ftp: support APPE data channels

Support APPE on the FTP data channel.

Ticket: OISF#8664

Author: jasonish

doc/userguide/rules/ftp-keywords.rst

@@ -7,12 +7,12 @@ ftpdata_command
 ---------------
 
 Filter ftp-data channel based on command used on the FTP command channel.
-Currently supported commands are RETR (get on a file) and STOR (put on a
-file).
+Currently supported commands are STOR and APPE (put/upload a file), RETR (get a
+file), and NLST, LIST and MLSD (list directory contents).
 
 Syntax::
 
-  ftpdata_command:(retr|stor)
+  ftpdata_command:(stor|appe|retr|nlst|list|mlsd)
 
 Signature Example:
 

src/app-layer-ftp.c

@@ -480,7 +480,8 @@ static AppLayerResult FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserSt
          * For ftp active mode, data connection direction is opposite to
          * control direction.
          */
-        if ((state->active && state->command == FTP_COMMAND_STOR) ||
+        if ((state->active &&
+                    (state->command == FTP_COMMAND_STOR || state->command == FTP_COMMAND_APPE)) ||
                 (!state->active &&
                         (state->command == FTP_COMMAND_RETR || state->command == FTP_COMMAND_NLST ||
                                 state->command == FTP_COMMAND_LIST ||
@@ -515,6 +516,8 @@ static AppLayerResult FTPParseRequest(Flow *f, void *ftp_state, AppLayerParserSt
             case FTP_COMMAND_RETR:
                 // fallthrough
             case FTP_COMMAND_STOR:
+                // fallthrough
+            case FTP_COMMAND_APPE:
                 /* Ensure that there is a negotiated dyn port and a file
                  * name -- need more than 5 chars: cmd [4], space, <filename>
                  */
@@ -1094,6 +1097,11 @@ static AppLayerResult FTPDataParse(Flow *f, FtpDataState *ftpdata_state,
                 SCLogDebug("STOR data to %s",
                         (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
                 break;
+            case FTP_COMMAND_APPE:
+                ftpdata_state->direction = data->direction;
+                SCLogDebug("APPE data to %s",
+                        (ftpdata_state->direction & STREAM_TOSERVER) ? "toserver" : "toclient");
+                break;
             case FTP_COMMAND_RETR:
                 ftpdata_state->direction = data->direction;
                 SCLogDebug("RETR data to %s",
@@ -1465,6 +1473,9 @@ bool EveFTPDataAddMetadata(void *vtx, SCJsonBuilder *jb)
         case FTP_COMMAND_STOR:
             JB_SET_STRING(jb, "command", "STOR");
             break;
+        case FTP_COMMAND_APPE:
+            JB_SET_STRING(jb, "command", "APPE");
+            break;
         case FTP_COMMAND_RETR:
             JB_SET_STRING(jb, "command", "RETR");
             break;
@@ -1624,6 +1635,50 @@ static int FTPParserTest12(void)
     StreamTcpFreeConfig(true);
     PASS;
 }
+
+/** \test Supply APPE without a filename */
+static int FTPParserTest13(void)
+{
+    Flow f;
+    uint8_t ftpbuf1[] = "PORT 192,168,1,1,0,80\r\n";
+    uint8_t ftpbuf2[] = "APPE\r\n";
+    uint8_t ftpbuf3[] = "227 OK\r\n";
+    TcpSession ssn;
+
+    AppLayerParserThreadCtx *alp_tctx = AppLayerParserThreadCtxAlloc();
+
+    memset(&f, 0, sizeof(f));
+    memset(&ssn, 0, sizeof(ssn));
+
+    f.protoctx = (void *)&ssn;
+    f.proto = IPPROTO_TCP;
+    f.alproto = ALPROTO_FTP;
+
+    StreamTcpInitConfig(true);
+
+    int r = AppLayerParserParse(NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER | STREAM_START,
+            ftpbuf1, sizeof(ftpbuf1) - 1);
+    FAIL_IF(r != 0);
+
+    /* Response */
+    r = AppLayerParserParse(
+            NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOCLIENT, ftpbuf3, sizeof(ftpbuf3) - 1);
+    FAIL_IF(r != 0);
+
+    r = AppLayerParserParse(
+            NULL, alp_tctx, &f, ALPROTO_FTP, STREAM_TOSERVER, ftpbuf2, sizeof(ftpbuf2) - 1);
+    FAIL_IF(r != 0);
+
+    FtpState *ftp_state = f.alstate;
+    FAIL_IF_NULL(ftp_state);
+
+    FAIL_IF(ftp_state->command != FTP_COMMAND_APPE);
+
+    FLOW_DESTROY(&f);
+    AppLayerParserThreadCtxFree(alp_tctx);
+    StreamTcpFreeConfig(true);
+    PASS;
+}
 #endif /* UNITTESTS */
 
