Pull request #5007: ftp_telnet: fix ftp_cmd_pipe_index handling

Merge in SNORT/snort3 from ~AMANDIUK/snort3:ftp_multiple_file_download to master

Squashed commit of the following:

commit a344640ab0970b50fa9278ec7d21df753b0d3415
Author: Andrii Mandiuk <amandiuk@cisco.com>
Date:   Mon Nov 24 07:44:48 2025 -0800

    ftp_telnet: fix ftp_cmd_pipe_index handling

diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.cc b/src/service_inspectors/ftp_telnet/ftpp_si.cc
index 75e2670c33202342708a7783da8ffaf3fe367e11..5c2b62b6064c7951b1d081a16962711bc70eb7cc 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftpp_si.cc
+++ b/src/service_inspectors/ftp_telnet/ftpp_si.cc
@@ -409,6 +409,7 @@ static inline int FTPResetsession(FTP_SESSION* Ftpsession)
     Ftpsession->data_chan_state = NO_STATE;
     Ftpsession->data_chan_index = -1;
     Ftpsession->data_xfer_index = -1;
+    Ftpsession->ftp_cmd_pipe_index = 0;
 
     return FTPP_SUCCESS;
 }

diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.h b/src/service_inspectors/ftp_telnet/ftpp_si.h
index 3a2ca37ace88c0ea7cfdb4a1ec0e5babcbf189e9..716b46cd81eb7db70ad7e8837c2656f1fb1ba332 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftpp_si.h
+++ b/src/service_inspectors/ftp_telnet/ftpp_si.h
@@ -162,6 +162,12 @@ struct FTP_SESSION
     int data_chan_state;
     int data_chan_index;
     int data_xfer_index;
+    /* 
+     * Used to keep track of pipelined commands - moved from thread_local storage
+     * to FTP_SESSION structure to avoid cross-session contamination when
+     * processing consecutive packets from different FTP flows.
+     */
+    int ftp_cmd_pipe_index;
     bool data_xfer_dir;
     snort::SfIp clientIP;
     uint16_t clientPort;

diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc
index 9e717e980ddad349a07f209350d7486d30605bab..c69b7e837fd384ff0e5ab35a8cee2ed0a40b69ba 100644 (file)
--- a/src/service_inspectors/ftp_telnet/pp_ftp.cc
+++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc
@@ -50,11 +50,6 @@ using namespace snort;
 #define MAXHOSTNAMELEN 256
 #endif
 
-/*
- * Used to keep track of pipelined commands and the last one
- * that resulted in a
- */
-static THREAD_LOCAL int ftp_cmd_pipe_index = 0;
 /*
  * Function: is_command_valid
  *
@@ -1107,10 +1102,10 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
         }
         else if (session->data_chan_state & DATA_CHAN_PASV_CMD_ISSUED)
         {
-            if (ftp_cmd_pipe_index == session->data_chan_index)
+            if (session->ftp_cmd_pipe_index == session->data_chan_index)
             {
                 if (session->data_xfer_index == -1)
-                    ftp_cmd_pipe_index = 0;
+                    session->ftp_cmd_pipe_index = 0;
                 session->data_chan_index = -1;
 
                 if ( rsp_code >= 227 && rsp_code <= 229 )
@@ -1249,10 +1244,10 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
         }
         else if (session->data_chan_state & DATA_CHAN_PORT_CMD_ISSUED)
         {
-            if (ftp_cmd_pipe_index == session->data_chan_index)
+            if (session->ftp_cmd_pipe_index == session->data_chan_index)
             {
                 if (session->data_xfer_index == -1)
-                    ftp_cmd_pipe_index = 0;
+                    session->ftp_cmd_pipe_index = 0;
                 session->data_chan_index = -1;
                 if (rsp_code == 200)
                 {
@@ -1260,7 +1255,7 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
                     session->data_chan_state |= DATA_CHAN_PORT_CMD_ACCEPT;
                     session->data_chan_index = -1;
                 }
-                else if (ftp_cmd_pipe_index == session->data_chan_index)
+                else if (session->ftp_cmd_pipe_index == session->data_chan_index)
                 {
                     session->data_chan_index = -1;
                     session->data_chan_state &= ~DATA_CHAN_PORT_CMD_ISSUED;
@@ -1269,10 +1264,10 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
         }
         else if (session->data_chan_state & DATA_CHAN_REST_CMD_ISSUED)
         {
-            if (ftp_cmd_pipe_index == session->data_xfer_index)
+            if (session->ftp_cmd_pipe_index == session->data_xfer_index)
             {
                 if (session->data_chan_index == 0)
-                    ftp_cmd_pipe_index = 1;
+                    session->ftp_cmd_pipe_index = 1;
                 session->data_xfer_index = 0;
                 if (rsp_code == 350)
                 {
@@ -1290,10 +1285,10 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
         }
         else if (session->data_chan_state & DATA_CHAN_XFER_CMD_ISSUED)
         {
-            if (ftp_cmd_pipe_index == session->data_xfer_index)
+            if (session->ftp_cmd_pipe_index == session->data_xfer_index)
             {
                 if (session->data_chan_index == -1)
-                    ftp_cmd_pipe_index = 0;
+                    session->ftp_cmd_pipe_index = 0;
 
                 session->data_xfer_index = -1;
 
@@ -1403,7 +1398,7 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
     if (iMode == FTPP_SI_CLIENT_MODE)
     {
         req = &ftpssn->client.request;
-        ftp_cmd_pipe_index = 0;
+        ftpssn->ftp_cmd_pipe_index = 0;
     }
     else if (iMode == FTPP_SI_SERVER_MODE)
     {
@@ -1812,7 +1807,7 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
                 if (CmdConf->data_chan_cmd)
                 {
                     ftpssn->data_chan_state |= DATA_CHAN_PASV_CMD_ISSUED;
-                    ftpssn->data_chan_index = ftp_cmd_pipe_index;
+                    ftpssn->data_chan_index = ftpssn->ftp_cmd_pipe_index;
                     if (ftpssn->data_chan_state & DATA_CHAN_PORT_CMD_ISSUED)
                     {
                         /*
@@ -1833,7 +1828,7 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
                         if ((errno == ERANGE || errno == EINVAL) || (offset > 0))
                         {
                             ftpssn->data_chan_state |= DATA_CHAN_REST_CMD_ISSUED;
-                            ftpssn->data_xfer_index = ftp_cmd_pipe_index;
+                            ftpssn->data_xfer_index = ftpssn->ftp_cmd_pipe_index;
                         }
                     }
                 }
@@ -1878,7 +1873,7 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
                         }
                     }
                     ftpssn->data_chan_state |= DATA_CHAN_XFER_CMD_ISSUED;
-                    ftpssn->data_xfer_index = ftp_cmd_pipe_index;
+                    ftpssn->data_xfer_index = ftpssn->ftp_cmd_pipe_index;
                 }
                 else if (CmdConf->encr_cmd)
                 {
@@ -1939,7 +1934,7 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
         }
 
         if (iMode == FTPP_SI_CLIENT_MODE)
-            ftp_cmd_pipe_index++;
+            ftpssn->ftp_cmd_pipe_index++;
         else if ((rsp_code != 226) && (rsp_code != 426))
         {
             /*
@@ -1949,13 +1944,13 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
              * The 226 may or may not be sent by the server.
              * Both are 2nd response to a transfer command.
              */
-            ftp_cmd_pipe_index++;
+            ftpssn->ftp_cmd_pipe_index++;
         }
     }
 
     if (iMode == FTPP_SI_CLIENT_MODE)
     {
-        ftp_cmd_pipe_index = 0;
+        ftpssn->ftp_cmd_pipe_index = 0;
     }
 
     if (encrypted)