suricata
app-layer-enip-common.h File Reference
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "flow.h"
#include "queue.h"
Include dependency graph for app-layer-enip-common.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  ENIPEncapHdr_
 
struct  ENIPEncapDataHdr_
 
struct  ENIPEncapAddresItem_
 
struct  ENIPEncapDataItem_
 
struct  CIPReqHdr_
 
struct  CIPRespHdr_
 
struct  SegmentEntry_
 
struct  AttributeEntry_
 
struct  CIPServiceEntry_
 
struct  ENIPTransaction_
 
struct  ENIPState_
 Per flow ENIP state container. More...
 

Macros

#define NOP   0x0000
 
#define LIST_SERVICES   0x0004
 
#define LIST_IDENTITY   0x0063
 
#define LIST_INTERFACES   0x0064
 
#define REGISTER_SESSION   0x0065
 
#define UNREGISTER_SESSION   0x0066
 
#define SEND_RR_DATA   0x006F
 
#define SEND_UNIT_DATA   0x0070
 
#define INDICATE_STATUS   0x0072
 
#define CANCEL   0x0073
 
#define NULL_ADDR   0x0000
 
#define CONNECTION_BASED   0x00a1
 
#define CONNECTED_DATA_ITEM   0x00b1
 
#define UNCONNECTED_DATA_ITEM   0x00b2
 
#define SEQUENCE_ADDR_ITEM   0xB002
 
#define SUCCESS   0x0000
 
#define INVALID_CMD   0x0001
 
#define NO_RESOURCES   0x0002
 
#define INCORRECT_DATA   0x0003
 
#define INVALID_SESSION   0x0064
 
#define INVALID_LENGTH   0x0065
 
#define UNSUPPORTED_PROT_REV   0x0069
 
#define MAX_CIP_SERVICE   127
 
#define MAX_CIP_CLASS   65535
 
#define MAX_CIP_ATTRIBUTE   65535
 
#define CIP_RESERVED   0x00
 
#define CIP_GET_ATTR_ALL   0x01
 
#define CIP_GET_ATTR_LIST   0x03
 
#define CIP_SET_ATTR_LIST   0x04
 
#define CIP_RESET   0x05
 
#define CIP_START   0x06
 
#define CIP_STOP   0x07
 
#define CIP_CREATE   0x08
 
#define CIP_DELETE   0x09
 
#define CIP_MSP   0x0a
 
#define CIP_APPLY_ATTR   0x0d
 
#define CIP_GET_ATTR_SINGLE   0x0e
 
#define CIP_SET_ATTR_SINGLE   0x10
 
#define CIP_KICK_TIMER   0x4b
 
#define CIP_OPEN_CONNECTION   0x4c
 
#define CIP_CHANGE_START   0x4f
 
#define CIP_GET_STATUS   0x50
 
#define PATH_CLASS_8BIT   0x20
 
#define PATH_CLASS_16BIT   0x21
 
#define PATH_INSTANCE_8BIT   0x24
 
#define PATH_INSTANCE_16BIT   0x25
 
#define PATH_ATTR_8BIT   0x30
 
#define PATH_ATTR_16BIT   0x31
 

Typedefs

typedef struct ENIPEncapHdr_ ENIPEncapHdr
 
typedef struct ENIPEncapDataHdr_ ENIPEncapDataHdr
 
typedef struct ENIPEncapAddresItem_ ENIPEncapAddresItem
 
typedef struct ENIPEncapDataItem_ ENIPEncapDataItem
 
typedef struct CIPReqHdr_ CIPReqHdr
 
typedef struct CIPRespHdr_ CIPRespHdr
 
typedef struct SegmentEntry_ SegmentEntry
 
typedef struct AttributeEntry_ AttributeEntry
 
typedef struct CIPServiceEntry_ CIPServiceEntry
 
typedef struct ENIPTransaction_ ENIPTransaction
 
typedef struct ENIPState_ ENIPState
 Per flow ENIP state container. More...
 

Functions

int DecodeENIPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
 Decode ENIP Encapsulation Header. More...
 
int DecodeCommonPacketFormatPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode Common Packet Format. More...
 
int DecodeCIPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP packet. More...
 
int DecodeCIPRequestPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request. More...
 
int DecodeCIPResponsePDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response. More...
 
int DecodeCIPRequestPathPDU (const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
 Deocde CIP Request Path. More...
 
int DecodeCIPRequestMSPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Request Multi Service Packet. More...
 
int DecodeCIPResponseMSPPDU (const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
 Decode CIP Response MultiService Packet. More...
 

Detailed Description

Macro Definition Documentation

◆ CANCEL

#define CANCEL   0x0073

Definition at line 43 of file app-layer-enip-common.h.

◆ CIP_APPLY_ATTR

#define CIP_APPLY_ATTR   0x0d

Definition at line 76 of file app-layer-enip-common.h.

◆ CIP_CHANGE_START

#define CIP_CHANGE_START   0x4f

Definition at line 81 of file app-layer-enip-common.h.

◆ CIP_CREATE

#define CIP_CREATE   0x08

Definition at line 73 of file app-layer-enip-common.h.

◆ CIP_DELETE

#define CIP_DELETE   0x09

Definition at line 74 of file app-layer-enip-common.h.

◆ CIP_GET_ATTR_ALL

#define CIP_GET_ATTR_ALL   0x01

Definition at line 67 of file app-layer-enip-common.h.

◆ CIP_GET_ATTR_LIST

#define CIP_GET_ATTR_LIST   0x03

Definition at line 68 of file app-layer-enip-common.h.

◆ CIP_GET_ATTR_SINGLE

#define CIP_GET_ATTR_SINGLE   0x0e

Definition at line 77 of file app-layer-enip-common.h.

◆ CIP_GET_STATUS

#define CIP_GET_STATUS   0x50

Definition at line 82 of file app-layer-enip-common.h.

◆ CIP_KICK_TIMER

#define CIP_KICK_TIMER   0x4b

Definition at line 79 of file app-layer-enip-common.h.

◆ CIP_MSP

#define CIP_MSP   0x0a

Definition at line 75 of file app-layer-enip-common.h.

◆ CIP_OPEN_CONNECTION

#define CIP_OPEN_CONNECTION   0x4c

Definition at line 80 of file app-layer-enip-common.h.

◆ CIP_RESERVED

#define CIP_RESERVED   0x00

Definition at line 66 of file app-layer-enip-common.h.

◆ CIP_RESET

#define CIP_RESET   0x05

Definition at line 70 of file app-layer-enip-common.h.

◆ CIP_SET_ATTR_LIST

#define CIP_SET_ATTR_LIST   0x04

Definition at line 69 of file app-layer-enip-common.h.

◆ CIP_SET_ATTR_SINGLE

#define CIP_SET_ATTR_SINGLE   0x10

Definition at line 78 of file app-layer-enip-common.h.

◆ CIP_START

#define CIP_START   0x06

Definition at line 71 of file app-layer-enip-common.h.

◆ CIP_STOP

#define CIP_STOP   0x07

Definition at line 72 of file app-layer-enip-common.h.

◆ CONNECTED_DATA_ITEM

#define CONNECTED_DATA_ITEM   0x00b1

Definition at line 48 of file app-layer-enip-common.h.

◆ CONNECTION_BASED

#define CONNECTION_BASED   0x00a1

Definition at line 47 of file app-layer-enip-common.h.

◆ INCORRECT_DATA

#define INCORRECT_DATA   0x0003

Definition at line 56 of file app-layer-enip-common.h.

◆ INDICATE_STATUS

#define INDICATE_STATUS   0x0072

Definition at line 42 of file app-layer-enip-common.h.

◆ INVALID_CMD

#define INVALID_CMD   0x0001

Definition at line 54 of file app-layer-enip-common.h.

◆ INVALID_LENGTH

#define INVALID_LENGTH   0x0065

Definition at line 58 of file app-layer-enip-common.h.

◆ INVALID_SESSION

#define INVALID_SESSION   0x0064

Definition at line 57 of file app-layer-enip-common.h.

◆ LIST_IDENTITY

#define LIST_IDENTITY   0x0063

Definition at line 36 of file app-layer-enip-common.h.

