suricata
app-layer-ftp.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Pablo Rincon Crespo <pablo.rincon.crespo@gmail.com>
22  * \author Jeff Lucovsky <jeff@lucovsky.org>
23  */
24 
25 #ifndef SURICATA_APP_LAYER_FTP_H
26 #define SURICATA_APP_LAYER_FTP_H
27 
28 #include "rust.h"
29 
30 struct FtpCommand;
31 
32 typedef uint32_t FtpRequestCommandArgOfs;
33 
34 /** used to hold the line state when we have fragmentation. */
35 typedef struct FtpLineState_ {
36  /** used to indicate if the current_line buffer is a malloced buffer. We
37  * use a malloced buffer, if a line is fragmented */
38  const uint8_t *buf;
39  uint32_t len;
40  uint8_t delim_len;
41  bool lf_found;
43 
44 typedef struct FTPString_ {
45  uint8_t *str;
46  uint32_t len;
47  bool truncated;
50 
51 /*
52  * These are the values for the table index value and the FTP command
53  * enum value. These *should* be the same if the enum and command insertion
54  * order remain the same. However, we store each value to protect against
55  * drift between enum and insertion order.
56  */
57 typedef struct FtpCommandInfo_ {
58  uint8_t command_index;
59  FtpRequestCommand command_code;
61 
62 typedef struct FTPTransaction_ {
63  /** id of this tx, starting at 0 */
64  uint64_t tx_id;
65 
67 
68  /* for the request */
69  uint32_t request_length;
70  uint8_t *request;
72 
73  /* for the command description */
75 
76  uint16_t dyn_port; /* dynamic port, if applicable */
77  bool done; /* transaction complete? */
78  bool active; /* active or passive mode */
79 
80  uint8_t direction;
81 
82  /* Handle multiple responses */
83  TAILQ_HEAD(, FTPString_) response_list;
84 
87 
88 /** FTP State for app layer parser */
89 typedef struct FtpState_ {
90  bool active;
91 
93  TAILQ_HEAD(, FTPTransaction_) tx_list; /**< transaction list */
94  uint64_t tx_cnt;
95 
98 
99  FtpRequestCommand command;
101  uint32_t port_line_len;
102  uint32_t port_line_size;
103  uint8_t *port_line;
104 
105  uint16_t dyn_port;
106 
107  AppLayerStateData state_data;
109 
110 /** FTP Data State for app layer parser */
111 typedef struct FtpDataState_ {
112  uint8_t *input;
113  uint8_t *file_name;
115  int32_t input_len;
116  int16_t file_len;
117  FtpRequestCommand command;
118  uint8_t state;
119  uint8_t direction;
121  AppLayerStateData state_data;
123 
124 void RegisterFTPParsers(void);
125 void FTPParserRegisterTests(void);
126 void FTPParserCleanup(void);
127 int FTPSetMemcap(uint64_t size);
128 uint64_t FTPMemuseGlobalCounter(void);
129 uint64_t FTPMemcapGlobalCounter(void);
130 
131 uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len);
132 bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb);
133 
134 #endif /* SURICATA_APP_LAYER_FTP_H */
FTPTransaction_::request_truncated
bool request_truncated
Definition: app-layer-ftp.h:71
FileContainer_
Definition: util-file.h:113
len
uint8_t len
Definition: app-layer-dnp3.h:2
FTPTransaction_::request
uint8_t * request
Definition: app-layer-ftp.h:70
FtpDataState_::input_len
int32_t input_len
Definition: app-layer-ftp.h:115
RegisterFTPParsers
void RegisterFTPParsers(void)
Definition: app-layer-ftp.c:1259
FtpState_::active
bool active
Definition: app-layer-ftp.h:90
FtpDataState_::state
uint8_t state
Definition: app-layer-ftp.h:118
FtpState
struct FtpState_ FtpState
FtpDataState_::input
uint8_t * input
Definition: app-layer-ftp.h:112
FtpLineState
struct FtpLineState_ FtpLineState
FtpCommandInfo_
Definition: app-layer-ftp.h:57
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
FtpState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:99
FtpState_::TAILQ_HEAD
TAILQ_HEAD(, FTPTransaction_) tx_list
FTPTransaction_::done
bool done
Definition: app-layer-ftp.h:77
FtpState_::current_line_truncated_tc
bool current_line_truncated_tc
Definition: app-layer-ftp.h:97
FTPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:66
