suricata
app-layer-enip-common.c File Reference
#include "suricata-common.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "util-byte.h"
#include "pkt-var.h"
#include "util-profiling.h"
#include "app-layer-enip-common.h"
Include dependency graph for app-layer-enip-common.c:

Go to the source code of this file.

Functions

int DecodeENIPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
 Decode ENIP Encapsulation Header. More...
 
int DecodeCommonPacketFormatPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode Common Packet Format. More...
 
int DecodeCIPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP packet. More...
 
int DecodeCIPRequestPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request. More...
 
int DecodeCIPRequestPathPDU (const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
 Deocde CIP Request Path. More...
 
int DecodeCIPResponsePDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response. More...
 
int DecodeCIPRequestMSPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request Multi Service Packet. More...
 
int DecodeCIPResponseMSPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response MultiService Packet. More...
 

Detailed Description

Author
Kevin Wong kwong.nosp@m.@sol.nosp@m.anane.nosp@m.twor.nosp@m.ks.co.nosp@m.m

App-layer parser for ENIP protocol common code

Definition in file app-layer-enip-common.c.

Function Documentation

int DecodeCIPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 407 of file app-layer-enip-common.c.

References DecodeCIPRequestPDU(), DecodeCIPResponsePDU(), ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, offset, and SCLogDebug.

Referenced by DecodeCIPRequestMSPPDU(), DecodeCIPResponseMSPPDU(), and DecodeCommonPacketFormatPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPRequestMSPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request Multi Service Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 863 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Referenced by DecodeCIPRequestPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPRequestPathPDU ( const uint8_t *  input,
uint32_t  input_len,
CIPServiceEntry node,
uint16_t  offset 
)

Deocde CIP Request Path.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
cipservicedthe cip service rule
Returns
1 Packet matches
0 Packet not match

Definition at line 571 of file app-layer-enip-common.c.

References AttributeEntry_::attribute, CIP_GET_ATTR_LIST, CIP_SET_ATTR_LIST, next, PATH_ATTR_8BIT, PATH_CLASS_16BIT, PATH_CLASS_8BIT, PATH_INSTANCE_16BIT, PATH_INSTANCE_8BIT, CIPServiceEntry_::request, SCLogDebug, SCMalloc, CIPServiceEntry_::service, TAILQ_INSERT_TAIL, and unlikely.

Referenced by DecodeCIPRequestPDU().

Here is the caller graph for this function:

int DecodeCIPRequestPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 451 of file app-layer-enip-common.c.

References CIP_APPLY_ATTR, CIP_CHANGE_START, CIP_CREATE, CIP_DELETE, CIP_GET_ATTR_ALL, CIP_GET_ATTR_LIST, CIP_GET_STATUS, CIP_KICK_TIMER, CIP_MSP, CIP_OPEN_CONNECTION, CIP_RESERVED, CIP_RESET, CIP_SET_ATTR_LIST, CIP_START, CIP_STOP, DecodeCIPRequestMSPPDU(), DecodeCIPRequestPathPDU(), CIPServiceEntry_::direction, ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, MAX_CIP_SERVICE, offset, CIPServiceEntry_::request, SCLogDebug, CIPServiceEntry_::service, and ENIPTransaction_::service_count.

Referenced by DecodeCIPPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPResponseMSPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response MultiService Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 910 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Referenced by DecodeCIPResponsePDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPResponsePDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 744 of file app-layer-enip-common.c.

References CIP_APPLY_ATTR, CIP_CHANGE_START, CIP_CREATE, CIP_DELETE, CIP_GET_ATTR_ALL, CIP_GET_ATTR_LIST, CIP_GET_STATUS, CIP_KICK_TIMER, CIP_MSP, CIP_OPEN_CONNECTION, CIP_RESERVED, CIP_RESET, CIP_SET_ATTR_LIST, CIP_START, CIP_STOP, DecodeCIPResponseMSPPDU(), CIPServiceEntry_::direction, ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, CIPServiceEntry_::request, CIPServiceEntry_::response, SCLogDebug, CIPServiceEntry_::service, and ENIPTransaction_::service_count.

Referenced by DecodeCIPPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCommonPacketFormatPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)
int DecodeENIPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data 
)

Decode ENIP Encapsulation Header.

Parameters
input,input_lendata stream
enip_datastores data from Packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 185 of file app-layer-enip-common.c.

References CANCEL, ENIPEncapHdr_::command, ENIPEncapHdr_::context, DecodeCommonPacketFormatPDU(), ENIPTransaction_::header, INDICATE_STATUS, len, ENIPEncapHdr_::length, LIST_IDENTITY, LIST_INTERFACES, LIST_SERVICES, NOP, ENIPEncapHdr_::option, REGISTER_SESSION, SCLogDebug, SEND_RR_DATA, SEND_UNIT_DATA, ENIPEncapHdr_::session, ENIPEncapHdr_::status, and UNREGISTER_SESSION.

Here is the call graph for this function: