suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Jeff Lucovsky <jeff@lucovsky.org>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_FTP_H
26 #define SURICATA_APP_LAYER_FTP_H
27 
28 #include "rust.h"
29 
30 enum {
34 };
35 
36 typedef enum {
86 
87  /* must be last */
89  /** \todo more if missing.. */
91 
92 typedef struct FtpCommand_ {
93  const char *command_name;
95  const uint8_t command_length;
97 extern const FtpCommand FtpCommands[FTP_COMMAND_MAX + 1];
98 
99 typedef uint32_t FtpRequestCommandArgOfs;
100 
101 /** used to hold the line state when we have fragmentation. */
102 typedef struct FtpLineState_ {
103  /** used to indicate if the current_line buffer is a malloced buffer. We
104  * use a malloced buffer, if a line is fragmented */
105  const uint8_t *buf;
106  uint32_t len;
107  uint8_t delim_len;
108  bool lf_found;
110 
111 typedef struct FTPString_ {
112  uint8_t *str;
113  uint32_t len;
114  bool truncated;
117 
118 typedef struct FTPTransaction_ {
119  /** id of this tx, starting at 0 */
120  uint64_t tx_id;
121 
123 
124  /* for the request */
125  uint32_t request_length;
126  uint8_t *request;
128 
129  /* for the command description */
131 
132  uint16_t dyn_port; /* dynamic port, if applicable */
133  bool done; /* transaction complete? */
134  bool active; /* active or passive mode */
135 
136  uint8_t direction;
137 
138  /* Handle multiple responses */
139  TAILQ_HEAD(, FTPString_) response_list;
140 
143 
144 /** FTP State for app layer parser */
145 typedef struct FtpState_ {
146  bool active;
147 
149  TAILQ_HEAD(, FTPTransaction_) tx_list; /**< transaction list */
150  uint64_t tx_cnt;
151 
154 
157  uint32_t port_line_len;
158  uint32_t port_line_size;
159  uint8_t *port_line;
160 
161  uint16_t dyn_port;
162 
163  AppLayerStateData state_data;
165 
166 enum {
169 };
170 
171 /** FTP Data State for app layer parser */
172 typedef struct FtpDataState_ {
173  uint8_t *input;
174  uint8_t *file_name;
176  int32_t input_len;
177  int16_t file_len;
179  uint8_t state;
180  uint8_t direction;
182  AppLayerStateData state_data;
184 
185 void RegisterFTPParsers(void);
186 void FTPParserRegisterTests(void);
187 void FTPAtExitPrintStats(void);
188 void FTPParserCleanup(void);
189 uint64_t FTPMemuseGlobalCounter(void);
190 uint64_t FTPMemcapGlobalCounter(void);
191 
192 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
193 bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb);
194 
195 #endif /* SURICATA_APP_LAYER_FTP_H */
FTPTransaction_::request_truncated
bool request_truncated
Definition: app-layer-ftp.h:127
FtpCommand_::command_length
const uint8_t command_length
Definition: app-layer-ftp.h:95
FTPTransaction_::command_descriptor
const FtpCommand * command_descriptor
Definition: app-layer-ftp.h:130
FileContainer_
Definition: util-file.h:113
len
uint8_t len
Definition: app-layer-dnp3.h:2
FTP_COMMAND_USER
@ FTP_COMMAND_USER
Definition: app-layer-ftp.h:84
FTP_COMMAND_STAT
@ FTP_COMMAND_STAT
Definition: app-layer-ftp.h:77
FTP_COMMAND_DELE
@ FTP_COMMAND_DELE
Definition: app-layer-ftp.h:46
FTPTransaction_::request
uint8_t * request
Definition: app-layer-ftp.h:126
FtpDataState_::input_len
int32_t input_len
Definition: app-layer-ftp.h:176
FTP_COMMAND_ALLO
@ FTP_COMMAND_ALLO
Definition: app-layer-ftp.h:40
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1289
FtpState_::active
bool active
Definition: app-layer-ftp.h:146
FtpDataState_::state
uint8_t state
Definition: app-layer-ftp.h:179
FtpState
struct FtpState_ FtpState
FtpDataState_::input
uint8_t * input
Definition: app-layer-ftp.h:173
FtpLineState
struct FtpLineState_ FtpLineState
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FTP_COMMAND_RNFR
@ FTP_COMMAND_RNFR
Definition: app-layer-ftp.h:72
