suricata
app-layer-enip-common.c File Reference
#include "suricata-common.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "util-byte.h"
#include "pkt-var.h"
#include "util-profiling.h"
#include "app-layer-enip-common.h"
Include dependency graph for app-layer-enip-common.c:

Go to the source code of this file.

Functions

int DecodeENIPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
 Decode ENIP Encapsulation Header. More...
 
int DecodeCommonPacketFormatPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode Common Packet Format. More...
 
int DecodeCIPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP packet. More...
 
int DecodeCIPRequestPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request. More...
 
int DecodeCIPRequestPathPDU (const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
 Deocde CIP Request Path. More...
 
int DecodeCIPResponsePDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response. More...
 
int DecodeCIPRequestMSPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request Multi Service Packet. More...
 
int DecodeCIPResponseMSPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response MultiService Packet. More...
 

Detailed Description

Author
Kevin Wong kwong.nosp@m.@sol.nosp@m.anane.nosp@m.twor.nosp@m.ks.co.nosp@m.m

App-layer parser for ENIP protocol common code

Definition in file app-layer-enip-common.c.

Function Documentation

◆ DecodeCIPPDU()

int DecodeCIPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 407 of file app-layer-enip-common.c.

References DecodeCIPRequestPDU(), DecodeCIPResponsePDU(), ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, offset, and SCLogDebug.

Referenced by DecodeCIPRequestMSPPDU(), and DecodeCIPResponseMSPPDU().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodeCIPRequestMSPPDU()

int DecodeCIPRequestMSPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request Multi Service Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 863 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Here is the call graph for this function:

◆ DecodeCIPRequestPathPDU()

int DecodeCIPRequestPathPDU ( const uint8_t *  input,
uint32_t  input_len,
CIPServiceEntry node,
uint16_t  offset 
)

Deocde CIP Request Path.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
cipservicedthe cip service rule
Returns
1 Packet matches
0 Packet not match

Definition at line 571 of file app-layer-enip-common.c.

References CIPServiceEntry_::request.

◆ DecodeCIPRequestPDU()

int DecodeCIPRequestPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 451 of file app-layer-enip-common.c.

References ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, and SCLogDebug.

Referenced by DecodeCIPPDU().

Here is the caller graph for this function:

◆ DecodeCIPResponseMSPPDU()

int DecodeCIPResponseMSPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response MultiService Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 910 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Here is the call graph for this function:

◆ DecodeCIPResponsePDU()

int DecodeCIPResponsePDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 744 of file app-layer-enip-common.c.

References ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, and SCLogDebug.

Referenced by DecodeCIPPDU().

Here is the caller graph for this function:

◆ DecodeCommonPacketFormatPDU()

int DecodeCommonPacketFormatPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode Common Packet Format.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 286 of file app-layer-enip-common.c.

References ENIPTransaction_::header, ENIPEncapHdr_::length, and SCLogDebug.

◆ DecodeENIPPDU()

int DecodeENIPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data 
)

Decode ENIP Encapsulation Header.

Parameters
input,input_lendata stream
enip_datastores data from Packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 185 of file app-layer-enip-common.c.

References context, len, and offset.