str, sizeof(FTPString));
246 }
247 
248 static void *FTPLocalStorageAlloc(void)
249 {
250  /* needed by the mpm */
251  FTPThreadCtx *td = SCCalloc(1, sizeof(*td));
252  if (td == NULL) {
253  exit(EXIT_FAILURE);
254  }
255 
256  td->pmq = SCCalloc(1, sizeof(*td->pmq));
257  if (td->pmq == NULL) {
258  exit(EXIT_FAILURE);
259  }
260  PmqSetup(td->pmq);
261 
262  td->ftp_mpm_thread_ctx = SCCalloc(1, sizeof(MpmThreadCtx));
263  if (unlikely(td->ftp_mpm_thread_ctx == NULL)) {
264  exit(EXIT_FAILURE);
265  }
267  return td;
268 }
269 
270 static void FTPLocalStorageFree(void *ptr)
271 {
272  FTPThreadCtx *td = ptr;
273  if (td != NULL) {
274  if (td->pmq != NULL) {
275  PmqFree(td->pmq);
276  SCFree(td->pmq);
277  }
278 
279  if (td->ftp_mpm_thread_ctx != NULL) {
282  }
283 
284  SCFree(td);
285  }
286 
287  return;
288 }
289 static FTPTransaction *FTPTransactionCreate(FtpState *state)
290 {
291  SCEnter();
292  FTPTransaction *firsttx = TAILQ_FIRST(&state->tx_list);
293  if (firsttx && state->tx_cnt - firsttx->tx_id > ftp_config_maxtx) {
294  // FTP does not set events yet...
295  return NULL;
296  }
297  FTPTransaction *tx = FTPCalloc(1, sizeof(*tx));
298  if (tx == NULL) {
299  return NULL;
300  }
301 
302  TAILQ_INSERT_TAIL(&state->tx_list, tx, next);
303  tx->tx_id = state->tx_cnt++;
304 
305  TAILQ_INIT(&tx->response_list);
306 
307  SCLogDebug("new transaction %p (state tx cnt %"PRIu64")", tx, state->tx_cnt);
308  return tx;
309 }
310 
311 static void FTPTransactionFree(FTPTransaction *tx)
312 {
313  SCEnter();
314 
315  if (tx->tx_data.de_state != NULL) {
316  DetectEngineStateFree(tx->tx_data.de_state);
317  }
318 
319  if (tx->request) {
320  FTPFree(tx->request, tx->request_length);
321  }
322 
323  FTPString *str = NULL;
324  while ((str = TAILQ_FIRST(&tx->response_list))) {
325  TAILQ_REMOVE(&tx->response_list, str, next);
326  FTPStringFree(str);
327  }
328 
329  if (tx->tx_data.events) {
331  }
332 
333  FTPFree(tx, sizeof(*tx));
334 }
335 
336 typedef struct FtpInput_ {
337  const uint8_t *buf;
338  int32_t consumed;
339  int32_t len;
340  int32_t orig_len;
342 
343 static AppLayerResult FTPGetLineForDirection(
344  FtpState *state, FtpLineState *line, FtpInput *input, bool *current_line_truncated)
345 {
346  SCEnter();
347 
348  /* we have run out of input */
349  if (input->len <= 0)
350  return APP_LAYER_ERROR;
351 
352  uint8_t *lf_idx = memchr(input->buf + input->consumed, 0x0a, input->len);
353 
354  if (lf_idx == NULL) {
355  if (!(*current_line_truncated) && (uint32_t)input->len >= ftp_max_line_len) {
356  *current_line_truncated = true;
357  line->buf = input->buf;
358  line->len = ftp_max_line_len;
359  line->delim_len = 0;
360  input->len = 0;
362  }
363  SCReturnStruct(APP_LAYER_INCOMPLETE(input->consumed, input->len + 1));
364  } else if (*current_line_truncated) {
365  // Whatever came in with first LF should also get discarded
366  *current_line_truncated = false;
367  line->len = 0;
368  line->delim_len = 0;
369  input->len = 0;
371  } else {
372  // There could be one chunk of command data that has LF but post the line limit
373  // e.g. input_len = 5077
374  // lf_idx = 5010
375  // max_line_len = 4096
376  uint32_t o_consumed = input->consumed;
377  input->consumed = lf_idx - input->buf + 1;
378  line->len = input->consumed - o_consumed;
379  input->len -= line->len;
380  line->lf_found = true;
381  DEBUG_VALIDATE_BUG_ON((input->consumed + input->len) != input->orig_len);
382  line->buf = input->buf + o_consumed;
383  if (line->len >= ftp_max_line_len) {
384  *current_line_truncated = true;
385  line->len = ftp_max_line_len;
387  }
388  if (input->consumed >= 2 && input->buf[input->consumed - 2] == 0x0D) {
389  line->delim_len = 2;
390  line->len -= 2;
391  } else {
392  line->delim_len = 1;
393  line->len -= 1;
394  }
396  }
397 }
398 
399 /**
400  * \brief This function is called to determine and set which command is being
401  * transferred to the ftp server
402  * \param thread context
403  * \param input input line of the command
404  * \param len of the command
405  * \param cmd_descriptor when the command has been parsed
406  *
407  * \retval 1 when the command is parsed, 0 otherwise
408  */
409 static int FTPParseRequestCommand(
410  FTPThreadCtx *td, FtpLineState *line, const FtpCommand **cmd_descriptor)
411 {
412  SCEnter();
413 
414  /* I don't like this pmq reset here. We'll devise a method later, that
415  * should make the use of the mpm very efficient */
416  PmqReset(td->pmq);
417  int mpm_cnt = mpm_table[FTP_MPM].Search(
418  ftp_mpm_ctx, td->ftp_mpm_thread_ctx, td->pmq, line->buf, line->len);
419  if (mpm_cnt) {
420  *cmd_descriptor = &FtpCommands[td->pmq->rule_id_array[0]];
421  SCReturnInt(1);
422  }
423 
424  *cmd_descriptor = NULL;
425  SCReturnInt(0);
426 }
427 
429  /** Need to look like a ExpectationData so DFree must
430  * be first field . */
431  void (*DFree)(void *);
432  uint64_t flow_id;
433  uint8_t *file_name;
434  uint16_t file_len;
435  uint8_t direction; /**< direction in which the data will flow */
437 };
438 
439 static void FtpTransferCmdFree(void *data)
440 {
441  struct FtpTransferCmd *cmd = (struct FtpTransferCmd *) data;
442  if (cmd == NULL)
443  return;
444  if (cmd->file_name) {
445  FTPFree(cmd->file_name, cmd->file_len + 1);
446  }
447  FTPFree(cmd, sizeof(struct FtpTransferCmd));
448 }
449 
450 static uint32_t CopyCommandLine(uint8_t **dest, FtpLineState *line)
451 {
452  if (likely(line->len)) {
453  uint8_t *where = FTPCalloc(line->len + 1, sizeof(char));
454  if (unlikely(where == NULL)) {
455  return 0;
456  }
457  memcpy(where, line->buf, line->len);
458 
459  /* Remove trailing newlines/carriage returns */
460  while (line->len && isspace((unsigned char)where[line->len - 1])) {
461  line->len--;
462  }
463 
464  where[line->len] = '\0';
465  *dest = where;
466  }
467  /* either 0 or actual */
468  return line->len ? line->len + 1 : 0;
469 }
470 
471 #include "util-print.h"
472 
473 /**
474  * \brief This function is called to retrieve a ftp request
475  * \param ftp_state the ftp state structure for the parser
476  *
477  * \retval APP_LAYER_OK when input was process successfully
478  * \retval APP_LAYER_ERROR when a unrecoverable error was encountered
479  */
480 static AppLayerResult FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserState *pstate,
481  StreamSlice stream_slice, void *local_data)
482 {
483  FTPThreadCtx *thread_data = local_data;
484 
485  SCEnter();
486  /* PrintRawDataFp(stdout, input,input_len); */
487 
488  FtpState *state = (FtpState *)ftp_state;
489  void *ptmp;
490 
491  const uint8_t *input = StreamSliceGetData(&stream_slice);
492  uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
493 
494  if (input == NULL && AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS)) {
496  } else if (input == NULL || input_len == 0) {
498  }
499 
500  FtpInput ftpi = { .buf = input, .len = input_len, .orig_len = input_len, .consumed = 0 };
501  FtpLineState line = { .buf = NULL, .len = 0, .delim_len = 0, .lf_found = false };
502 
503  uint8_t direction = STREAM_TOSERVER;
504  AppLayerResult res;
505  while (1) {
506  res = FTPGetLineForDirection(state, &line, &ftpi, &state->current_line_truncated_ts);
507  if (res.status == 1) {
508  return res;
509  } else if (res.status == -1) {
510  break;
511  }
512  const FtpCommand *cmd_descriptor;
513 
514  if (!FTPParseRequestCommand(thread_data, &line, &cmd_descriptor)) {
515  state->command = FTP_COMMAND_UNKNOWN;
516  continue;
517  }
518 
519  state->command = cmd_descriptor->command;
520  FTPTransaction *tx = FTPTransactionCreate(state);
521  if (unlikely(tx == NULL))
523  state->curr_tx = tx;
524 
525  tx->command_descriptor = cmd_descriptor;
526  tx->request_length = CopyCommandLine(&tx->request, &line);
528 
529  if (line.lf_found) {
530  state->current_line_truncated_ts = false;
531  }
532  if (tx->request_truncated) {
533  AppLayerDecoderEventsSetEventRaw(&tx->tx_data.events, FtpEventRequestCommandTooLong);
534  }
535 
536  /* change direction (default to server) so expectation will handle
537  * the correct message when expectation will match.