FtpState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:155
FtpState_::TAILQ_HEAD
TAILQ_HEAD(, FTPTransaction_) tx_list
FTPTransaction_::done
bool done
Definition: app-layer-ftp.h:133
FTP_COMMAND_MSND
@ FTP_COMMAND_MSND
Definition: app-layer-ftp.h:59
FTP_COMMAND_EPSV
@ FTP_COMMAND_EPSV
Definition: app-layer-ftp.h:47
FTP_COMMAND_RNTO
@ FTP_COMMAND_RNTO
Definition: app-layer-ftp.h:73
FtpState_::current_line_truncated_tc
bool current_line_truncated_tc
Definition: app-layer-ftp.h:153
FTP_COMMAND_MODE
@ FTP_COMMAND_MODE
Definition: app-layer-ftp.h:55
FTPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:122
FTP_COMMAND_RMD
@ FTP_COMMAND_RMD
Definition: app-layer-ftp.h:71
FtpDataState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:178
FTP_COMMAND_ABOR
@ FTP_COMMAND_ABOR
Definition: app-layer-ftp.h:38
rust.h
FTP_COMMAND_MKD
@ FTP_COMMAND_MKD
Definition: app-layer-ftp.h:53
FtpLineState_::buf
const uint8_t * buf
Definition: app-layer-ftp.h:105
FtpCommands
const FtpCommand FtpCommands[FTP_COMMAND_MAX+1]
Definition: app-layer-ftp.c:51
FtpCommand_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:94
FTP_COMMAND_LIST
@ FTP_COMMAND_LIST
Definition: app-layer-ftp.h:50
FtpCommand_::command_name
const char * command_name
Definition: app-layer-ftp.h:93
FtpDataState_::file_len
int16_t file_len
Definition: app-layer-ftp.h:177
FTPTransaction
struct FTPTransaction_ FTPTransaction
FTPAtExitPrintStats
void FTPAtExitPrintStats(void)
Definition: app-layer-ftp.c:1369
FTPString_::len
uint32_t len
Definition: app-layer-ftp.h:113
FtpDataState_::direction
uint8_t direction
Definition: app-layer-ftp.h:180
FTP_COMMAND_HELP
@ FTP_COMMAND_HELP
Definition: app-layer-ftp.h:48
FTPDATA_STATE_IN_PROGRESS
@ FTPDATA_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:167
FTP_COMMAND_SIZE
@ FTP_COMMAND_SIZE
Definition: app-layer-ftp.h:75
FTPString_::truncated
bool truncated
Definition: app-layer-ftp.h:114
FTPDATA_STATE_FINISHED
@ FTPDATA_STATE_FINISHED
Definition: app-layer-ftp.h:168
FTP_STATE_FINISHED
@ FTP_STATE_FINISHED
Definition: app-layer-ftp.h:33
FTP_COMMAND_CWD
@ FTP_COMMAND_CWD
Definition: app-layer-ftp.h:45
FTP_COMMAND_MSAM
@ FTP_COMMAND_MSAM
Definition: app-layer-ftp.h:58
FTP_COMMAND_SITE
@ FTP_COMMAND_SITE
Definition: app-layer-ftp.h:74
FtpState_
Definition: app-layer-ftp.h:145
FTP_COMMAND_STOU
@ FTP_COMMAND_STOU
Definition: app-layer-ftp.h:79
FTP_STATE_IN_PROGRESS
@ FTP_STATE_IN_PROGRESS
Definition: app-layer-ftp.h:31
FtpState_::port_line
uint8_t * port_line
Definition: app-layer-ftp.h:159
FTP_COMMAND_APPE
@ FTP_COMMAND_APPE
Definition: app-layer-ftp.h:41
FtpState_::curr_tx
FTPTransaction * curr_tx
Definition: app-layer-ftp.h:148
FTP_COMMAND_TYPE
@ FTP_COMMAND_TYPE
Definition: app-layer-ftp.h:82
FtpDataState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:182
FTPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(FTPTransaction_) next
FTP_COMMAND_PORT
@ FTP_COMMAND_PORT
Definition: app-layer-ftp.h:65
FTP_COMMAND_MAX
@ FTP_COMMAND_MAX
Definition: app-layer-ftp.h:88
FTP_COMMAND_REIN
@ FTP_COMMAND_REIN
Definition: app-layer-ftp.h:68
FtpLineState_::lf_found
bool lf_found
Definition: app-layer-ftp.h:108
JsonGetNextLineFromBuffer
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
Definition: app-layer-ftp.c:1397
FtpState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:163
FtpCommand_
Definition: app-layer-ftp.h:92
FtpState_::arg_offset
FtpRequestCommandArgOfs arg_offset
Definition: app-layer-ftp.h:156
FTPString
struct FTPString_ FTPString
FTP_COMMAND_CHMOD
@ FTP_COMMAND_CHMOD
Definition: app-layer-ftp.h:44
FTP_COMMAND_SYST
@ FTP_COMMAND_SYST
Definition: app-layer-ftp.h:81
FtpDataState
struct FtpDataState_ FtpDataState
FTP_COMMAND_ACCT
@ FTP_COMMAND_ACCT
Definition: app-layer-ftp.h:39