 void FTPParserRegisterTests(void)
@@ -1632,6 +1687,7 @@ void FTPParserRegisterTests(void)
     UtRegisterTest("FTPParserTest01", FTPParserTest01);
     UtRegisterTest("FTPParserTest11", FTPParserTest11);
     UtRegisterTest("FTPParserTest12", FTPParserTest12);
+    UtRegisterTest("FTPParserTest13", FTPParserTest13);
 #endif /* UNITTESTS */
 }
 

src/detect-ftpdata.c

@@ -37,7 +37,7 @@
 /**
  * \brief Regex for parsing our keyword options
  */
-#define PARSE_REGEX "^\\s*(stor|retr|nlst|list|mlsd)\\s*$"
+#define PARSE_REGEX "^\\s*(stor|appe|retr|nlst|list|mlsd)\\s*$"
 static DetectParseRegex parse_regex;
 
 /* Prototypes of functions registered in DetectFtpdataRegister below */
@@ -143,6 +143,8 @@ static DetectFtpdataData *DetectFtpdataParse(const char *ftpcommandstr)
         goto error;
     if (!strcmp(arg1, "stor")) {
         ftpcommandd->command = FTP_COMMAND_STOR;
+    } else if (!strcmp(arg1, "appe")) {
+        ftpcommandd->command = FTP_COMMAND_APPE;
     } else if (!strcmp(arg1, "retr")) {
         ftpcommandd->command = FTP_COMMAND_RETR;
     } else if (!strcmp(arg1, "nlst")) {
@@ -218,6 +220,11 @@ static int DetectFtpdataParseTest01(void)
     FAIL_IF(!(ftpcommandd->command == FTP_COMMAND_STOR));
     DetectFtpdataFree(NULL, ftpcommandd);
 
+    ftpcommandd = DetectFtpdataParse("appe");
+    FAIL_IF_NULL(ftpcommandd);
+    FAIL_IF(!(ftpcommandd->command == FTP_COMMAND_APPE));
+    DetectFtpdataFree(NULL, ftpcommandd);
+
     ftpcommandd = DetectFtpdataParse("list");
     FAIL_IF_NULL(ftpcommandd);
     FAIL_IF(!(ftpcommandd->command == FTP_COMMAND_LIST));
@@ -240,13 +247,16 @@ static int DetectFtpdataSignatureTest01(void)
     sig = DetectEngineAppendSig(de_ctx, "alert ip any any -> any any (ftpdata_command:retr; sid:2; rev:1;)");
     FAIL_IF_NULL(sig);
     sig = DetectEngineAppendSig(
-            de_ctx, "alert ip any any -> any any (ftpdata_command:list; sid:3; rev:1;)");
+            de_ctx, "alert ip any any -> any any (ftpdata_command:appe; sid:3; rev:1;)");
+    FAIL_IF_NULL(sig);
+    sig = DetectEngineAppendSig(
+            de_ctx, "alert ip any any -> any any (ftpdata_command:list; sid:4; rev:1;)");
     FAIL_IF_NULL(sig);
     sig = DetectEngineAppendSig(
-            de_ctx, "alert ip any any -> any any (ftpdata_command:mlsd; sid:4; rev:1;)");
+            de_ctx, "alert ip any any -> any any (ftpdata_command:mlsd; sid:5; rev:1;)");
     FAIL_IF_NULL(sig);
     sig = DetectEngineAppendSig(
-            de_ctx, "alert ip any any -> any any (ftpdata_command:xxx; sid:5; rev:1;)");
+            de_ctx, "alert ip any any -> any any (ftpdata_command:xxx; sid:6; rev:1;)");
     FAIL_IF_NOT_NULL(sig);
 
     DetectEngineCtxFree(de_ctx);