538  * For ftp active mode, data connection direction is opposite to
539  * control direction.
540  */
541  if ((state->active && state->command == FTP_COMMAND_STOR) ||
542  (!state->active && state->command == FTP_COMMAND_RETR)) {
543  direction = STREAM_TOCLIENT;
544  }
545 
546  switch (state->command) {
547  case FTP_COMMAND_EPRT:
548  // fallthrough
549  case FTP_COMMAND_PORT:
550  if (line.len + 1 > state->port_line_size) {
551  /* Allocate an extra byte for a NULL terminator */
552  ptmp = FTPRealloc(state->port_line, state->port_line_size, line.len);
553  if (ptmp == NULL) {
554  if (state->port_line) {
555  FTPFree(state->port_line, state->port_line_size);
556  state->port_line = NULL;
557  state->port_line_size = 0;
558  state->port_line_len = 0;
559  }
561  }
562  state->port_line = ptmp;
563  state->port_line_size = line.len;
564  }
565  memcpy(state->port_line, line.buf, line.len);
566  state->port_line_len = line.len;
567  break;
568  case FTP_COMMAND_RETR:
569  // fallthrough
570  case FTP_COMMAND_STOR: {
571  /* Ensure that there is a negotiated dyn port and a file
572  * name -- need more than 5 chars: cmd [4], space, <filename>
573  */
574  if (state->dyn_port == 0 || line.len < 6) {
576  }
577  struct FtpTransferCmd *data = FTPCalloc(1, sizeof(struct FtpTransferCmd));
578  if (data == NULL)
580  data->DFree = FtpTransferCmdFree;
581  /*
582  * Min size has been checked in FTPParseRequestCommand
583  * SC_FILENAME_MAX includes the null
584  */
585  uint32_t file_name_len = MIN(SC_FILENAME_MAX - 1, line.len - 5);
586 #if SC_FILENAME_MAX > UINT16_MAX
587 #error SC_FILENAME_MAX is greater than UINT16_MAX
588 #endif
589  data->file_name = FTPCalloc(file_name_len + 1, sizeof(char));
590  if (data->file_name == NULL) {
591  FtpTransferCmdFree(data);
593  }
594  data->file_name[file_name_len] = 0;
595  data->file_len = (uint16_t)file_name_len;
596  memcpy(data->file_name, line.buf + 5, file_name_len);
597  data->cmd = state->command;
598  data->flow_id = FlowGetId(f);
599  data->direction = direction;
601  0, state->dyn_port, ALPROTO_FTPDATA, data);
602  if (ret == -1) {
603  FtpTransferCmdFree(data);
604  SCLogDebug("No expectation created.");
606  } else {
607  SCLogDebug("Expectation created [direction: %s, dynamic port %"PRIu16"].",
608  state->active ? "to server" : "to client",
609  state->dyn_port);
610  }
611 
612  /* reset the dyn port to avoid duplicate */
613  state->dyn_port = 0;
614  /* reset active/passive indicator */
615  state->active = false;
616  } break;
617  default:
618  break;
619  }
620  if (line.len >= ftp_max_line_len) {
621  ftpi.consumed = ftpi.len + 1;
622  break;
623  }
624  }
625 
627 }
628 
629 static int FTPParsePassiveResponse(Flow *f, FtpState *state, const uint8_t *input, uint32_t input_len)
630 {
631  uint16_t dyn_port = rs_ftp_pasv_response(input, input_len);
632  if (dyn_port == 0) {
633  return -1;
634  }
635  SCLogDebug("FTP passive mode (v4): dynamic port %"PRIu16"", dyn_port);
636  state->active = false;
637  state->dyn_port = dyn_port;
638  state->curr_tx->dyn_port = dyn_port;
639  state->curr_tx->active = false;
640 
641  return 0;
642 }
643 
644 static int FTPParsePassiveResponseV6(Flow *f, FtpState *state, const uint8_t *input, uint32_t input_len)
645 {
646  uint16_t dyn_port = rs_ftp_epsv_response(input, input_len);
647  if (dyn_port == 0) {
648  return -1;
649  }
650  SCLogDebug("FTP passive mode (v6): dynamic port %"PRIu16"", dyn_port);
651  state->active = false;
652  state->dyn_port = dyn_port;
653  state->curr_tx->dyn_port = dyn_port;
654  state->curr_tx->active = false;
655  return 0;
656 }
657 
658 /**
659  * \brief Handle preliminary replies -- keep tx open
660  * \retval bool True for a positive preliminary reply; false otherwise
661  *
662  * 1yz Positive Preliminary reply
663  *
664  * The requested action is being initiated; expect another
665  * reply before proceeding with a new command
666  */
667 static inline bool FTPIsPPR(const uint8_t *input, uint32_t input_len)
668 {
669  return input_len >= 4 && isdigit(input[0]) && input[0] == '1' &&
670  isdigit(input[1]) && isdigit(input[2]) && isspace(input[3]);
671 }
672 
673 /**
674  * \brief This function is called to retrieve a ftp response
675  * \param ftp_state the ftp state structure for the parser
676  * \param input input line of the command
677  * \param input_len length of the request
678  * \param output the resulting output
679  *
680  * \retval 1 when the command is parsed, 0 otherwise
681  */
682 static AppLayerResult FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstate,
683  StreamSlice stream_slice, void *local_data)
684 {
685  FtpState *state = (FtpState *)ftp_state;
686 
687  const uint8_t *input = StreamSliceGetData(&stream_slice);
688  uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
689 
690  if (unlikely(input_len == 0)) {
692  }
693  FtpInput ftpi = { .buf = input, .len = input_len, .orig_len = input_len, .consumed = 0 };
694  FtpLineState line = { .buf = NULL, .len = 0, .delim_len = 0, .lf_found = false };
695 
696  FTPTransaction *lasttx = TAILQ_FIRST(&state->tx_list);
697  AppLayerResult res;
698  while (1) {
699  res = FTPGetLineForDirection(state, &line, &ftpi, &state->current_line_truncated_tc);
700  if (res.status == 1) {
701  return res;
702  } else if (res.status == -1) {
703  break;
704  }
705  FTPTransaction *tx = FTPGetOldestTx(state, lasttx);
706  if (tx == NULL) {
707  tx = FTPTransactionCreate(state);
708  }
709  if (unlikely(tx == NULL)) {
711  }
712  lasttx = tx;
713  if (state->command == FTP_COMMAND_UNKNOWN || tx->command_descriptor == NULL) {
714  /* unknown */
716  }
717 
718  state->curr_tx = tx;
719  uint16_t dyn_port;
720  switch (state->command) {
722  if (line.len >= 4 && SCMemcmp("234 ", line.buf, 4) == 0) {
724  }
725  break;
726 
727  case FTP_COMMAND_EPRT:
728  dyn_port = rs_ftp_active_eprt(state->port_line, state->port_line_len);
729  if (dyn_port == 0) {
730  goto tx_complete;
731  }
732  state->dyn_port = dyn_port;
733  state->active = true;
734  tx->dyn_port = dyn_port;
735  tx->active = true;
736  SCLogDebug("FTP active mode (v6): dynamic port %" PRIu16 "", dyn_port);
737  break;
738 
739  case FTP_COMMAND_PORT:
740  dyn_port = rs_ftp_active_port(state->port_line, state->port_line_len);
741  if (dyn_port == 0) {
742  goto tx_complete;
743  }
744  state->dyn_port = dyn_port;
745  state->active = true;
746  tx->dyn_port = state->dyn_port;
747  tx->active = true;
748  SCLogDebug("FTP active mode (v4): dynamic port %" PRIu16 "", dyn_port);
749  break;
750 
751  case FTP_COMMAND_PASV:
752  if (line.len >= 4 && SCMemcmp("227 ", line.buf, 4) == 0) {
753  FTPParsePassiveResponse(f, ftp_state, line.buf, line.len);
754  }
755  break;
756 
757  case FTP_COMMAND_EPSV:
758  if (line.len >= 4 && SCMemcmp("229 ", line.buf, 4) == 0) {
759  FTPParsePassiveResponseV6(f, ftp_state, line.buf, line.len);
760  }
761  break;
762  default:
763  break;
764  }
765 
766  if (likely(line.len)) {
767  FTPString *response = FTPStringAlloc();
768  if (likely(response)) {
769  response->len = CopyCommandLine(&response->str, &line);
770  response->truncated = state->current_line_truncated_tc;
771  if (response->truncated) {
773  &tx->tx_data.events, FtpEventResponseCommandTooLong);
774  }
775  if (line.lf_found) {
776  state->current_line_truncated_tc = false;
777  }
778  TAILQ_INSERT_TAIL(&tx->response_list, response, next);
779  }
780  }
781 
782  /* Handle preliminary replies -- keep tx open */
783  if (FTPIsPPR(line.buf, line.len)) {
784  continue;
785  }
786  tx_complete:
787  tx->done = true;
788 
789  if (line.len >= ftp_max_line_len) {
790  ftpi.consumed = ftpi.len + 1;
791  break;
792  }
793  }
794 
796 }
797 
798 
799 #ifdef DEBUG