FTP_COMMAND_MRSQ
@ FTP_COMMAND_MRSQ
Definition: app-layer-ftp.h:57
FtpDataState_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:181
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:167
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1355
FTPTransaction_::direction
uint8_t direction
Definition: app-layer-ftp.h:136
FTPTransaction_::request_length
uint32_t request_length
Definition: app-layer-ftp.h:125
FTP_COMMAND_NOOP
@ FTP_COMMAND_NOOP
Definition: app-layer-ftp.h:62
FtpLineState_
Definition: app-layer-ftp.h:102
FTP_COMMAND_CDUP
@ FTP_COMMAND_CDUP
Definition: app-layer-ftp.h:43
FtpRequestCommandArgOfs
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:99
FTP_COMMAND_PASS
@ FTP_COMMAND_PASS
Definition: app-layer-ftp.h:63
FtpState_::port_line_len
uint32_t port_line_len
Definition: app-layer-ftp.h:157
FtpState_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:161
FTP_COMMAND_MRCP
@ FTP_COMMAND_MRCP
Definition: app-layer-ftp.h:56
FTPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, FTPString_) response_list
FtpDataState_
Definition: app-layer-ftp.h:172
FTP_COMMAND_PWD
@ FTP_COMMAND_PWD
Definition: app-layer-ftp.h:66
FTP_COMMAND_STRU
@ FTP_COMMAND_STRU
Definition: app-layer-ftp.h:80
FTP_COMMAND_UNKNOWN
@ FTP_COMMAND_UNKNOWN
Definition: app-layer-ftp.h:37
FTP_COMMAND_MAIL
@ FTP_COMMAND_MAIL
Definition: app-layer-ftp.h:51
FTP_COMMAND_UMASK
@ FTP_COMMAND_UMASK
Definition: app-layer-ftp.h:83
FtpLineState_::delim_len
uint8_t delim_len
Definition: app-layer-ftp.h:107
FTP_STATE_PORT_DONE
@ FTP_STATE_PORT_DONE
Definition: app-layer-ftp.h:32
FtpState_::tx_cnt
uint64_t tx_cnt
Definition: app-layer-ftp.h:150
FtpState_::current_line_truncated_ts
bool current_line_truncated_ts
Definition: app-layer-ftp.h:152
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
Definition: app-layer-ftp.c:1407
FtpCommand
struct FtpCommand_ FtpCommand
FTP_COMMAND_IDLE
@ FTP_COMMAND_IDLE
Definition: app-layer-ftp.h:49
FtpLineState_::len
uint32_t len
Definition: app-layer-ftp.h:106
FtpState_::port_line_size
uint32_t port_line_size
Definition: app-layer-ftp.h:158
FTP_COMMAND_RETR
@ FTP_COMMAND_RETR
Definition: app-layer-ftp.h:70
FTPTransaction_::tx_id
uint64_t tx_id
Definition: app-layer-ftp.h:120
FTPTransaction_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:132
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:173
FTPTransaction_::active
bool active
Definition: app-layer-ftp.h:134
FTP_COMMAND_STOR
@ FTP_COMMAND_STOR
Definition: app-layer-ftp.h:78
FtpDataState_::files
FileContainer * files
Definition: app-layer-ftp.h:175
FTP_COMMAND_MSOM
@ FTP_COMMAND_MSOM
Definition: app-layer-ftp.h:60
FTP_COMMAND_EPRT
@ FTP_COMMAND_EPRT
Definition: app-layer-ftp.h:85
FTPString_
Definition: app-layer-ftp.h:111
FtpRequestCommand
FtpRequestCommand
Definition: app-layer-ftp.h:36
FTPTransaction_
Definition: app-layer-ftp.h:118
FTP_COMMAND_REST
@ FTP_COMMAND_REST
Definition: app-layer-ftp.h:69
FTP_COMMAND_PASV
@ FTP_COMMAND_PASV
Definition: app-layer-ftp.h:64
FTP_COMMAND_AUTH_TLS
@ FTP_COMMAND_AUTH_TLS
Definition: app-layer-ftp.h:42
FTPString_::str
uint8_t * str
Definition: app-layer-ftp.h:112
FTP_COMMAND_NLST
@ FTP_COMMAND_NLST
Definition: app-layer-ftp.h:61
FTP_COMMAND_MDTM
@ FTP_COMMAND_MDTM
Definition: app-layer-ftp.h:52
FTP_COMMAND_SMNT
@ FTP_COMMAND_SMNT
Definition: app-layer-ftp.h:76
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1432
FTP_COMMAND_QUIT
@ FTP_COMMAND_QUIT
Definition: app-layer-ftp.h:67
FtpDataState_::file_name
uint8_t * file_name
Definition: app-layer-ftp.h:174
FTPString_::TAILQ_ENTRY
TAILQ_ENTRY(FTPString_) next
FTP_COMMAND_MLFL
@ FTP_COMMAND_MLFL
Definition: app-layer-ftp.h:54
FTPParserRegisterTests
void FTPParserRegisterTests(void)
Definition: app-layer-ftp.c:1567