suricata
app-layer-enip-common.h File Reference
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "flow.h"
#include "queue.h"
Include dependency graph for app-layer-enip-common.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  ENIPEncapHdr_
 
struct  ENIPEncapDataHdr_
 
struct  ENIPEncapAddresItem_
 
struct  ENIPEncapDataItem_
 
struct  CIPReqHdr_
 
struct  CIPRespHdr_
 
struct  SegmentEntry_
 
struct  AttributeEntry_
 
struct  CIPServiceEntry_
 
struct  ENIPTransaction_
 
struct  ENIPState_
 Per flow ENIP state container. More...
 

Macros

#define MAX_ENIP_CMD   65535
 
#define NOP   0x0000
 
#define LIST_SERVICES   0x0004
 
#define LIST_IDENTITY   0x0063
 
#define LIST_INTERFACES   0x0064
 
#define REGISTER_SESSION   0x0065
 
#define UNREGISTER_SESSION   0x0066
 
#define SEND_RR_DATA   0x006F
 
#define SEND_UNIT_DATA   0x0070
 
#define INDICATE_STATUS   0x0072
 
#define CANCEL   0x0073
 
#define NULL_ADDR   0x0000
 
#define CONNECTION_BASED   0x00a1
 
#define CONNECTED_DATA_ITEM   0x00b1
 
#define UNCONNECTED_DATA_ITEM   0x00b2
 
#define SEQUENCE_ADDR_ITEM   0xB002
 
#define SUCCESS   0x0000
 
#define INVALID_CMD   0x0001
 
#define NO_RESOURCES   0x0002
 
#define INCORRECT_DATA   0x0003
 
#define INVALID_SESSION   0x0064
 
#define INVALID_LENGTH   0x0065
 
#define UNSUPPORTED_PROT_REV   0x0069
 
#define MAX_CIP_SERVICE   127
 
#define MAX_CIP_CLASS   65535
 
#define MAX_CIP_ATTRIBUTE   65535
 
#define CIP_RESERVED   0x00
 
#define CIP_GET_ATTR_ALL   0x01
 
#define CIP_GET_ATTR_LIST   0x03
 
#define CIP_SET_ATTR_LIST   0x04
 
#define CIP_RESET   0x05
 
#define CIP_START   0x06
 
#define CIP_STOP   0x07
 
#define CIP_CREATE   0x08
 
#define CIP_DELETE   0x09
 
#define CIP_MSP   0x0a
 
#define CIP_APPLY_ATTR   0x0d
 
#define CIP_GET_ATTR_SINGLE   0x0e
 
#define CIP_SET_ATTR_SINGLE   0x10
 
#define CIP_KICK_TIMER   0x4b
 
#define CIP_OPEN_CONNECTION   0x4c
 
#define CIP_CHANGE_START   0x4f
 
#define CIP_GET_STATUS   0x50
 
#define PATH_CLASS_8BIT   0x20
 
#define PATH_CLASS_16BIT   0x21
 
#define PATH_INSTANCE_8BIT   0x24
 
#define PATH_INSTANCE_16BIT   0x25
 
#define PATH_ATTR_8BIT   0x30
 
#define PATH_ATTR_16BIT   0x31
 

Typedefs

typedef struct ENIPEncapHdr_ ENIPEncapHdr
 
typedef struct ENIPEncapDataHdr_ ENIPEncapDataHdr
 
typedef struct ENIPEncapAddresItem_ ENIPEncapAddresItem
 
typedef struct ENIPEncapDataItem_ ENIPEncapDataItem
 
typedef struct CIPReqHdr_ CIPReqHdr
 
typedef struct CIPRespHdr_ CIPRespHdr
 
typedef struct SegmentEntry_ SegmentEntry
 
typedef struct AttributeEntry_ AttributeEntry
 
typedef struct CIPServiceEntry_ CIPServiceEntry
 
typedef struct ENIPTransaction_ ENIPTransaction
 
typedef struct ENIPState_ ENIPState
 Per flow ENIP state container. More...
 

Functions

int DecodeENIPPDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
 Decode ENIP Encapsulation Header. More...
 
int DecodeCommonPacketFormatPDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode Common Packet Format. More...
 
int DecodeCIPPDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP packet. More...
 
int DecodeCIPRequestPDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request. More...
 
int DecodeCIPResponsePDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response. More...
 
int DecodeCIPRequestPathPDU (uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
 Deocde CIP Request Path. More...
 
int DecodeCIPRequestMSPPDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request Multi Service Packet. More...
 
int DecodeCIPResponseMSPPDU (uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response MultiService Packet. More...
 