800 static SCMutex ftp_state_mem_lock = SCMUTEX_INITIALIZER;
801 static uint64_t ftp_state_memuse = 0;
802 static uint64_t ftp_state_memcnt = 0;
803 #endif
804 
805 static void *FTPStateAlloc(void *orig_state, AppProto proto_orig)
806 {
807  void *s = FTPCalloc(1, sizeof(FtpState));
808  if (unlikely(s == NULL))
809  return NULL;
810 
811  FtpState *ftp_state = (FtpState *) s;
812  TAILQ_INIT(&ftp_state->tx_list);
813 
814 #ifdef DEBUG
815  SCMutexLock(&ftp_state_mem_lock);
816  ftp_state_memcnt++;
817  ftp_state_memuse+=sizeof(FtpState);
818  SCMutexUnlock(&ftp_state_mem_lock);
819 #endif
820  return s;
821 }
822 
823 static void FTPStateFree(void *s)
824 {
825  FtpState *fstate = (FtpState *) s;
826  if (fstate->port_line != NULL)
827  FTPFree(fstate->port_line, fstate->port_line_size);
828 
829  FTPTransaction *tx = NULL;
830  while ((tx = TAILQ_FIRST(&fstate->tx_list))) {
831  TAILQ_REMOVE(&fstate->tx_list, tx, next);
832  SCLogDebug("[%s] state %p id %" PRIu64 ", Freeing %d bytes at %p",
834  tx->request);
835  FTPTransactionFree(tx);
836  }
837 
838  FTPFree(s, sizeof(FtpState));
839 #ifdef DEBUG
840  SCMutexLock(&ftp_state_mem_lock);
841  ftp_state_memcnt--;
842  ftp_state_memuse-=sizeof(FtpState);
843  SCMutexUnlock(&ftp_state_mem_lock);
844 #endif
845 }
846 
847 /**
848  * \brief This function returns the oldest open transaction; if none
849  * are open, then the oldest transaction is returned
850  * \param ftp_state the ftp state structure for the parser
851  * \param starttx the ftp transaction where to start looking
852  *
853  * \retval transaction pointer when a transaction was found; NULL otherwise.
854  */
855 static FTPTransaction *FTPGetOldestTx(const FtpState *ftp_state, FTPTransaction *starttx)
856 {
857  if (unlikely(!ftp_state)) {
858  SCLogDebug("NULL state object; no transactions available");
859  return NULL;
860  }
861  FTPTransaction *tx = starttx;
862  FTPTransaction *lasttx = NULL;
863  while(tx != NULL) {
864  /* Return oldest open tx */
865  if (!tx->done) {
866  SCLogDebug("Returning tx %p id %"PRIu64, tx, tx->tx_id);
867  return tx;
868  }
869  /* save for the end */
870  lasttx = tx;
871  tx = TAILQ_NEXT(tx, next);
872  }
873  /* All tx are closed; return last element */
874  if (lasttx)
875  SCLogDebug("Returning OLDEST tx %p id %"PRIu64, lasttx, lasttx->tx_id);
876  return lasttx;
877 }
878 
879 static void *FTPGetTx(void *state, uint64_t tx_id)
880 {
881  FtpState *ftp_state = (FtpState *)state;
882  if (ftp_state) {
883  FTPTransaction *tx = NULL;
884 
885  if (ftp_state->curr_tx == NULL)
886  return NULL;
887  if (ftp_state->curr_tx->tx_id == tx_id)
888  return ftp_state->curr_tx;
889 
890  TAILQ_FOREACH(tx, &ftp_state->tx_list, next) {
891  if (tx->tx_id == tx_id)
892  return tx;
893  }
894  }
895  return NULL;
896 }
897 
898 static AppLayerTxData *FTPGetTxData(void *vtx)
899 {
900  FTPTransaction *tx = (FTPTransaction *)vtx;
901  return &tx->tx_data;
902 }
903 
904 static AppLayerStateData *FTPGetStateData(void *vstate)
905 {
906  FtpState *s = (FtpState *)vstate;
907  return &s->state_data;
908 }
909 
910 static void FTPStateTransactionFree(void *state, uint64_t tx_id)
911 {
912  FtpState *ftp_state = state;
913  FTPTransaction *tx = NULL;
914  TAILQ_FOREACH(tx, &ftp_state->tx_list, next) {
915  if (tx_id < tx->tx_id)
916  break;
917  else if (tx_id > tx->tx_id)
918  continue;
919 
920  if (tx == ftp_state->curr_tx)
921  ftp_state->curr_tx = NULL;
922  TAILQ_REMOVE(&ftp_state->tx_list, tx, next);
923  FTPTransactionFree(tx);
924  break;
925  }
926 }
927 
928 static uint64_t FTPGetTxCnt(void *state)
929 {
930  uint64_t cnt = 0;
931  FtpState *ftp_state = state;
932  if (ftp_state) {
933  cnt = ftp_state->tx_cnt;
934  }
935  SCLogDebug("returning state %p %"PRIu64, state, cnt);
936  return cnt;
937 }
938 
939 static int FTPGetAlstateProgress(void *vtx, uint8_t direction)
940 {
941  SCLogDebug("tx %p", vtx);
942  FTPTransaction *tx = vtx;
943 
944  if (!tx->done) {
945  if (direction == STREAM_TOSERVER && tx->command_descriptor->command == FTP_COMMAND_PORT) {
946  return FTP_STATE_PORT_DONE;
947  }
948  return FTP_STATE_IN_PROGRESS;
949  }
950 
951  return FTP_STATE_FINISHED;
952 }
953 
954 
955 static int FTPRegisterPatternsForProtocolDetection(void)
956 {
958  IPPROTO_TCP, ALPROTO_FTP, "220 (", 5, 0, STREAM_TOCLIENT) < 0) {
959  return -1;
960  }
962  IPPROTO_TCP, ALPROTO_FTP, "FEAT", 4, 0, STREAM_TOSERVER) < 0) {
963  return -1;
964  }
966  IPPROTO_TCP, ALPROTO_FTP, "USER ", 5, 0, STREAM_TOSERVER) < 0) {
967  return -1;
968  }
970  IPPROTO_TCP, ALPROTO_FTP, "PASS ", 5, 0, STREAM_TOSERVER) < 0) {
971  return -1;
972  }
974  IPPROTO_TCP, ALPROTO_FTP, "PORT ", 5, 0, STREAM_TOSERVER) < 0) {
975  return -1;
976  }
977 
978  return 0;
979 }
980 
981 
983 
984 /**
985  * \brief This function is called to retrieve a ftp request
986  * \param ftp_state the ftp state structure for the parser
987  * \param output the resulting output
988  *
989  * \retval 1 when the command is parsed, 0 otherwise
990  */
991 static AppLayerResult FTPDataParse(Flow *f, FtpDataState *ftpdata_state,
992  AppLayerParserState *pstate, StreamSlice stream_slice, void *local_data, uint8_t direction)
993 {
994  const uint8_t *input = StreamSliceGetData(&stream_slice);
995  uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
996  const bool eof = (direction & STREAM_TOSERVER)
999 
1000  ftpdata_state->tx_data.file_flags |= ftpdata_state->state_data.file_flags;
1001  if (ftpdata_state->tx_data.file_tx == 0)
1002  ftpdata_state->tx_data.file_tx = direction & (STREAM_TOSERVER | STREAM_TOCLIENT);
1003 
1004  /* we depend on detection engine for file pruning */
1005  const uint16_t flags = FileFlowFlagsToFlags(ftpdata_state->tx_data.file_flags, direction);
1006  int ret = 0;
1007 
1008  SCLogDebug("FTP-DATA input_len %u flags %04x dir %d/%s EOF %s", input_len, flags, direction,
1009  (direction & STREAM_TOSERVER) ? "toserver" : "toclient", eof ? "true" : "false");
1010 
1011  SCLogDebug("FTP-DATA flags %04x dir %d", flags, direction);
1012  if (input_len && ftpdata_state->files == NULL) {
1013  struct FtpTransferCmd *data =
1015  if (data == NULL) {
1017  }
1018 
1019  /* we shouldn't get data in the wrong dir. Don't set things up for this dir */
1020  if ((direction & data->direction) == 0) {
1021  // TODO set event for data in wrong direction
1022  SCLogDebug("input %u not for our direction (%s): %s/%s", input_len,
1023  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
1024  data->cmd == FTP_COMMAND_STOR ? "STOR" : "RETR",
1025  (data->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1027  }
1028 
1029  ftpdata_state->files = FileContainerAlloc();
1030  if (ftpdata_state->files == NULL) {
1033  }
1034 
1035  ftpdata_state->file_name = data->file_name;
1036  ftpdata_state->file_len = data->file_len;
1037  data->file_name = NULL;
1038  data->file_len = 0;
1039  f->parent_id = data->flow_id;
1040  ftpdata_state->command = data->cmd;
1041  switch (data->cmd) {
1042  case FTP_COMMAND_STOR:
1043  ftpdata_state->direction = data->direction;
1044  SCLogDebug("STOR data to %s",
1045  (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1046  break;
1047  case FTP_COMMAND_RETR:
1048  ftpdata_state->direction = data->direction;
1049  SCLogDebug("RETR data to %s",
1050  (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1051  break;
1052  default:
1053  break;
1054  }
1055 
1056  /* open with fixed track_id 0 as we can have just one
1057  * file per ftp-data flow. */
1058  if (FileOpenFileWithId(ftpdata_state->files, &sbcfg,
1059  0ULL, (uint8_t *) ftpdata_state->file_name,
1060  ftpdata_state->file_len,
1061  input, input_len, flags) != 0) {
1062  SCLogDebug("Can't open file");
1063  ret = -1;
1064  }
1066  ftpdata_state->tx_data.files_opened = 1;
