suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Jeff Lucovsky <jeff@lucovsky.org>
23  */
24 
25 #ifndef __APP_LAYER_FTP_H__
26 #define __APP_LAYER_FTP_H__
27 
28 #include "rust.h"
29 
30 enum {
34 };
35 
36 typedef enum {
86 
87  /* must be last */
89  /** \todo more if missing.. */
91 
92 typedef struct FtpCommand_ {
94  const char *command_name;
95  const uint8_t command_length;
97 extern const FtpCommand FtpCommands[FTP_COMMAND_MAX + 1];
98 
99 typedef uint32_t FtpRequestCommandArgOfs;
100 
101 typedef uint16_t FtpResponseCode;
102 
103 enum {
105 
109 
112 
113  /* must be last */
115 };
116 
117 /** used to hold the line state when we have fragmentation. */
118 typedef struct FtpLineState_ {
119  /** used to indicate if the current_line buffer is a malloced buffer. We
120  * use a malloced buffer, if a line is fragmented */
121  uint8_t *db;
122  uint32_t db_len;
124  /** we have see LF for the currently parsed line */
127 
128 typedef struct FTPString_ {
129  uint8_t *str;
130  uint16_t len;
133 
134 typedef struct FTPTransaction_ {
135  /** id of this tx, starting at 0 */
136  uint64_t tx_id;
137 
138  uint64_t detect_flags_ts;
139  uint64_t detect_flags_tc;
140 
141  /** indicates loggers done logging */
142  uint32_t logged;
143 
144  /* for the request */
145  uint32_t request_length;
146  uint8_t *request;
147 
148  /* for the command description */
150 
151  uint16_t dyn_port; /* dynamic port, if applicable */
152  bool done; /* transaction complete? */
153  bool active; /* active or passive mode */
154 
155  uint8_t direction;
156 
157  /* Handle multiple responses */
158  TAILQ_HEAD(, FTPString_) response_list;
159 
161 
164 
165 /** FTP State for app layer parser */
166 typedef struct FtpState_ {
167  const uint8_t *input;
168  int32_t input_len;
169  uint8_t direction;
170  bool active;
171 
173  TAILQ_HEAD(, FTPTransaction_) tx_list; /**< transaction list */
174  uint64_t tx_cnt;
175 
176  /* --parser details-- */
177  /** current line extracted by the parser from the call to FTPGetline() */
178  const uint8_t *current_line;
179  /** length of the line in current_line. Doesn't include the delimiter */
182 
183  /* 0 for toserver, 1 for toclient */
185 
188  uint32_t port_line_len;
189  uint32_t port_line_size;
190  uint8_t *port_line;
191 
192  uint16_t dyn_port;
193  /* specifies which loggers are done logging */
194  uint32_t logged;
195 
197 
198 enum {
201 };
202 
203 /** FTP Data State for app layer parser */
204 typedef struct FtpDataState_ {
205  uint8_t *input;
206  uint8_t *file_name;
209  int32_t input_len;
210  int16_t file_len;
212  uint8_t state;
213  uint8_t direction;
214  uint64_t detect_flags_ts;
215  uint64_t detect_flags_tc;
217 
218 void RegisterFTPParsers(void);
219 void FTPParserRegisterTests(void);
220 void FTPAtExitPrintStats(void);
221 void FTPParserCleanup(void);
222 uint64_t FTPMemuseGlobalCounter(void);
223 uint64_t FTPMemcapGlobalCounter(void);
224 
225 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
226 void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb);
227 
228 #endif /* __APP_LAYER_FTP_H__ */
229 
FtpCommand_::command_length
const uint8_t command_length
Definition: app-layer-ftp.h:95
FtpLineState_::current_line_lf_seen
uint8_t current_line_lf_seen
Definition: app-layer-ftp.h:125
FTPTransaction_::command_descriptor
const FtpCommand * command_descriptor
Definition: app-layer-ftp.h:149
FileContainer_
Definition: util-file.h:100
len
uint8_t len
Definition: app-layer-dnp3.h:2
FTP_COMMAND_USER
@ FTP_COMMAND_USER
Definition: app-layer-ftp.h:84
FTP_COMMAND_STAT
@ FTP_COMMAND_STAT
Definition: app-layer-ftp.h:77
FTP_COMMAND_DELE
@ FTP_COMMAND_DELE
Definition: app-layer-ftp.h:46
FTPTransaction_::request
uint8_t * request
Definition: app-layer-ftp.h:146
FtpDataState_::input_len
int32_t input_len
Definition: app-layer-ftp.h:209
FTP_COMMAND_ALLO
@ FTP_COMMAND_ALLO
Definition: app-layer-ftp.h:40
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1317
FtpDataState_::detect_flags_ts
uint64_t detect_flags_ts
Definition: app-layer-ftp.h:214
FtpState_::active
bool active
Definition: app-layer-ftp.h:170
FtpDataState_::state
uint8_t state
Definition: app-layer-ftp.h:212
DetectEngineState_
Definition: detect-engine-state.h:92
FtpState_::input_len
int32_t input_len
Definition: app-layer-ftp.h:168
FtpState
struct FtpState_ FtpState
FtpDataState_::input
uint8_t * input
Definition: app-layer-ftp.h:205
FTPString_::len
uint16_t len
Definition: app-layer-ftp.h:130
FtpLineState
struct FtpLineState_ FtpLineState
FTP_FIELD_REQUEST_ARGS
@ FTP_FIELD_REQUEST_ARGS
Definition: app-layer-ftp.h:108
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FtpDataState_::detect_flags_tc
uint64_t detect_flags_tc
Definition: app-layer-ftp.h:215
FtpLineState_::db_len
uint32_t db_len
Definition: app-layer-ftp.h:122
FTP_COMMAND_RNFR
@ FTP_COMMAND_RNFR
Definition: app-layer-ftp.h:72
FtpState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:186
FTP_STATE_PORT_DONE
@ FTP_STATE_PORT_DONE
Definition: app-layer-ftp.h:32
FtpLineState_::current_line_db
uint8_t current_line_db
Definition: app-layer-ftp.h:123
FtpState_::TAILQ_HEAD
TAILQ_HEAD(, FTPTransaction_) tx_list
Flow_
Flow data structure.
Definition: flow.h:343
FTPTransaction_::done
bool done
Definition: app-layer-ftp.h:152
FTP_COMMAND_MSND
@ FTP_COMMAND_MSND
Definition: app-layer-ftp.h:59
FTP_COMMAND_EPSV
@ FTP_COMMAND_EPSV
Definition: app-layer-ftp.h:47
FTP_COMMAND_RNTO
@ FTP_COMMAND_RNTO
Definition: app-layer-ftp.h:73
FtpState_::line_state
FtpLineState line_state[2]
Definition: app-layer-ftp.h:184
FTP_COMMAND_MODE
@ FTP_COMMAND_MODE
Definition: app-layer-ftp.h:55
FTP_COMMAND_RMD
@ FTP_COMMAND_RMD
Definition: app-layer-ftp.h:71
FtpDataState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:211
FTP_COMMAND_ABOR
@ FTP_COMMAND_ABOR
Definition: app-layer-ftp.h:38
rust.h
FTP_COMMAND_MKD
@ FTP_COMMAND_MKD
Definition: app-layer-ftp.h:53
FtpCommands
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
Definition: app-layer-ftp.c:73
FtpCommand_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:93
FTP_COMMAND_LIST
@ FTP_COMMAND_LIST
Definition: app-layer-ftp.h:50
FtpCommand_::command_name
const char * command_name
Definition: app-layer-ftp.h:94
FtpDataState_::file_len
int16_t file_len
Definition: app-layer-ftp.h:210
FTPTransaction
struct FTPTransaction_ FTPTransaction
FTPAtExitPrintStats
void FTPAtExitPrintStats(void)
Definition: app-layer-ftp.c:1403
FtpDataState_::direction
uint8_t direction
Definition: app-layer-ftp.h:213
FtpState_::direction
uint8_t direction
Definition: app-layer-ftp.h:169
EveFTPDataAddMetadata
