suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Jeff Lucovsky <jeff@lucovsky.org>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_FTP_H
26 #define SURICATA_APP_LAYER_FTP_H
27 
28 #include "rust.h"
29 
30 struct FtpCommand;
31 
32 typedef uint32_t FtpRequestCommandArgOfs;
33 
34 /** used to hold the line state when we have fragmentation. */
35 typedef struct FtpLineState_ {
36  /** used to indicate if the current_line buffer is a malloced buffer. We
37  * use a malloced buffer, if a line is fragmented */
38  const uint8_t *buf;
39  uint32_t len;
40  uint8_t delim_len;
41  bool lf_found;
43 
44 typedef struct FTPResponseWrapper_ {
45  FTPResponseLine *response;
48 
49 /*
50  * These are the values for the table index value and the FTP command
51  * enum value. These *should* be the same if the enum and command insertion
52  * order remain the same. However, we store each value to protect against
53  * drift between enum and insertion order.
54  */
55 typedef struct FtpCommandInfo_ {
56  uint8_t command_index;
57  FtpRequestCommand command_code;
59 
60 typedef struct FTPTransaction_ {
61  /** id of this tx, starting at 0 */
62  uint64_t tx_id;
63 
65 
66  /* for the request */
67  uint32_t request_length;
68  uint8_t *request;
70 
71  /* for the command description */
73 
74  uint16_t dyn_port; /* dynamic port, if applicable */
75  bool done; /* transaction complete? */
76  bool active; /* active or passive mode */
77 
78  uint8_t direction;
79 
80  /* Handle multiple responses */
81  TAILQ_HEAD(, FTPResponseWrapper_) response_list;
82 
85 
86 /** FTP State for app layer parser */
87 typedef struct FtpState_ {
88  bool active;
89 
91  TAILQ_HEAD(, FTPTransaction_) tx_list; /**< transaction list */
92  uint64_t tx_cnt;
93 
96 
97  FtpRequestCommand command;
99  uint32_t port_line_len;
100  uint32_t port_line_size;
101  uint8_t *port_line;
102 
103  uint16_t dyn_port;
104 
105  AppLayerStateData state_data;
107 
108 /** FTP Data State for app layer parser */
109 typedef struct FtpDataState_ {
110  uint8_t *input;
111  uint8_t *file_name;
113  int32_t input_len;
114  int16_t file_len;
115  FtpRequestCommand command;
116  uint8_t state;
117  uint8_t direction;
119  AppLayerStateData state_data;
121 
122 void RegisterFTPParsers(void);
123 void FTPParserRegisterTests(void);
124 void FTPParserCleanup(void);
125 int FTPSetMemcap(uint64_t size);
126 uint64_t FTPMemuseGlobalCounter(void);
127 uint64_t FTPMemcapGlobalCounter(void);
128 
129 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
130 bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb);
131 
132 #endif /* SURICATA_APP_LAYER_FTP_H */
FTPTransaction_::request_truncated
bool request_truncated
Definition: app-layer-ftp.h:69
FileContainer_
Definition: util-file.h:113
len
uint8_t len
Definition: app-layer-dnp3.h:2
FTPTransaction_::request
uint8_t * request
Definition: app-layer-ftp.h:68
FtpDataState_::input_len
int32_t input_len
Definition: app-layer-ftp.h:113
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1269
FtpState_::active
bool active
Definition: app-layer-ftp.h:88
FtpDataState_::state
uint8_t state
Definition: app-layer-ftp.h:116
FtpState
struct FtpState_ FtpState
FtpDataState_::input
uint8_t * input
Definition: app-layer-ftp.h:110
FtpLineState
struct FtpLineState_ FtpLineState
FtpCommandInfo_
Definition: app-layer-ftp.h:55
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FtpState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:97
FtpState_::TAILQ_HEAD
TAILQ_HEAD(, FTPTransaction_) tx_list
FTPTransaction_::done
bool done
Definition: app-layer-ftp.h:75
FtpState_::current_line_truncated_tc
bool current_line_truncated_tc
Definition: app-layer-ftp.h:95
FTPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:64
FtpDataState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:115
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb)
Definition: app-layer-ftp.c:1378
rust.h
FtpLineState_::buf
const uint8_t * buf
Definition: app-layer-ftp.h:38
FtpDataState_::file_len
int16_t file_len
Definition: app-layer-ftp.h:114
FTPTransaction
struct FTPTransaction_ FTPTransaction
FtpCommandInfo
struct FtpCommandInfo_ FtpCommandInfo
FTPResponseWrapper_
Definition: app-layer-ftp.h:44
FtpDataState_::direction
uint8_t direction
Definition: app-layer-ftp.h:117
FtpState_
Definition: app-layer-ftp.h:87
FtpState_::port_line
uint8_t * port_line
Definition: app-layer-ftp.h:101
FtpState_::curr_tx
FTPTransaction * curr_tx
Definition: app-layer-ftp.h:90
FtpDataState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:119
FTPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(FTPTransaction_) next
FtpLineState_::lf_found
bool lf_found
Definition: app-layer-ftp.h:41
JsonGetNextLineFromBuffer
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
Definition: app-layer-ftp.c:1368
FtpState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:105
FTPTransaction_::command_descriptor
FtpCommandInfo command_descriptor
Definition: app-layer-ftp.h:72
FTPResponseWrapper
struct FTPResponseWrapper_ FTPResponseWrapper
FtpCommandInfo_::command_code
FtpRequestCommand command_code
Definition: app-layer-ftp.h:57
FtpState_::arg_offset
FtpRequestCommandArgOfs arg_offset
Definition: app-layer-ftp.h:98
FTPResponseWrapper_::TAILQ_ENTRY
TAILQ_ENTRY(FTPResponseWrapper_) next
FTPResponseWrapper_::response
FTPResponseLine * response
Definition: app-layer-ftp.h:45
FtpDataState
struct FtpDataState_ FtpDataState
FtpDataState_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:118
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:77
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1466
FTPTransaction_::direction
uint8_t direction
Definition: app-layer-ftp.h:78
FTPTransaction_::request_length
uint32_t request_length
Definition: app-layer-ftp.h:67
FtpLineState_
Definition: app-layer-ftp.h:35
FtpRequestCommandArgOfs
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:30
FtpState_::port_line_len
uint32_t port_line_len
Definition: app-layer-ftp.h:99
FtpState_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:103
FtpDataState_
Definition: app-layer-ftp.h:109
FtpLineState_::delim_len
uint8_t delim_len
Definition: app-layer-ftp.h:40
FtpCommandInfo_::command_index
uint8_t command_index
Definition: app-layer-ftp.h:56
FtpState_::tx_cnt
uint64_t tx_cnt
Definition: app-layer-ftp.h:92
FtpState_::current_line_truncated_ts
bool current_line_truncated_ts
Definition: app-layer-ftp.h:94
FTPSetMemcap
int FTPSetMemcap(uint64_t size)
Definition: app-layer-ftp.c:89
FtpLineState_::len
uint32_t len
Definition: app-layer-ftp.h:39
FtpState_::port_line_size
uint32_t port_line_size
Definition: app-layer-ftp.h:100
FTPTransaction_::tx_id
uint64_t tx_id
Definition: app-layer-ftp.h:62
FTPTransaction_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:74
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:83
FTPTransaction_::active
bool active
Definition: app-layer-ftp.h:76
FtpDataState_::files
FileContainer * files
Definition: app-layer-ftp.h:112
FTPTransaction_
Definition: app-layer-ftp.h:60
FTPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, FTPResponseWrapper_) response_list
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1403
FtpDataState_::file_name
uint8_t * file_name
Definition: app-layer-ftp.h:111
FTPParserRegisterTests
void FTPParserRegisterTests(void)
Definition: app-layer-ftp.c:1538