1067  } else {
1068  if (ftpdata_state->state == FTPDATA_STATE_FINISHED) {
1069  SCLogDebug("state is already finished");
1070  DEBUG_VALIDATE_BUG_ON(input_len); // data after state finished is a bug.
1072  }
1073  if ((direction & ftpdata_state->direction) == 0) {
1074  if (input_len) {
1075  // TODO set event for data in wrong direction
1076  }
1077  SCLogDebug("input %u not for us (%s): %s/%s", input_len,
1078  (direction & STREAM_TOSERVER) ? "toserver" : "toclient",
1079  ftpdata_state->command == FTP_COMMAND_STOR ? "STOR" : "RETR",
1080  (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
1082  }
1083  if (input_len != 0) {
1084  ret = FileAppendData(ftpdata_state->files, &sbcfg, input, input_len);
1085  if (ret == -2) {
1086  ret = 0;
1087  SCLogDebug("FileAppendData() - file no longer being extracted");
1088  goto out;
1089  } else if (ret < 0) {
1090  SCLogDebug("FileAppendData() failed: %d", ret);
1091  ret = -2;
1092  goto out;
1093  }
1094  }
1095  }
1096 
1097  BUG_ON((direction & ftpdata_state->direction) == 0); // should be unreachable
1098  if (eof) {
1099  ret = FileCloseFile(ftpdata_state->files, &sbcfg, NULL, 0, flags);
1100  ftpdata_state->state = FTPDATA_STATE_FINISHED;
1101  SCLogDebug("closed because of eof: state now FTPDATA_STATE_FINISHED");
1102  }
1103 out:
1104  if (ret < 0) {
1106  }
1108 }
1109 
1110 static AppLayerResult FTPDataParseRequest(Flow *f, void *ftp_state, AppLayerParserState *pstate,
1111  StreamSlice stream_slice, void *local_data)
1112 {
1113  return FTPDataParse(f, ftp_state, pstate, stream_slice, local_data, STREAM_TOSERVER);
1114 }
1115 
1116 static AppLayerResult FTPDataParseResponse(Flow *f, void *ftp_state, AppLayerParserState *pstate,
1117  StreamSlice stream_slice, void *local_data)
1118 {
1119  return FTPDataParse(f, ftp_state, pstate, stream_slice, local_data, STREAM_TOCLIENT);
1120 }
1121 
1122 #ifdef DEBUG
1123 static SCMutex ftpdata_state_mem_lock = SCMUTEX_INITIALIZER;
1124 static uint64_t ftpdata_state_memuse = 0;
1125 static uint64_t ftpdata_state_memcnt = 0;
1126 #endif
1127 
1128 static void *FTPDataStateAlloc(void *orig_state, AppProto proto_orig)
1129 {
1130  void *s = FTPCalloc(1, sizeof(FtpDataState));
1131  if (unlikely(s == NULL))
1132  return NULL;
1133 
1134  FtpDataState *state = (FtpDataState *) s;
1136 
1137 #ifdef DEBUG
1138  SCMutexLock(&ftpdata_state_mem_lock);
1139  ftpdata_state_memcnt++;
1140  ftpdata_state_memuse+=sizeof(FtpDataState);
1141  SCMutexUnlock(&ftpdata_state_mem_lock);
1142 #endif
1143  return s;
1144 }
1145 
1146 static void FTPDataStateFree(void *s)
1147 {
1148  FtpDataState *fstate = (FtpDataState *) s;
1149 
1150  if (fstate->tx_data.de_state != NULL) {
1151  DetectEngineStateFree(fstate->tx_data.de_state);
1152  }
1153  if (fstate->file_name != NULL) {
1154  FTPFree(fstate->file_name, fstate->file_len + 1);
1155  }
1156 
1157  FileContainerFree(fstate->files, &sbcfg);
1158 
1159  FTPFree(s, sizeof(FtpDataState));
1160 #ifdef DEBUG
1161  SCMutexLock(&ftpdata_state_mem_lock);
1162  ftpdata_state_memcnt--;
1163  ftpdata_state_memuse-=sizeof(FtpDataState);
1164  SCMutexUnlock(&ftpdata_state_mem_lock);
1165 #endif
1166 }
1167 
1168 static AppLayerTxData *FTPDataGetTxData(void *vtx)
1169 {
1170  FtpDataState *ftp_state = (FtpDataState *)vtx;
1171  return &ftp_state->tx_data;
1172 }
1173 
1174 static AppLayerStateData *FTPDataGetStateData(void *vstate)
1175 {
1176  FtpDataState *ftp_state = (FtpDataState *)vstate;
1177  return &ftp_state->state_data;
1178 }
1179 
1180 static void FTPDataStateTransactionFree(void *state, uint64_t tx_id)
1181 {
1182  /* do nothing */
1183 }
1184 
1185 static void *FTPDataGetTx(void *state, uint64_t tx_id)
1186 {
1187  FtpDataState *ftp_state = (FtpDataState *)state;
1188  return ftp_state;
1189 }
1190 
1191 static uint64_t FTPDataGetTxCnt(void *state)
1192 {
1193  /* ftp-data is single tx */
1194  return 1;
1195 }
1196 
1197 static int FTPDataGetAlstateProgress(void *tx, uint8_t direction)
1198 {
1199  FtpDataState *ftpdata_state = (FtpDataState *)tx;
1200  if (direction == ftpdata_state->direction)
1201  return ftpdata_state->state;
1202  else
1203  return FTPDATA_STATE_FINISHED;
1204 }
1205 
1206 static AppLayerGetFileState FTPDataStateGetTxFiles(void *_state, void *tx, uint8_t direction)
1207 {
1208  FtpDataState *ftpdata_state = (FtpDataState *)tx;
1209  AppLayerGetFileState files = { .fc = NULL, .cfg = &sbcfg };
1210 
1211  if (direction == ftpdata_state->direction)
1212  files.fc = ftpdata_state->files;
1213 
1214  return files;
1215 }
1216 
1217 static void FTPSetMpmState(void)
1218 {
1219  ftp_mpm_ctx = SCCalloc(1, sizeof(MpmCtx));
1220  if (unlikely(ftp_mpm_ctx == NULL)) {
1221  exit(EXIT_FAILURE);
1222  }
1223  MpmInitCtx(ftp_mpm_ctx, FTP_MPM);
1224 
1225  uint32_t i = 0;
1226  for (i = 0; i < sizeof(FtpCommands)/sizeof(FtpCommand) - 1; i++) {
1227  const FtpCommand *cmd = &FtpCommands[i];
1228  if (cmd->command_length == 0)
1229  continue;
1230 
1231  MpmAddPatternCI(ftp_mpm_ctx,
1232  (uint8_t *)cmd->command_name,
1233  cmd->command_length,
1234  0 /* defunct */, 0 /* defunct */,
1235  i /* id */, i /* rule id */ , 0 /* no flags */);
1236  }
1237 
1238  mpm_table[FTP_MPM].Prepare(ftp_mpm_ctx);
1239 
1240 }
1241 
1242 static void FTPFreeMpmState(void)
1243 {
1244  if (ftp_mpm_ctx != NULL) {
1245  mpm_table[FTP_MPM].DestroyCtx(ftp_mpm_ctx);
1246  SCFree(ftp_mpm_ctx);
1247  ftp_mpm_ctx = NULL;
1248  }
1249 }
1250 
1251 /** \brief FTP tx iterator, specialized for its linked list
1252  *
1253  * \retval txptr or NULL if no more txs in list
1254  */
1255 static AppLayerGetTxIterTuple FTPGetTxIterator(const uint8_t ipproto, const AppProto alproto,
1256  void *alstate, uint64_t min_tx_id, uint64_t max_tx_id, AppLayerGetTxIterState *state)
1257 {
1258  FtpState *ftp_state = (FtpState *)alstate;