FtpDataState_::command
FtpRequestCommand command
Definition: app-layer-ftp.h:117
rust.h
FtpLineState_::buf
const uint8_t * buf
Definition: app-layer-ftp.h:38
FtpDataState_::file_len
int16_t file_len
Definition: app-layer-ftp.h:116
FTPTransaction
struct FTPTransaction_ FTPTransaction
FtpCommandInfo
struct FtpCommandInfo_ FtpCommandInfo
FTPString_::len
uint32_t len
Definition: app-layer-ftp.h:46
FtpDataState_::direction
uint8_t direction
Definition: app-layer-ftp.h:119
FTPString_::truncated
bool truncated
Definition: app-layer-ftp.h:47
FtpState_
Definition: app-layer-ftp.h:89
FtpState_::port_line
uint8_t * port_line
Definition: app-layer-ftp.h:103
FtpState_::curr_tx
FTPTransaction * curr_tx
Definition: app-layer-ftp.h:92
FtpDataState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:121
FTPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(FTPTransaction_) next
FtpLineState_::lf_found
bool lf_found
Definition: app-layer-ftp.h:41
JsonGetNextLineFromBuffer
uint16_t JsonGetNextLineFromBuffer(const char *buffer, const uint16_t len)
Definition: app-layer-ftp.c:1358
FtpState_::state_data
AppLayerStateData state_data
Definition: app-layer-ftp.h:107
FTPTransaction_::command_descriptor
FtpCommandInfo command_descriptor
Definition: app-layer-ftp.h:74
FtpCommandInfo_::command_code
FtpRequestCommand command_code
Definition: app-layer-ftp.h:59
FtpState_::arg_offset
FtpRequestCommandArgOfs arg_offset
Definition: app-layer-ftp.h:100
FTPString
struct FTPString_ FTPString
FtpDataState
struct FtpDataState_ FtpDataState
FtpDataState_::tx_data
AppLayerTxData tx_data
Definition: app-layer-ftp.h:120
FTPMemuseGlobalCounter
uint64_t FTPMemuseGlobalCounter(void)
Definition: app-layer-ftp.c:77
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1389
FTPTransaction_::direction
uint8_t direction
Definition: app-layer-ftp.h:80
FTPTransaction_::request_length
uint32_t request_length
Definition: app-layer-ftp.h:69
FtpLineState_
Definition: app-layer-ftp.h:35
FtpRequestCommandArgOfs
uint32_t FtpRequestCommandArgOfs
Definition: app-layer-ftp.h:30
FtpState_::port_line_len
uint32_t port_line_len
Definition: app-layer-ftp.h:101
FtpState_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:105
FTPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, FTPString_) response_list
FtpDataState_
Definition: app-layer-ftp.h:111
FtpLineState_::delim_len
uint8_t delim_len
Definition: app-layer-ftp.h:40
FtpCommandInfo_::command_index
uint8_t command_index
Definition: app-layer-ftp.h:58
FtpState_::tx_cnt
uint64_t tx_cnt
Definition: app-layer-ftp.h:94
FtpState_::current_line_truncated_ts
bool current_line_truncated_ts
Definition: app-layer-ftp.h:96
EveFTPDataAddMetadata
bool EveFTPDataAddMetadata(void *vtx, JsonBuilder *jb)
Definition: app-layer-ftp.c:1368
FTPSetMemcap
int FTPSetMemcap(uint64_t size)
Definition: app-layer-ftp.c:89
FtpLineState_::len
uint32_t len
Definition: app-layer-ftp.h:39
FtpState_::port_line_size
uint32_t port_line_size
Definition: app-layer-ftp.h:102
FTPTransaction_::tx_id
uint64_t tx_id
Definition: app-layer-ftp.h:64
FTPTransaction_::dyn_port
uint16_t dyn_port
Definition: app-layer-ftp.h:76
FTPMemcapGlobalCounter
uint64_t FTPMemcapGlobalCounter(void)
Definition: app-layer-ftp.c:83
FTPTransaction_::active
bool active
Definition: app-layer-ftp.h:78
FtpDataState_::files
FileContainer * files
Definition: app-layer-ftp.h:114
FTPString_
Definition: app-layer-ftp.h:44
FTPTransaction_
Definition: app-layer-ftp.h:62
FTPString_::str
uint8_t * str
Definition: app-layer-ftp.h:45
FTPParserCleanup
void FTPParserCleanup(void)
Free memory allocated for global FTP parser state.
Definition: app-layer-ftp.c:1393
FtpDataState_::file_name
uint8_t * file_name
Definition: app-layer-ftp.h:113
FTPString_::TAILQ_ENTRY
TAILQ_ENTRY(FTPString_) next
FTPParserRegisterTests
void FTPParserRegisterTests(void)
Definition: app-layer-ftp.c:1528