suricata
detect-ftp-command.c
Go to the documentation of this file.
1 /* Copyright (C) 2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  *
20  * \author Jeff Lucovsky <jlucovsky@oisf.net>
21  *
22  * Implements the ftp.command sticky buffer
23  *
24  */
25 
26 #include "suricata-common.h"
27 #include "detect.h"
28 
29 #include "detect-parse.h"
30 #include "detect-engine.h"
31 #include "detect-engine-buffer.h"
32 #include "detect-engine-helper.h"
33 
34 #include "flow.h"
35 
36 #include "app-layer.h"
37 #include "app-layer-ftp.h"
38 
39 #include "detect-ftp-command.h"
40 
41 #define KEYWORD_NAME "ftp.command"
42 #define KEYWORD_DOC "ftp-keywords.html#ftp-command"
43 #define BUFFER_NAME "ftp.command"
44 #define BUFFER_DESC "ftp command"
45 
46 static int g_ftp_cmd_buffer_id = 0;
47 
48 static int DetectFtpCommandSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
49 {
50  if (SCDetectBufferSetActiveList(de_ctx, s, g_ftp_cmd_buffer_id) < 0)
51  return -1;
52 
54  return -1;
55 
56  return 0;
57 }
58 
59 static bool DetectFTPCommandGetData(
60  const void *txv, const uint8_t _flow_flags, const uint8_t **buffer, uint32_t *buffer_len)
61 {
62  FTPTransaction *tx = (FTPTransaction *)txv;
63 
64  if (tx->command_descriptor.command_code == FTP_COMMAND_UNKNOWN)
65  return false;
66 
67  uint8_t b_len = 0;
68  if (SCGetFtpCommandInfo(
69  tx->command_descriptor.command_index, (const char **)buffer, NULL, &b_len)) {
70  *buffer_len = b_len;
71  return true;
72  } else {
73  return false;
74  }
75 }
76 
78 {
79  /* ftp.command sticky buffer */
81  sigmatch_table[DETECT_FTP_COMMAND].desc = "sticky buffer to match on the FTP command buffer";
83  sigmatch_table[DETECT_FTP_COMMAND].Setup = DetectFtpCommandSetup;
85 
86  g_ftp_cmd_buffer_id = SCDetectHelperBufferMpmRegister(
87  BUFFER_NAME, BUFFER_DESC, ALPROTO_FTP, STREAM_TOSERVER, DetectFTPCommandGetData);
88 
89  SCLogDebug("registering " BUFFER_NAME " rule option");
90 }
SigTableElmt_::url
const char * url
Definition: detect.h:1422
detect-engine.h
DetectFtpCommandRegister
void DetectFtpCommandRegister(void)
Definition: detect-ftp-command.c:77
SigTableElmt_::desc
const char * desc
Definition: detect.h:1421
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SigTableElmt_::name
const char * name
Definition: detect.h:1419
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:270
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1413
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:919
BUFFER_DESC
#define BUFFER_DESC
Definition: detect-ftp-command.c:44
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
KEYWORD_DOC
#define KEYWORD_DOC
Definition: detect-ftp-command.c:42
SCDetectBufferSetActiveList
int SCDetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine-buffer.c:29
SCDetectHelperBufferMpmRegister
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto, uint8_t direction, InspectionSingleBufferGetDataPtr GetData)
Definition: detect-engine-helper.c:47
SCDetectSignatureSetAppProto
int SCDetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:2212
app-layer-ftp.h
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1404
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
detect.h
KEYWORD_NAME
#define KEYWORD_NAME
Definition: detect-ftp-command.c:41
detect-engine-helper.h
FTPTransaction_::command_descriptor
FtpCommandInfo command_descriptor
Definition: app-layer-ftp.h:72
FtpCommandInfo_::command_code
FtpRequestCommand command_code
Definition: app-layer-ftp.h:57
suricata-common.h
detect-ftp-command.h
detect-engine-buffer.h
str
#define str(s)
Definition: suricata-common.h:308
detect-parse.h
Signature_
Signature container.
Definition: detect.h:657
FtpCommandInfo_::command_index
uint8_t command_index
Definition: app-layer-ftp.h:56
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1611
flow.h
FTPTransaction_
Definition: app-layer-ftp.h:60
DETECT_FTP_COMMAND
@ DETECT_FTP_COMMAND
Definition: detect-engine-register.h:332
BUFFER_NAME
#define BUFFER_NAME
Definition: detect-ftp-command.c:43
app-layer.h