1259  AppLayerGetTxIterTuple no_tuple = { NULL, 0, false };
1260  if (ftp_state) {
1261  FTPTransaction *tx_ptr;
1262  if (state->un.ptr == NULL) {
1263  tx_ptr = TAILQ_FIRST(&ftp_state->tx_list);
1264  } else {
1265  tx_ptr = (FTPTransaction *)state->un.ptr;
1266  }
1267  if (tx_ptr) {
1268  while (tx_ptr->tx_id < min_tx_id) {
1269  tx_ptr = TAILQ_NEXT(tx_ptr, next);
1270  if (!tx_ptr) {
1271  return no_tuple;
1272  }
1273  }
1274  if (tx_ptr->tx_id >= max_tx_id) {
1275  return no_tuple;
1276  }
1277  state->un.ptr = TAILQ_NEXT(tx_ptr, next);
1278  AppLayerGetTxIterTuple tuple = {
1279  .tx_ptr = tx_ptr,
1280  .tx_id = tx_ptr->tx_id,
1281  .has_next = (state->un.ptr != NULL),
1282  };
1283  return tuple;
1284  }
1285  }
1286  return no_tuple;
1287 }
1288 
1290 {
1291  const char *proto_name = "ftp";
1292  const char *proto_data_name = "ftp-data";
1293 
1294  /** FTP */
1295  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
1297  if (FTPRegisterPatternsForProtocolDetection() < 0 )
1298  return;
1300  }
1301 
1302  if (AppLayerParserConfParserEnabled("tcp", proto_name)) {
1303  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOSERVER,
1304  FTPParseRequest);
1305  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOCLIENT,
1306  FTPParseResponse);
1307  AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_FTP, FTPStateAlloc, FTPStateFree);
1308  AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_FTP, STREAM_TOSERVER | STREAM_TOCLIENT);
1309 
1310  AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_FTP, FTPStateTransactionFree);
1311 
1312  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_FTP, FTPGetTx);
1313  AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_FTP, FTPGetTxData);
1314  AppLayerParserRegisterGetTxIterator(IPPROTO_TCP, ALPROTO_FTP, FTPGetTxIterator);
1315  AppLayerParserRegisterStateDataFunc(IPPROTO_TCP, ALPROTO_FTP, FTPGetStateData);
1316 
1317  AppLayerParserRegisterLocalStorageFunc(IPPROTO_TCP, ALPROTO_FTP, FTPLocalStorageAlloc,
1318  FTPLocalStorageFree);
1319  AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_FTP, FTPGetTxCnt);
1320 
1321  AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_FTP, FTPGetAlstateProgress);
1322 
1325 
1327  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTPDATA, STREAM_TOSERVER,
1328  FTPDataParseRequest);
1329  AppLayerParserRegisterParser(IPPROTO_TCP, ALPROTO_FTPDATA, STREAM_TOCLIENT,
1330  FTPDataParseResponse);
1331  AppLayerParserRegisterStateFuncs(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateAlloc, FTPDataStateFree);
1332  AppLayerParserRegisterParserAcceptableDataDirection(IPPROTO_TCP, ALPROTO_FTPDATA, STREAM_TOSERVER | STREAM_TOCLIENT);
1333  AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateTransactionFree);
1334 
1335  AppLayerParserRegisterGetTxFilesFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataStateGetTxFiles);
1336 
1337  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetTx);
1338  AppLayerParserRegisterTxDataFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetTxData);
1339  AppLayerParserRegisterStateDataFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetStateData);
1340 
1341  AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetTxCnt);
1342 
1343  AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_FTPDATA, FTPDataGetAlstateProgress);
1344 
1347 
1348  AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_FTP, ftp_get_event_info);
1349  AppLayerParserRegisterGetEventInfoById(IPPROTO_TCP, ALPROTO_FTP, ftp_get_event_info_by_id);
1350 
1351  sbcfg.buf_size = 4096;
1352  sbcfg.Calloc = FTPCalloc;
1353  sbcfg.Realloc = FTPRealloc;
1354  sbcfg.Free = FTPFree;
1355 
1356  FTPParseMemcap();
1357  } else {
1358  SCLogInfo("Parsed disabled for %s protocol. Protocol detection"
1359  "still on.", proto_name);
1360  }
1361 
1362  FTPSetMpmState();
1363 
1364 #ifdef UNITTESTS
1366 #endif
1367 }
1368 
1370 {
1371 #ifdef DEBUG
1372  SCMutexLock(&ftp_state_mem_lock);
1373  SCLogDebug("ftp_state_memcnt %"PRIu64", ftp_state_memuse %"PRIu64"",
1374  ftp_state_memcnt, ftp_state_memuse);
1375  SCMutexUnlock(&ftp_state_mem_lock);
1376 #endif
1377 }
1378 
1379 
1380 /*
1381  * \brief Returns the ending offset of the next line from a multi-line buffer.
1382  *
1383  * "Buffer" refers to a FTP response in a single buffer containing multiple lines.
1384  * Here, "next line" is defined as terminating on
1385  * - Newline character
1386  * - Null character
1387  *
1388  * \param buffer Contains zero or more characters.
1389  * \param len Size, in bytes, of buffer.
1390  *
1391  * \retval Offset from the start of buffer indicating the where the
1392  * next "line ends". The characters between the input buffer and this
1393  * value comprise the line.
1394  *
1395  * NULL is found first or a newline isn't found, then UINT16_MAX is returned.
1396  */
1397 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
1398 {
1399  if (!buffer || *buffer == '\0') {
1400  return UINT16_MAX;
1401  }
1402 
1403  char *c = strchr(buffer, '\n');
1404  return c == NULL ? len : (uint16_t)(c - buffer + 1);
1405 }
1406 
1407 bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
1408 {
1409  const FtpDataState *ftp_state = (FtpDataState *)vtx;
1410  jb_open_object(jb, "ftp_data");
1411 
1412  if (ftp_state->file_name) {
1413  jb_set_string_from_bytes(jb, "filename", ftp_state->file_name, ftp_state->file_len);
1414  }
1415  switch (ftp_state->command) {
1416  case FTP_COMMAND_STOR:
1417  JB_SET_STRING(jb, "command", "STOR");
1418  break;
1419  case FTP_COMMAND_RETR:
1420  JB_SET_STRING(jb, "command", "RETR");
1421  break;
1422  default:
1423  break;
1424  }
1425  jb_close(jb);
1426  return true;
1427 }
1428 
1429 /**
1430  * \brief Free memory allocated for global FTP parser state.