Detailed Description

Macro Definition Documentation

#define CANCEL   0x0073

Definition at line 44 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define CIP_APPLY_ATTR   0x0d

Definition at line 77 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_CHANGE_START   0x4f

Definition at line 82 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_CREATE   0x08

Definition at line 74 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_DELETE   0x09

Definition at line 75 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_GET_ATTR_ALL   0x01

Definition at line 68 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_GET_ATTR_LIST   0x03
#define CIP_GET_ATTR_SINGLE   0x0e

Definition at line 78 of file app-layer-enip-common.h.

#define CIP_GET_STATUS   0x50

Definition at line 83 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_KICK_TIMER   0x4b

Definition at line 80 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_MSP   0x0a

Definition at line 76 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_OPEN_CONNECTION   0x4c

Definition at line 81 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_RESERVED   0x00

Definition at line 67 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_RESET   0x05

Definition at line 71 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_SET_ATTR_LIST   0x04
#define CIP_SET_ATTR_SINGLE   0x10

Definition at line 79 of file app-layer-enip-common.h.

#define CIP_START   0x06

Definition at line 72 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CIP_STOP   0x07

Definition at line 73 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DecodeCIPResponsePDU().

#define CONNECTED_DATA_ITEM   0x00b1

Definition at line 49 of file app-layer-enip-common.h.

Referenced by DecodeCommonPacketFormatPDU().

#define CONNECTION_BASED   0x00a1

Definition at line 48 of file app-layer-enip-common.h.

Referenced by DecodeCommonPacketFormatPDU().

#define INCORRECT_DATA   0x0003

Definition at line 57 of file app-layer-enip-common.h.

#define INDICATE_STATUS   0x0072

Definition at line 43 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define INVALID_CMD   0x0001

Definition at line 55 of file app-layer-enip-common.h.

#define INVALID_LENGTH   0x0065

Definition at line 59 of file app-layer-enip-common.h.

#define INVALID_SESSION   0x0064

Definition at line 58 of file app-layer-enip-common.h.

#define LIST_IDENTITY   0x0063

Definition at line 37 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define LIST_INTERFACES   0x0064

Definition at line 38 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define LIST_SERVICES   0x0004

Definition at line 36 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define MAX_CIP_ATTRIBUTE   65535

Definition at line 64 of file app-layer-enip-common.h.

Referenced by DetectCipServiceRegister().

#define MAX_CIP_CLASS   65535

Definition at line 63 of file app-layer-enip-common.h.

Referenced by DetectCipServiceRegister().

#define MAX_CIP_SERVICE   127

Definition at line 62 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPDU(), and DetectCipServiceRegister().

#define MAX_ENIP_CMD   65535

Definition at line 32 of file app-layer-enip-common.h.

Referenced by DetectEnipCommandRegister().

#define NO_RESOURCES   0x0002

Definition at line 56 of file app-layer-enip-common.h.

#define NOP   0x0000

Definition at line 35 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define NULL_ADDR   0x0000

Definition at line 47 of file app-layer-enip-common.h.

#define PATH_ATTR_16BIT   0x31

Definition at line 91 of file app-layer-enip-common.h.

#define PATH_ATTR_8BIT   0x30

Definition at line 90 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPathPDU().

#define PATH_CLASS_16BIT   0x21

Definition at line 87 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPathPDU().

#define PATH_CLASS_8BIT   0x20

Definition at line 86 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPathPDU().

#define PATH_INSTANCE_16BIT   0x25

Definition at line 89 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPathPDU().

#define PATH_INSTANCE_8BIT   0x24

Definition at line 88 of file app-layer-enip-common.h.

Referenced by DecodeCIPRequestPathPDU().

#define REGISTER_SESSION   0x0065

Definition at line 39 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define SEND_RR_DATA   0x006F

Definition at line 41 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define SEND_UNIT_DATA   0x0070

Definition at line 42 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define SEQUENCE_ADDR_ITEM   0xB002

Definition at line 51 of file app-layer-enip-common.h.

Referenced by DecodeCommonPacketFormatPDU().

#define SUCCESS   0x0000

Definition at line 54 of file app-layer-enip-common.h.

#define UNCONNECTED_DATA_ITEM   0x00b2

Definition at line 50 of file app-layer-enip-common.h.

Referenced by DecodeCommonPacketFormatPDU().

#define UNREGISTER_SESSION   0x0066

Definition at line 40 of file app-layer-enip-common.h.

Referenced by DecodeENIPPDU().