void EveFTPDataAddMetadata(const Flow *f, JsonBuilder *jb)
Definition: app-layer-ftp.c:1441
FTP_COMMAND_HELP
@ FTP_COMMAND_HELP
Definition: app-layer-ftp.h:48
FTPDATA_STATE_IN_PROGRESS
@ FTPDATA_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:199
FTP_COMMAND_SIZE
@ FTP_COMMAND_SIZE
Definition: app-layer-ftp.h:75
FTPDATA_STATE_FINISHED
@ FTPDATA_STATE_FINISHED
Definition: app-layer-ftp.h:200
FTP_COMMAND_CWD
@ FTP_COMMAND_CWD
Definition: app-layer-ftp.h:45
FTP_COMMAND_MSAM
@ FTP_COMMAND_MSAM
Definition: app-layer-ftp.h:58
FTP_COMMAND_SITE
@ FTP_COMMAND_SITE
Definition: app-layer-ftp.h:74
FtpState_
Definition: app-layer-ftp.h:166
FTP_COMMAND_STOU
@ FTP_COMMAND_STOU
Definition: app-layer-ftp.h:79
FtpState_::port_line
uint8_t * port_line
Definition: app-layer-ftp.h:190
FTP_COMMAND_APPE
@ FTP_COMMAND_APPE
Definition: app-layer-ftp.h:41
FtpState_::curr_tx
FTPTransaction * curr_tx
Definition: app-layer-ftp.h:172
FTP_COMMAND_TYPE
@ FTP_COMMAND_TYPE
Definition: app-layer-ftp.h:82
FTP_FIELD_REPONSE_CODE
@ FTP_FIELD_REPONSE_CODE
Definition: app-layer-ftp.h:111
FTPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(FTPTransaction_) next
FTP_COMMAND_PORT
@ FTP_COMMAND_PORT
Definition: app-layer-ftp.h:65
FTP_COMMAND_MAX
@ FTP_COMMAND_MAX
Definition: app-layer-ftp.h:88
FTP_COMMAND_REIN
@ FTP_COMMAND_REIN
Definition: app-layer-ftp.h:68
FtpState_::input
const uint8_t * input
Definition: app-layer-ftp.h:167
JsonGetNextLineFromBuffer
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
Definition: app-layer-ftp.c:1431
FTP_STATE_FINISHED
@ FTP_STATE_FINISHED
Definition: app-layer-ftp.h:33
FtpCommand_
Definition: app-layer-ftp.h:92
FtpState_::arg_offset
FtpRequestCommandArgOfs arg_offset
Definition: app-layer-ftp.h:187
FTPString
struct FTPString_ FTPString
FTP_COMMAND_CHMOD
@ FTP_COMMAND_CHMOD
Definition: app-layer-ftp.h:44
FTP_COMMAND_SYST
@ FTP_COMMAND_SYST
Definition: app-layer-ftp.h:81
FtpDataState
struct FtpDataState_ FtpDataState
FTP_COMMAND_ACCT
@ FTP_COMMAND_ACCT
Definition: app-layer-ftp.h:39
FTP_COMMAND_MRSQ
@ FTP_COMMAND_MRSQ
Definition: app-layer-ftp.h:57
FTP_FIELD_REQUEST_LINE
@ FTP_FIELD_REQUEST_LINE
Definition: app-layer-ftp.h:106
FtpState_::current_line
const uint8_t * current_line
Definition: app-layer-ftp.h:178
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:169
FTPTransaction_::direction
uint8_t direction
Definition: app-layer-ftp.h:155
FTPTransaction_::request_length
uint32_t request_length
Definition: app-layer-ftp.h:145
FTP_FIELD_RESPONSE_LINE
@ FTP_FIELD_RESPONSE_LINE
Definition: app-layer-ftp.h:110
FTP_COMMAND_NOOP
@ FTP_COMMAND_NOOP
Definition: app-layer-ftp.h:62
FtpLineState_
Definition: app-layer-ftp.h:118
FTP_COMMAND_CDUP
@ FTP_COMMAND_CDUP
Definition: app-layer-ftp.h:43
FtpRequestCommandArgOfs
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:99
FTP_COMMAND_PASS
@ FTP_COMMAND_PASS
Definition: app-layer-ftp.h:63
FtpState_::current_line_len
uint32_t current_line_len
Definition: app-layer-ftp.h:180
FTPTransaction_::de_state
DetectEngineState * de_state
Definition: app-layer-ftp.h:160
FtpState_::port_line_len
uint32_t port_line_len
Definition: app-layer-ftp.h:188
FtpState_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:192
FtpState_::logged
uint32_t logged
Definition: app-layer-ftp.h:194
FTP_FIELD_NONE
@ FTP_FIELD_NONE
Definition: app-layer-ftp.h:104
FTP_COMMAND_MRCP
@ FTP_COMMAND_MRCP
Definition: app-layer-ftp.h:56
FTPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, FTPString_) response_list
FtpDataState_
Definition: app-layer-ftp.h:204
FTP_COMMAND_PWD
@ FTP_COMMAND_PWD
Definition: app-layer-ftp.h:66
FTP_COMMAND_STRU
@ FTP_COMMAND_STRU
Definition: app-layer-ftp.h:80
FTP_COMMAND_UNKNOWN
@ FTP_COMMAND_UNKNOWN
Definition: app-layer-ftp.h:37
FTP_COMMAND_MAIL
@ FTP_COMMAND_MAIL
Definition: app-layer-ftp.h:51
FTP_COMMAND_UMASK
@ FTP_COMMAND_UMASK
Definition: app-layer-ftp.h:83
FTPTransaction_::detect_flags_tc
uint64_t detect_flags_tc
Definition: app-layer-ftp.h:139
FTPTransaction_::logged
uint32_t logged
Definition: app-layer-ftp.h:142
FtpState_::tx_cnt
uint64_t tx_cnt
Definition: app-layer-ftp.h:174
FtpResponseCode
uint16_t FtpResponseCode
Definition: app-layer-ftp.h:101
FtpDataState_::de_state
DetectEngineState * de_state
Definition: app-layer-ftp.h:208
FTP_FIELD_REQUEST_COMMAND
@ FTP_FIELD_REQUEST_COMMAND
Definition: app-layer-ftp.h:107
FtpCommand
struct FtpCommand_ FtpCommand
FTP_COMMAND_IDLE
@ FTP_COMMAND_IDLE
Definition: app-layer-ftp.h:49
FtpState_::port_line_size
uint32_t port_line_size
Definition: app-layer-ftp.h:189
FTP_COMMAND_RETR
@ FTP_COMMAND_RETR
Definition: app-layer-ftp.h:70
FTPTransaction_::tx_id
uint64_t tx_id
Definition: app-layer-ftp.h:136
FTPTransaction_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:151
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:175
FTPTransaction_::active
bool active
Definition: app-layer-ftp.h:153
FTP_COMMAND_STOR
@ FTP_COMMAND_STOR
Definition: app-layer-ftp.h:78
FtpDataState_::files
FileContainer * files
Definition: app-layer-ftp.h:207
FTP_COMMAND_MSOM
@ FTP_COMMAND_MSOM
Definition: app-layer-ftp.h:60
FTP_COMMAND_EPRT
@ FTP_COMMAND_EPRT
Definition: app-layer-ftp.h:85
FTPString_
Definition: app-layer-ftp.h:128
FtpLineState_::db
uint8_t * db
Definition: app-layer-ftp.h:121
FtpRequestCommand
FtpRequestCommand
Definition: app-layer-ftp.h:36
FTPTransaction_
Definition: app-layer-ftp.h:134
FTP_FIELD_MAX
@ FTP_FIELD_MAX
Definition: app-layer-ftp.h:114
FTP_COMMAND_REST
@ FTP_COMMAND_REST
Definition: app-layer-ftp.h:69
FTP_STATE_IN_PROGRESS
@ FTP_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:31
FtpState_::current_line_delimiter_len
uint8_t current_line_delimiter_len
Definition: app-layer-ftp.h:181
FTP_COMMAND_PASV
@ FTP_COMMAND_PASV
Definition: app-layer-ftp.h:64
FTP_COMMAND_AUTH_TLS
@ FTP_COMMAND_AUTH_TLS
Definition: app-layer-ftp.h:42
FTPString_::str
uint8_t * str
Definition: app-layer-ftp.h:129
FTP_COMMAND_NLST
@ FTP_COMMAND_NLST
Definition: app-layer-ftp.h:61
FTP_COMMAND_MDTM
@ FTP_COMMAND_MDTM
Definition: app-layer-ftp.h:52
FTP_COMMAND_SMNT
@ FTP_COMMAND_SMNT
Definition: app-layer-ftp.h:76
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1467
FTP_COMMAND_QUIT
@ FTP_COMMAND_QUIT
Definition: app-layer-ftp.h:67
FtpDataState_::file_name
uint8_t * file_name
Definition: app-layer-ftp.h:206
FTPString_::TAILQ_ENTRY
TAILQ_ENTRY(FTPString_) next
FTPTransaction_::detect_flags_ts
uint64_t detect_flags_ts
Definition: app-layer-ftp.h:138
FTP_COMMAND_MLFL
@ FTP_COMMAND_MLFL
Definition: app-layer-ftp.h:54
FTPParserRegisterTests
void FTPParserRegisterTests(void)
Definition: app-layer-ftp.c:1949