1431  */
1433 {
1434  FTPFreeMpmState();
1435 }
1436 
1437 /* UNITTESTS */
1438 #ifdef UNITTESTS
1439 #include "stream-tcp.h"
1440 
1441 /** \test Send a get request in one chunk. */
1442 static int FTPParserTest01(void)
1443 {
1444  Flow f;
1445  uint8_t ftpbuf[] = "PORT 192,168,1,1,0,80\r\n";
1446  uint32_t ftplen = sizeof(ftpbuf) - 1; /* minus the \0 */
1447  TcpSession ssn;
1449 
1450  memset(&f, 0, sizeof(f));
1451  memset(&ssn, 0, sizeof(ssn));
1452 
1453  f.protoctx = (void *)&ssn;
1454  f.proto = IPPROTO_TCP;
1455  f.alproto = ALPROTO_FTP;
1456 
1457  StreamTcpInitConfig(true);
1458 
1459  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1460  STREAM_TOSERVER | STREAM_EOF, ftpbuf, ftplen);
1461  FAIL_IF(r != 0);
1462 
1463  FtpState *ftp_state = f.alstate;
1464  FAIL_IF_NULL(ftp_state);
1465  FAIL_IF(ftp_state->command != FTP_COMMAND_PORT);
1466 
1468  StreamTcpFreeConfig(true);
1469  PASS;
1470 }
1471 
1472 /** \test Supply RETR without a filename */
1473 static int FTPParserTest11(void)
1474 {
1475  Flow f;
1476  uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
1477  uint8_t ftpbuf2[] = "RETR\r\n";
1478  uint8_t ftpbuf3[] = "227 OK\r\n";
1479  TcpSession ssn;
1480 
1482 
1483  memset(&f, 0, sizeof(f));
1484  memset(&ssn, 0, sizeof(ssn));
1485 
1486  f.protoctx = (void *)&ssn;
1487  f.proto = IPPROTO_TCP;
1488  f.alproto = ALPROTO_FTP;
1489 
1490  StreamTcpInitConfig(true);
1491 
1492  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1493  STREAM_TOSERVER | STREAM_START, ftpbuf1,
1494  sizeof(ftpbuf1) - 1);
1495  FAIL_IF(r != 0);
1496 
1497  /* Response */
1498  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1499  STREAM_TOCLIENT,
1500  ftpbuf3,
1501  sizeof(ftpbuf3) - 1);
1502  FAIL_IF(r != 0);
1503 
1504  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1505  STREAM_TOSERVER, ftpbuf2,
1506  sizeof(ftpbuf2) - 1);
1507  FAIL_IF(r == 0);
1508 
1509  FtpState *ftp_state = f.alstate;
1510  FAIL_IF_NULL(ftp_state);
1511 
1512  FAIL_IF(ftp_state->command != FTP_COMMAND_RETR);
1513 
1515  StreamTcpFreeConfig(true);
1516  PASS;
1517 }
1518 
1519 /** \test Supply STOR without a filename */
1520 static int FTPParserTest12(void)
1521 {
1522  Flow f;
1523  uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
1524  uint8_t ftpbuf2[] = "STOR\r\n";
1525  uint8_t ftpbuf3[] = "227 OK\r\n";
1526  TcpSession ssn;
1527 
1529 
1530  memset(&f, 0, sizeof(f));
1531  memset(&ssn, 0, sizeof(ssn));
1532 
1533  f.protoctx = (void *)&ssn;
1534  f.proto = IPPROTO_TCP;
1535  f.alproto = ALPROTO_FTP;
1536 
1537  StreamTcpInitConfig(true);
1538 
1539  int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1540  STREAM_TOSERVER | STREAM_START, ftpbuf1,
1541  sizeof(ftpbuf1) - 1);
1542  FAIL_IF(r != 0);
1543 
1544  /* Response */
1545  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1546  STREAM_TOCLIENT,
1547  ftpbuf3,
1548  sizeof(ftpbuf3) - 1);
1549  FAIL_IF(r != 0);
1550 
1551  r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP,
1552  STREAM_TOSERVER, ftpbuf2,
1553  sizeof(ftpbuf2) - 1);
1554  FAIL_IF(r == 0);
1555 
1556  FtpState *ftp_state = f.alstate;
1557  FAIL_IF_NULL(ftp_state);
1558 
1559  FAIL_IF(ftp_state->command != FTP_COMMAND_STOR);
1560 
1562  StreamTcpFreeConfig(true);
1563  PASS;
1564 }
1565 #endif /* UNITTESTS */
1566 
1568 {
1569 #ifdef UNITTESTS
1570  UtRegisterTest("FTPParserTest01", FTPParserTest01);
1571  UtRegisterTest("FTPParserTest11", FTPParserTest11);
1572  UtRegisterTest("FTPParserTest12", FTPParserTest12);
1573 #endif /* UNITTESTS */
1574 }
1575 
MpmInitThreadCtx
void MpmInitThreadCtx(MpmThreadCtx *mpm_thread_ctx, uint16_t matcher)
Definition: util-mpm.c:196
FTPTransaction_::request_truncated
bool request_truncated
Definition: app-layer-ftp.h:127
PmqReset
void PmqReset(PrefilterRuleStore *pmq)
Reset a Pmq for reusage. Meant to be called after a single search.
Definition: util-prefilter.c:102
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:494
FTPTransaction_::command_descriptor
const FtpCommand * command_descriptor
Definition: app-layer-ftp.h:130
len
uint8_t len
Definition: app-layer-dnp3.h:2
FTP_COMMAND_USER
@ FTP_COMMAND_USER
Definition: app-layer-ftp.h:84
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
FTP_COMMAND_STAT
@ FTP_COMMAND_STAT
Definition: app-layer-ftp.h:77
FTP_COMMAND_DELE
@ FTP_COMMAND_DELE
Definition: app-layer-ftp.h:46
FTPTransaction_::request
uint8_t * request
Definition: app-layer-ftp.h:126
AppLayerGetTxIterState::ptr
void * ptr
Definition: app-layer-parser.h:146
AppLayerProtoDetectPMRegisterPatternCI
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1706
FTPThreadCtx_
Definition: app-layer-ftp.c:41
FtpTransferCmd::flow_id
uint64_t flow_id
Definition: app-layer-ftp.c:432
AppLayerGetTxIterState::un
union AppLayerGetTxIterState::@15 un
StreamingBufferConfig_::buf_size
uint32_t buf_size
Definition: util-streaming-buffer.h:66
AppLayerParserRegisterLocalStorageFunc
void AppLayerParserRegisterLocalStorageFunc(uint8_t ipproto, AppProto alproto, void *(*LocalStorageAlloc)(void), void(*LocalStorageFree)(void *))
Definition: app-layer-parser.c:442
FTP_COMMAND_ALLO
@ FTP_COMMAND_ALLO
Definition: app-layer-ftp.h:40
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:262
FtpState_::active
bool active
Definition: app-layer-ftp.h:146
SC_ATOMIC_INIT
#define SC_ATOMIC_INIT(name)
wrapper for initializing an atomic variable.
Definition: util-atomic.h:314
FtpCommands
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
Definition: app-layer-ftp.c:51
FileContainerAlloc
FileContainer * FileContainerAlloc(void)
allocate a FileContainer
Definition: util-file.c:497
FtpDataState_::state
uint8_t state
Definition: app-layer-ftp.h:179
StreamingBufferConfig_::Calloc
void *(* Calloc)(size_t n, size_t size)
Definition: util-streaming-buffer.h:69
MpmThreadCtx_
Definition: util-mpm.h:46
stream-tcp.h
FtpState
struct FtpState_ FtpState
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
AppLayerRequestProtocolTLSUpgrade
bool AppLayerRequestProtocolTLSUpgrade(Flow *f)
request applayer to wrap up this protocol and rerun protocol detection with expectation of TLS....
Definition: app-layer-detect-proto.c:1864
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
AppLayerExpectationGetFlowId
FlowStorageId AppLayerExpectationGetFlowId(void)
Definition: app-layer-expectation.c:288
PrefilterRuleStore_
structure for storing potential rule matches
Definition: util-prefilter.h:34
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
ParseSizeStringU64
int ParseSizeStringU64(const char *size, uint64_t *res)
Definition: util-misc.c:198
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FTP_COMMAND_RNFR
@ FTP_COMMAND_RNFR
Definition: app-layer-ftp.h:72
Flow_::proto
uint8_t proto
Definition: flow.h:372
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
FtpState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:155
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:332
STREAMING_BUFFER_CONFIG_INITIALIZER
#define STREAMING_BUFFER_CONFIG_INITIALIZER
Definition: util-streaming-buffer.h:74
FileContainerFree
void FileContainerFree(FileContainer *ffc, const StreamingBufferConfig *cfg)
Free a FileContainer.
Definition: util-file.c:533
Flow_
Flow data structure.
Definition: flow.h:350
FTPTransaction_::done
bool done
Definition: app-layer-ftp.h:133
FTP_COMMAND_MSND
@ FTP_COMMAND_MSND
Definition: app-layer-ftp.h:59
FTP_COMMAND_EPSV
@ FTP_COMMAND_EPSV
Definition: app-layer-ftp.h:47
SC_ATOMIC_ADD
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:332
AppLayerParserRegisterStateProgressCompletionStatus
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
Definition: app-layer-parser.c:546
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:402
FTP_COMMAND_RNTO
@ FTP_COMMAND_RNTO
Definition: app-layer-ftp.h:73
FtpState_::current_line_truncated_tc
bool current_line_truncated_tc
Definition: app-layer-ftp.h:153
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:505
FTP_COMMAND_MODE
@ FTP_COMMAND_MODE
Definition: app-layer-ftp.h:55
FTPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:122
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
FTP_COMMAND_RMD
@ FTP_COMMAND_RMD
Definition: app-layer-ftp.h:71
FtpDataState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:178
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:167
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:312
FTP_COMMAND_ABOR
@ FTP_COMMAND_ABOR
Definition: app-layer-ftp.h:38
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
rust.h
MIN
#define MIN(x, y)
Definition: suricata-common.h:391
FTP_COMMAND_MKD
@ FTP_COMMAND_MKD
Definition: app-layer-ftp.h:53
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:133
FtpLineState_::buf
const uint8_t * buf
Definition: app-layer-ftp.h:105
FtpCommand_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:94
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:31
FTP_COMMAND_LIST
@ FTP_COMMAND_LIST
Definition: app-layer-ftp.h:50
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
AppLayerParserRegisterGetTxFilesFunc
void AppLayerParserRegisterGetTxFilesFunc(uint8_t ipproto, AppProto alproto, AppLayerGetFileState(*GetTxFiles)(void *, void *, uint8_t))
Definition: app-layer-parser.c:456
FtpCommand_::command_name
const char * command_name
Definition: app-layer-ftp.h:93
FtpDataState_::file_len
int16_t file_len
Definition: app-layer-ftp.h:177
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:294
app-layer-ftp.h
APP_LAYER_PARSER_EOF_TS
#define APP_LAYER_PARSER_EOF_TS
Definition: app-layer-parser.h:39
Flow_::protoctx
void * protoctx
Definition: flow.h:440
FTPString_::len
uint32_t len
Definition: app-layer-ftp.h:113
FtpDataState_::direction
uint8_t direction
Definition: app-layer-ftp.h:180
FtpInput_::len
int32_t len
Definition: app-layer-ftp.c:339
FtpTransferCmd::file_len
uint16_t file_len
Definition: app-layer-ftp.c:434
SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(uint64_t, ftp_memuse)
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1432
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
Definition: app-layer-ftp.c:1407
FTP_COMMAND_HELP
@ FTP_COMMAND_HELP
Definition: app-layer-ftp.h:48
FTPDATA_STATE_IN_PROGRESS
@ FTPDATA_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:167
FTP_COMMAND_SIZE
@ FTP_COMMAND_SIZE
Definition: app-layer-ftp.h:75
FTPString_::truncated
bool truncated
Definition: app-layer-ftp.h:114
MpmInitCtx
void MpmInitCtx(MpmCtx *mpm_ctx, uint8_t matcher)
Definition: util-mpm.c:210
FTPDATA_STATE_FINISHED
@ FTPDATA_STATE_FINISHED
Definition: app-layer-ftp.h:168
ftp_max_line_len
uint32_t ftp_max_line_len
Definition: app-layer-ftp.c:109
FTP_STATE_FINISHED
@ FTP_STATE_FINISHED
Definition: app-layer-ftp.h:33
ConfGet
int ConfGet(const char *name, const char **vptr)
Retrieve the value of a configuration node.
Definition: conf.c:335
FTP_COMMAND_CWD
@ FTP_COMMAND_CWD
Definition: app-layer-ftp.h:45
FTP_COMMAND_MSAM
@ FTP_COMMAND_MSAM
Definition: app-layer-ftp.h:58
FTP_COMMAND_SITE
@ FTP_COMMAND_SITE
Definition: app-layer-ftp.h:74
FtpState_
Definition: app-layer-ftp.h:145
app-layer-expectation.h
app-layer-detect-proto.h
StreamTcpInitConfig
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
Definition: stream-tcp.c:359
FTP_COMMAND_STOU
@ FTP_COMMAND_STOU
Definition: app-layer-ftp.h:79
APP_LAYER_INCOMPLETE
#define APP_LAYER_INCOMPLETE(c, n)
Definition: app-layer-parser.h:100
FTP_STATE_IN_PROGRESS
@ FTP_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:31
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:312
MpmDestroyThreadCtx
void MpmDestroyThreadCtx(MpmThreadCtx *mpm_thread_ctx, const uint16_t matcher)
Definition: util-mpm.c:203
JB_SET_STRING
#define JB_SET_STRING(jb, key, val)
Definition: rust.h:26
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:250
FtpState_::port_line
uint8_t * port_line
Definition: app-layer-ftp.h:159
AppLayerParserState_
Definition: app-layer-parser.c:138
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
FTP_COMMAND_APPE
@ FTP_COMMAND_APPE
Definition: app-layer-ftp.h:41
FTPThreadCtx_::pmq
PrefilterRuleStore * pmq
Definition: app-layer-ftp.c:43
SC_FILENAME_MAX
#define SC_FILENAME_MAX
Definition: util-file.h:62
FtpState_::curr_tx
FTPTransaction * curr_tx
Definition: app-layer-ftp.h:148
FTP_COMMAND_TYPE
@ FTP_COMMAND_TYPE
Definition: app-layer-ftp.h:82
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
FtpDataState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:182
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:22
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
FTP_COMMAND_PORT
@ FTP_COMMAND_PORT
Definition: app-layer-ftp.h:65
FTP_COMMAND_MAX
@ FTP_COMMAND_MAX
Definition: app-layer-ftp.h:88
FTP_COMMAND_REIN
@ FTP_COMMAND_REIN
Definition: app-layer-ftp.h:68
FtpTransferCmd::cmd
FtpRequestCommand cmd
Definition: app-layer-ftp.c:436
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
Definition: app-layer-parser.c:429
FtpLineState_::lf_found
bool lf_found
Definition: app-layer-ftp.h:108
app-layer-parser.h
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:300
FtpState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:163
SC_ATOMIC_SUB
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:341
FTPParserRegisterTests
void FTPParserRegisterTests(void)
Definition: app-layer-ftp.c:1567
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1289
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1908
AppLayerExpectationCreate
int AppLayerExpectationCreate(Flow *f, int direction, Port src, Port dst, AppProto alproto, void *data)
Definition: app-layer-expectation.c:219
AppLayerGetTxIterState
Definition: app-layer-parser.h:144
FtpCommand_
Definition: app-layer-ftp.h:92
FtpTransferCmd
Definition: app-layer-ftp.c:428
APP_LAYER_PARSER_EOF_TC
#define APP_LAYER_PARSER_EOF_TC
Definition: app-layer-parser.h:40
ftp_config_memcap
uint64_t ftp_config_memcap
Definition: app-layer-ftp.c:107
FTP_COMMAND_CHMOD
@ FTP_COMMAND_CHMOD
Definition: app-layer-ftp.h:44
AppLayerRegisterExpectationProto
void AppLayerRegisterExpectationProto(uint8_t proto, AppProto alproto)
Definition: app-layer-detect-proto.c:2130
MpmTableElmt_::Prepare
int(* Prepare)(struct MpmCtx_ *)
Definition: util-mpm.h:166
FTP_COMMAND_SYST
@ FTP_COMMAND_SYST
Definition: app-layer-ftp.h:81
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:583
FileOpenFileWithId
int FileOpenFileWithId(FileContainer *ffc, const StreamingBufferConfig *sbcfg, uint32_t track_id, const uint8_t *name, uint16_t name_len, const uint8_t *data, uint32_t data_len, uint16_t flags)
Open a new File.
Definition: util-file.c:981
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1783
FtpDataState
struct FtpDataState_ FtpDataState
FTP_COMMAND_ACCT
@ FTP_COMMAND_ACCT
Definition: app-layer-ftp.h:39
FileAppendData
int FileAppendData(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *data, uint32_t data_len)
Store/handle a chunk of file data in the File structure The last file in the FileContainer will be us...