#define UNSUPPORTED_PROT_REV   0x0069

Definition at line 60 of file app-layer-enip-common.h.

Typedef Documentation

typedef struct CIPReqHdr_ CIPReqHdr

CIP Request Header

typedef struct CIPRespHdr_ CIPRespHdr

CIP Response Header

ENIP encapsulation address item

ENIP encapsulation data header

ENIP encapsulation data item

typedef struct ENIPEncapHdr_ ENIPEncapHdr

ENIP encapsulation header

typedef struct ENIPState_ ENIPState

Per flow ENIP state container.

typedef struct SegmentEntry_ SegmentEntry

Function Documentation

int DecodeCIPPDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 407 of file app-layer-enip-common.c.

References DecodeCIPRequestPDU(), DecodeCIPResponsePDU(), ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, offset, and SCLogDebug.

Referenced by DecodeCIPRequestMSPPDU(), DecodeCIPResponseMSPPDU(), and DecodeCommonPacketFormatPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPRequestMSPPDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request Multi Service Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 863 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Referenced by DecodeCIPRequestPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPRequestPathPDU ( uint8_t *  input,
uint32_t  input_len,
CIPServiceEntry node,
uint16_t  offset 
)

Deocde CIP Request Path.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
cipservicedthe cip service rule
Returns
1 Packet matches
0 Packet not match

Definition at line 571 of file app-layer-enip-common.c.

References AttributeEntry_::attribute, CIP_GET_ATTR_LIST, CIP_SET_ATTR_LIST, next, PATH_ATTR_8BIT, PATH_CLASS_16BIT, PATH_CLASS_8BIT, PATH_INSTANCE_16BIT, PATH_INSTANCE_8BIT, CIPServiceEntry_::request, SCLogDebug, SCMalloc, CIPServiceEntry_::service, TAILQ_INSERT_TAIL, and unlikely.

Referenced by DecodeCIPRequestPDU().

Here is the caller graph for this function:

int DecodeCIPRequestPDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 451 of file app-layer-enip-common.c.

References CIP_APPLY_ATTR, CIP_CHANGE_START, CIP_CREATE, CIP_DELETE, CIP_GET_ATTR_ALL, CIP_GET_ATTR_LIST, CIP_GET_STATUS, CIP_KICK_TIMER, CIP_MSP, CIP_OPEN_CONNECTION, CIP_RESERVED, CIP_RESET, CIP_SET_ATTR_LIST, CIP_START, CIP_STOP, DecodeCIPRequestMSPPDU(), DecodeCIPRequestPathPDU(), CIPServiceEntry_::direction, ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, MAX_CIP_SERVICE, offset, CIPServiceEntry_::request, SCLogDebug, CIPServiceEntry_::service, and ENIPTransaction_::service_count.

Referenced by DecodeCIPPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPResponseMSPPDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response MultiService Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 910 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Referenced by DecodeCIPResponsePDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCIPResponsePDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 744 of file app-layer-enip-common.c.

References CIP_APPLY_ATTR, CIP_CHANGE_START, CIP_CREATE, CIP_DELETE, CIP_GET_ATTR_ALL, CIP_GET_ATTR_LIST, CIP_GET_STATUS, CIP_KICK_TIMER, CIP_MSP, CIP_OPEN_CONNECTION, CIP_RESERVED, CIP_RESET, CIP_SET_ATTR_LIST, CIP_START, CIP_STOP, DecodeCIPResponseMSPPDU(), CIPServiceEntry_::direction, ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, CIPServiceEntry_::request, CIPServiceEntry_::response, SCLogDebug, CIPServiceEntry_::service, and ENIPTransaction_::service_count.

Referenced by DecodeCIPPDU().

Here is the call graph for this function:

Here is the caller graph for this function:

int DecodeCommonPacketFormatPDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)
int DecodeENIPPDU ( uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data 
)

Decode ENIP Encapsulation Header.

Parameters
input,input_lendata stream
enip_datastores data from Packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 185 of file app-layer-enip-common.c.

References CANCEL, ENIPEncapHdr_::command, ENIPEncapHdr_::context, DecodeCommonPacketFormatPDU(), ENIPTransaction_::header, INDICATE_STATUS, len, ENIPEncapHdr_::length, LIST_IDENTITY, LIST_INTERFACES, LIST_SERVICES, NOP, ENIPEncapHdr_::option, REGISTER_SESSION, SCLogDebug, SEND_RR_DATA, SEND_UNIT_DATA, ENIPEncapHdr_::session, ENIPEncapHdr_::status, and UNREGISTER_SESSION.

Here is the call graph for this function: