suricata
detect-ftp-command.c
Go to the documentation of this file.
1
/* Copyright (C) 2025 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
*
20
* \author Jeff Lucovsky <jlucovsky@oisf.net>
21
*
22
* Implements the ftp.command sticky buffer
23
*
24
*/
25
26
#include "
suricata-common.h
"
27
#include "
detect.h
"
28
29
#include "
detect-parse.h
"
30
#include "
detect-engine.h
"
31
#include "
detect-engine-buffer.h
"
32
#include "
detect-engine-helper.h
"
33
34
#include "
flow.h
"
35
36
#include "
app-layer.h
"
37
#include "
app-layer-ftp.h
"
38
39
#include "
detect-ftp-command.h
"
40
41
#define KEYWORD_NAME "ftp.command"
42
#define KEYWORD_DOC "ftp-keywords.html#ftp-command"
43
#define BUFFER_NAME "ftp.command"
44
#define BUFFER_DESC "ftp command"
45
46
static
int
g_ftp_cmd_buffer_id = 0;
47
48
static
int
DetectFtpCommandSetup(
DetectEngineCtx
*
de_ctx
,
Signature
*s,
const
char
*
str
)
49
{
50
if
(
SCDetectBufferSetActiveList
(
de_ctx
, s, g_ftp_cmd_buffer_id) < 0)
51
return
-1;
52
53
if
(
SCDetectSignatureSetAppProto
(s,
ALPROTO_FTP
) < 0)
54
return
-1;
55
56
return
0;
57
}
58
59
static
bool
DetectFTPCommandGetData(
60
const
void
*txv,
const
uint8_t _flow_flags,
const
uint8_t **buffer, uint32_t *buffer_len)
61
{
62
FTPTransaction
*tx = (
FTPTransaction
*)txv;
63
64
if
(tx->
command_descriptor
.
command_code
== FTP_COMMAND_UNKNOWN)
65
return
false
;
66
67
uint8_t b_len = 0;
68
if
(SCGetFtpCommandInfo(
69
tx->
command_descriptor
.
command_index
, (
const
char
**)buffer, NULL, &b_len)) {
70
*buffer_len = b_len;
71
return
true
;
72
}
else
{
73
return
false
;
74
}
75
}
76
77
void
DetectFtpCommandRegister
(
void
)
78
{
79
/* ftp.command sticky buffer */
80
sigmatch_table
[
DETECT_FTP_COMMAND
].
name
=
KEYWORD_NAME
;
81
sigmatch_table
[
DETECT_FTP_COMMAND
].
desc
=
"sticky buffer to match on the FTP command buffer"
;
82
sigmatch_table
[
DETECT_FTP_COMMAND
].
url
=
"/rules/"
KEYWORD_DOC
;
83
sigmatch_table
[
DETECT_FTP_COMMAND
].
Setup
= DetectFtpCommandSetup;
84
sigmatch_table
[
DETECT_FTP_COMMAND
].
flags
|=
SIGMATCH_NOOPT
;
85
86
g_ftp_cmd_buffer_id =
SCDetectHelperBufferMpmRegister
(
87
BUFFER_NAME
,
BUFFER_DESC
,
ALPROTO_FTP
, STREAM_TOSERVER, DetectFTPCommandGetData);
88
89
SCLogDebug
(
"registering "
BUFFER_NAME
" rule option"
);
90
}
SigTableElmt_::url
const char * url
Definition:
detect.h:1422
detect-engine.h
DetectFtpCommandRegister
void DetectFtpCommandRegister(void)
Definition:
detect-ftp-command.c:77
SigTableElmt_::desc
const char * desc
Definition:
detect.h:1421
sigmatch_table
SigTableElmt * sigmatch_table
Definition:
detect-parse.c:79
SigTableElmt_::name
const char * name
Definition:
detect.h:1419
SCLogDebug
#define SCLogDebug(...)
Definition:
util-debug.h:270
SigTableElmt_::flags
uint16_t flags
Definition:
detect.h:1413
DetectEngineCtx_
main detection engine ctx
Definition:
detect.h:919
BUFFER_DESC
#define BUFFER_DESC
Definition:
detect-ftp-command.c:44
ALPROTO_FTP
@ ALPROTO_FTP
Definition:
app-layer-protos.h:37
KEYWORD_DOC
#define KEYWORD_DOC
Definition:
detect-ftp-command.c:42
SCDetectBufferSetActiveList
int SCDetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition:
detect-engine-buffer.c:29
SCDetectHelperBufferMpmRegister
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
Definition:
detect-engine-helper.c:47
SCDetectSignatureSetAppProto
int SCDetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition:
detect-parse.c:2212
app-layer-ftp.h
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition:
detect.h:1404
de_ctx
DetectEngineCtx * de_ctx
Definition:
fuzz_siginit.c:18
detect.h
KEYWORD_NAME
#define KEYWORD_NAME
Definition:
detect-ftp-command.c:41
detect-engine-helper.h
FTPTransaction_::command_descriptor
FtpCommandInfo command_descriptor
Definition:
app-layer-ftp.h:72
FtpCommandInfo_::command_code
FtpRequestCommand command_code
Definition:
app-layer-ftp.h:57
suricata-common.h
detect-ftp-command.h
detect-engine-buffer.h
str
#define str(s)
Definition:
suricata-common.h:308
detect-parse.h
Signature_
Signature container.
Definition:
detect.h:657
FtpCommandInfo_::command_index
uint8_t command_index
Definition:
app-layer-ftp.h:56
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition:
detect.h:1611
flow.h
FTPTransaction_
Definition:
app-layer-ftp.h:60
DETECT_FTP_COMMAND
@ DETECT_FTP_COMMAND
Definition:
detect-engine-register.h:332
BUFFER_NAME
#define BUFFER_NAME
Definition:
detect-ftp-command.c:43
app-layer.h
src
detect-ftp-command.c
Generated on Sun Jun 1 2025 23:30:30 for suricata by
1.8.18