Function ExtractDataChannel

decoder/stream/ftp/ftp_reader.go:424–457

ExtractDataChannel extracts file from FTP data channel

(conv *core.ConversationInfo, data []byte, conn *FTPDataConnection)

// ExtractDataChannel extracts file from FTP data channel
func ExtractDataChannel(conv *core.ConversationInfo, data []byte, conn *FTPDataConnection) error {
	if len(data) == 0 {
		return nil
	}

	ftpLog.Info("Extracting FTP data channel file",
		zap.String("filename", conn.Filename),
		zap.String("command", conn.Command),
		zap.Int("dataSize", len(data)),
		zap.String("ident", conv.Ident),
	)

	// Use file extraction framework
	extractor, ok := file.GetExtractor("FTP")
	if !ok {
		ftpLog.Error("FTP file extractor not registered")
		return nil
	}

	flowDirection := "server_to_client"
	if conn.Command == "STOR" {
		flowDirection = "client_to_server"
	}

	metadata := file.FileMetadata{
		ConnectionUID: conv.Ident,
		FlowDirection: flowDirection,
		FTPCommand:    conn.Command,
		Filename:      filepath.Base(conn.Filename),
		Host:          conn.IP,
	}

	return extractor.ExtractFile(conv, data, metadata)
}