Definition: util-file.c:780
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:173
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:168
FTP_COMMAND_MRSQ
@ FTP_COMMAND_MRSQ
Definition: app-layer-ftp.h:57
FtpInput
struct FtpInput_ FtpInput
FtpDataState_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:181
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:224
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:390
FtpInput_::orig_len
int32_t orig_len
Definition: app-layer-ftp.c:340
DetectEngineStateFree
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:172
FtpTransferCmd::direction
uint8_t direction
Definition: app-layer-ftp.c:435
SCRealloc
#define SCRealloc(ptr, sz)
Definition: util-mem.h:50
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:291
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:527
APP_LAYER_OK
#define APP_LAYER_OK
Definition: app-layer-parser.h:88
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1355
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
SCReturnStruct
#define SCReturnStruct(x)
Definition: util-debug.h:291
FTPTransaction_::request_length
uint32_t request_length
Definition: app-layer-ftp.h:125
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
util-mpm.h
StreamTcpFreeConfig
void StreamTcpFreeConfig(bool quiet)
Definition: stream-tcp.c:690
flags
uint8_t flags
Definition: decode-gre.h:0
FTP_COMMAND_NOOP
@ FTP_COMMAND_NOOP
Definition: app-layer-ftp.h:62
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1303
FtpLineState_
Definition: app-layer-ftp.h:102
FTP_COMMAND_CDUP
@ FTP_COMMAND_CDUP
Definition: app-layer-ftp.h:43
suricata-common.h
ftp_config_maxtx
uint32_t ftp_config_maxtx
Definition: app-layer-ftp.c:108
FTP_COMMAND_PASS
@ FTP_COMMAND_PASS
Definition: app-layer-ftp.h:63
AppLayerDecoderEventsSetEventRaw
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
Definition: app-layer-events.c:91
FtpState_::port_line_len
uint32_t port_line_len
Definition: app-layer-ftp.h:157
FtpState_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:161
TAILQ_NEXT
#define TAILQ_NEXT(elm, field)
Definition: queue.h:307
ALPROTO_FTPDATA
@ ALPROTO_FTPDATA
Definition: app-layer-protos.h:47
AppLayerParserRegisterStateDataFunc
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
Definition: app-layer-parser.c:605
FtpTransferCmd::DFree
void(* DFree)(void *)
Definition: app-layer-ftp.c:431
AppLayerParserRegisterTxDataFunc
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
Definition: app-layer-parser.c:595
FTPAtExitPrintStats
void FTPAtExitPrintStats(void)
Definition: app-layer-ftp.c:1369
Flow_::parent_id
int64_t parent_id
Definition: flow.h:429
FTP_COMMAND_MRCP
@ FTP_COMMAND_MRCP
Definition: app-layer-ftp.h:56
FtpDataState_
Definition: app-layer-ftp.h:172
ParseSizeStringU32
int ParseSizeStringU32(const char *size, uint32_t *res)
Definition: util-misc.c:181
FTP_COMMAND_PWD
@ FTP_COMMAND_PWD
Definition: app-layer-ftp.h:66
util-validate.h
FTP_COMMAND_STRU
@ FTP_COMMAND_STRU
Definition: app-layer-ftp.h:80
StreamingBufferConfig_
Definition: util-streaming-buffer.h:65
FTP_COMMAND_UNKNOWN
@ FTP_COMMAND_UNKNOWN
Definition: app-layer-ftp.h:37
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
FTP_COMMAND_MAIL
@ FTP_COMMAND_MAIL
Definition: app-layer-ftp.h:51
FTP_COMMAND_UMASK
@ FTP_COMMAND_UMASK
Definition: app-layer-ftp.h:83
FtpLineState_::delim_len
uint8_t delim_len
Definition: app-layer-ftp.h:107
str
#define str(s)
Definition: suricata-common.h:291
AppLayerParserRegisterGetTxIterator
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
Definition: app-layer-parser.c:538
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
MpmTableElmt_::DestroyCtx
void(* DestroyCtx)(struct MpmCtx_ *)
Definition: util-mpm.h:150
FlowFreeStorageById
void FlowFreeStorageById(Flow *f, FlowStorageId id)
Definition: flow-storage.c:55
FileCloseFile
int FileCloseFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg, const uint8_t *data, uint32_t data_len, uint16_t flags)
Close a File.
Definition: util-file.c:1077
SCFree
#define SCFree(p)
Definition: util-mem.h:61
Flow_::alstate
void * alstate
Definition: flow.h:475
StreamingBufferConfig_::Free
void(* Free)(void *ptr, size_t size)
Definition: util-streaming-buffer.h:71
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:561
FTP_STATE_PORT_DONE
@ FTP_STATE_PORT_DONE
Definition: app-layer-ftp.h:32
FtpState_::tx_cnt
uint64_t tx_cnt
Definition: app-layer-ftp.h:150
FtpState_::current_line_truncated_ts
bool current_line_truncated_ts
Definition: app-layer-ftp.h:152
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
FTP_COMMAND_IDLE
@ FTP_COMMAND_IDLE
Definition: app-layer-ftp.h:49
FtpLineState_::len
uint32_t len
Definition: app-layer-ftp.h:106
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:516
APP_LAYER_ERROR
#define APP_LAYER_ERROR
Definition: app-layer-parser.h:92
FtpState_::port_line_size
uint32_t port_line_size
Definition: app-layer-ftp.h:158
FTP_COMMAND_RETR
@ FTP_COMMAND_RETR
Definition: app-layer-ftp.h:70
PmqFree
void PmqFree(PrefilterRuleStore *pmq)
Cleanup and free a Pmq.
Definition: util-prefilter.c:126
FTP_MPM
#define FTP_MPM
Definition: app-layer-ftp.c:46
FTPTransaction_::tx_id
uint64_t tx_id
Definition: app-layer-ftp.h:120
FTPTransaction_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:132
FTPTransaction_::active
bool active
Definition: app-layer-ftp.h:134
FTP_COMMAND_STOR
@ FTP_COMMAND_STOR
Definition: app-layer-ftp.h:78
FtpDataState_::files
FileContainer * files
Definition: app-layer-ftp.h:175
likely
#define likely(expr)
Definition: util-optimize.h:32
FTP_COMMAND_MSOM
@ FTP_COMMAND_MSOM
Definition: app-layer-ftp.h:60
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:65
FTP_COMMAND_EPRT
@ FTP_COMMAND_EPRT
Definition: app-layer-ftp.h:85
FTPString_
Definition: app-layer-ftp.h:111
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:375
MpmCtx_
Definition: util-mpm.h:88
TcpSession_
Definition: stream-tcp-private.h:283
JsonGetNextLineFromBuffer
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
Definition: app-layer-ftp.c:1397
util-misc.h
FtpRequestCommand
FtpRequestCommand
Definition: app-layer-ftp.h:36
FileFlowFlagsToFlags
uint16_t FileFlowFlagsToFlags(const uint16_t flow_file_flags, uint8_t direction)
Definition: util-file.c:233
FTPTransaction_
Definition: app-layer-ftp.h:118
FTPThreadCtx
struct FTPThreadCtx_ FTPThreadCtx
AppLayerParserStateIssetFlag
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
Definition: app-layer-parser.c:1804
FtpInput_::buf
const uint8_t * buf
Definition: app-layer-ftp.c:337
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:449
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
FTP_COMMAND_REST
@ FTP_COMMAND_REST
Definition: app-layer-ftp.h:69
SCReturnInt
#define SCReturnInt(x)
Definition: util-debug.h:275
MpmAddPatternCI
int MpmAddPatternCI(struct MpmCtx_ *mpm_ctx, uint8_t *pat, uint16_t patlen, uint16_t offset, uint16_t depth, uint32_t pid, SigIntId sid, uint8_t flags)
Definition: util-mpm.c:259
SCMemcmp
#define SCMemcmp(a, b, c)
Definition: util-memcmp.h:290
FTP_COMMAND_PASV
@ FTP_COMMAND_PASV
Definition: app-layer-ftp.h:64
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1958
FTP_COMMAND_AUTH_TLS
@ FTP_COMMAND_AUTH_TLS
Definition: app-layer-ftp.h:42
SCMutex
#define SCMutex
Definition: threads-debug.h:114
FTPString_::str
uint8_t * str
Definition: app-layer-ftp.h:112
FTPThreadCtx_::ftp_mpm_thread_ctx
MpmThreadCtx * ftp_mpm_thread_ctx
Definition: app-layer-ftp.c:42
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:103
FtpInput_::consumed
int32_t consumed
Definition: app-layer-ftp.c:338
FTP_COMMAND_NLST
@ FTP_COMMAND_NLST
Definition: app-layer-ftp.h:61
PmqSetup
int PmqSetup(PrefilterRuleStore *pmq)
Setup a pmq.
Definition: util-prefilter.c:37
FTP_COMMAND_MDTM
@ FTP_COMMAND_MDTM
Definition: app-layer-ftp.h:52
FTP_COMMAND_SMNT
@ FTP_COMMAND_SMNT
Definition: app-layer-ftp.h:76
FTP_COMMAND_QUIT
@ FTP_COMMAND_QUIT
Definition: app-layer-ftp.h:67
StreamingBufferConfig_::Realloc
void *(* Realloc)(void *ptr, size_t orig_size, size_t size)
Definition: util-streaming-buffer.h:70
FtpDataState_::file_name
uint8_t * file_name
Definition: app-layer-ftp.h:174
FtpInput_
Definition: app-layer-ftp.c:336
FTP_COMMAND_MLFL
@ FTP_COMMAND_MLFL
Definition: app-layer-ftp.h:54
FtpTransferCmd::file_name
uint8_t * file_name
Definition: app-layer-ftp.c:433
app-layer.h
PrefilterRuleStore_::rule_id_array
SigIntId * rule_id_array
Definition: util-prefilter.h:38