suricata
detect-ftp-completion-code.c
Go to the documentation of this file.
1 /* Copyright (C) 2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  *
20  * \author Jeff Lucovsky <jlucovsky@oisf.net>
21  *
22  * Implements the ftp.completion-code sticky buffer
23  *
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "detect.h"
29 #include "detect-parse.h"
30 #include "detect-engine.h"
31 #include "detect-engine-buffer.h"
32 #include "detect-engine-helper.h"
34 
35 #include "app-layer.h"
36 #include "app-layer-ftp.h"
37 
38 #include "flow.h"
39 
40 #include "util-debug.h"
41 
42 #define KEYWORD_NAME "ftp.completion_code"
43 #define KEYWORD_DOC "ftp-keywords.html#ftp-completion_code"
44 #define BUFFER_NAME "ftp.completion_code"
45 #define BUFFER_DESC "ftp completion code"
46 
47 static int g_ftp_ccode_buffer_id = 0;
48 
49 static int DetectFtpCompletionCodeSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
50 {
51  if (SCDetectBufferSetActiveList(de_ctx, s, g_ftp_ccode_buffer_id) < 0)
52  return -1;
53 
55  return -1;
56 
57  return 0;
58 }
59 
60 static bool DetectFTPCompletionCodeGetData(DetectEngineThreadCtx *_det_ctx, const void *txv,
61  uint8_t _flow_flags, uint32_t index, const uint8_t **buffer, uint32_t *buffer_len)
62 {
63  FTPTransaction *tx = (FTPTransaction *)txv;
64 
65  if (tx->command_descriptor.command_code == FTP_COMMAND_UNKNOWN)
66  return false;
67 
68  if (!TAILQ_EMPTY(&tx->response_list)) {
69  uint32_t count = 0;
70  FTPResponseWrapper *wrapper;
71  TAILQ_FOREACH (wrapper, &tx->response_list, next) {
72  DEBUG_VALIDATE_BUG_ON(wrapper->response == NULL);
73  if (index == count) {
74  *buffer = (const uint8_t *)wrapper->response->code;
75  *buffer_len = (uint32_t)wrapper->response->code_length;
76  return true;
77  }
78  count++;
79  }
80  }
81 
82  *buffer = NULL;
83  *buffer_len = 0;
84  return false;
85 }
86 
88 {
89  /* ftp.completion_code sticky buffer */
92  "sticky buffer to match on the FTP completion code buffer";
94  sigmatch_table[DETECT_FTP_COMPLETION_CODE].Setup = DetectFtpCompletionCodeSetup;
96 
98  BUFFER_NAME, ALPROTO_FTP, SIG_FLAG_TOCLIENT, 0, DetectFTPCompletionCodeGetData, 2);
99 
101 
102  g_ftp_ccode_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
103 
104  SCLogDebug("registering " BUFFER_NAME " rule option");
105 }
BUFFER_DESC
#define BUFFER_DESC
Definition: detect-ftp-completion-code.c:45
SigTableElmt_::url
const char * url
Definition: detect.h:1422
detect-engine.h
SigTableElmt_::desc
const char * desc
Definition: detect.h:1421
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:79
SigTableElmt_::name
const char * name
Definition: detect.h:1419
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:270
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
detect-ftp-completion-code.h
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1413
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:919
TAILQ_EMPTY
#define TAILQ_EMPTY(head)
Definition: queue.h:248
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:252
ALPROTO_FTP
@ ALPROTO_FTP
Definition: app-layer-protos.h:37
SCDetectBufferSetActiveList
int SCDetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine-buffer.c:29
FTPResponseWrapper_
Definition: app-layer-ftp.h:44
SCDetectSignatureSetAppProto
int SCDetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:2212
app-layer-ftp.h
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:272
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1404
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1256
KEYWORD_NAME
#define KEYWORD_NAME
Definition: detect-ftp-completion-code.c:42
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1211
detect.h
detect-engine-helper.h
FTPTransaction_::command_descriptor
FtpCommandInfo command_descriptor
Definition: app-layer-ftp.h:72
FtpCommandInfo_::command_code
FtpRequestCommand command_code
Definition: app-layer-ftp.h:57
FTPResponseWrapper_::response
FTPResponseLine * response
Definition: app-layer-ftp.h:45
DetectFtpCompletionCodeRegister
void DetectFtpCompletionCodeRegister(void)
Definition: detect-ftp-completion-code.c:87
BUFFER_NAME
#define BUFFER_NAME
Definition: detect-ftp-completion-code.c:44
DETECT_FTP_COMPLETION_CODE
@ DETECT_FTP_COMPLETION_CODE
Definition: detect-engine-register.h:337
suricata-common.h
detect-engine-buffer.h
str
#define str(s)
Definition: suricata-common.h:308
detect-parse.h
Signature_
Signature container.
Definition: detect.h:657
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1611
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1353
KEYWORD_DOC
#define KEYWORD_DOC
Definition: detect-ftp-completion-code.c:43
DetectAppLayerMultiRegister
void DetectAppLayerMultiRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectionMultiBufferGetDataPtr GetData, int priority)
Definition: detect-engine.c:2086
flow.h
FTPTransaction_
Definition: app-layer-ftp.h:60
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
app-layer.h