◆ LIST_INTERFACES

#define LIST_INTERFACES   0x0064

Definition at line 37 of file app-layer-enip-common.h.

◆ LIST_SERVICES

#define LIST_SERVICES   0x0004

Definition at line 35 of file app-layer-enip-common.h.

◆ MAX_CIP_ATTRIBUTE

#define MAX_CIP_ATTRIBUTE   65535

Definition at line 63 of file app-layer-enip-common.h.

◆ MAX_CIP_CLASS

#define MAX_CIP_CLASS   65535

Definition at line 62 of file app-layer-enip-common.h.

◆ MAX_CIP_SERVICE

#define MAX_CIP_SERVICE   127

Definition at line 61 of file app-layer-enip-common.h.

◆ NO_RESOURCES

#define NO_RESOURCES   0x0002

Definition at line 55 of file app-layer-enip-common.h.

◆ NOP

#define NOP   0x0000

Definition at line 34 of file app-layer-enip-common.h.

◆ NULL_ADDR

#define NULL_ADDR   0x0000

Definition at line 46 of file app-layer-enip-common.h.

◆ PATH_ATTR_16BIT

#define PATH_ATTR_16BIT   0x31

Definition at line 90 of file app-layer-enip-common.h.

◆ PATH_ATTR_8BIT

#define PATH_ATTR_8BIT   0x30

Definition at line 89 of file app-layer-enip-common.h.

◆ PATH_CLASS_16BIT

#define PATH_CLASS_16BIT   0x21

Definition at line 86 of file app-layer-enip-common.h.

◆ PATH_CLASS_8BIT

#define PATH_CLASS_8BIT   0x20

Definition at line 85 of file app-layer-enip-common.h.

◆ PATH_INSTANCE_16BIT

#define PATH_INSTANCE_16BIT   0x25

Definition at line 88 of file app-layer-enip-common.h.

◆ PATH_INSTANCE_8BIT

#define PATH_INSTANCE_8BIT   0x24

Definition at line 87 of file app-layer-enip-common.h.

◆ REGISTER_SESSION

#define REGISTER_SESSION   0x0065

Definition at line 38 of file app-layer-enip-common.h.

◆ SEND_RR_DATA

#define SEND_RR_DATA   0x006F

Definition at line 40 of file app-layer-enip-common.h.

◆ SEND_UNIT_DATA

#define SEND_UNIT_DATA   0x0070

Definition at line 41 of file app-layer-enip-common.h.

◆ SEQUENCE_ADDR_ITEM

#define SEQUENCE_ADDR_ITEM   0xB002

Definition at line 50 of file app-layer-enip-common.h.

◆ SUCCESS

#define SUCCESS   0x0000

Definition at line 53 of file app-layer-enip-common.h.

◆ UNCONNECTED_DATA_ITEM

#define UNCONNECTED_DATA_ITEM   0x00b2

Definition at line 49 of file app-layer-enip-common.h.

◆ UNREGISTER_SESSION

#define UNREGISTER_SESSION   0x0066

Definition at line 39 of file app-layer-enip-common.h.

◆ UNSUPPORTED_PROT_REV

#define UNSUPPORTED_PROT_REV   0x0069

Definition at line 59 of file app-layer-enip-common.h.

Typedef Documentation

◆ AttributeEntry

◆ CIPReqHdr

typedef struct CIPReqHdr_ CIPReqHdr

CIP Request Header

◆ CIPRespHdr

typedef struct CIPRespHdr_ CIPRespHdr

CIP Response Header

◆ CIPServiceEntry

◆ ENIPEncapAddresItem

ENIP encapsulation address item

◆ ENIPEncapDataHdr

ENIP encapsulation data header

◆ ENIPEncapDataItem

ENIP encapsulation data item

◆ ENIPEncapHdr

typedef struct ENIPEncapHdr_ ENIPEncapHdr

ENIP encapsulation header

◆ ENIPState

typedef struct ENIPState_ ENIPState

Per flow ENIP state container.

◆ ENIPTransaction

◆ SegmentEntry

typedef struct SegmentEntry_ SegmentEntry

Function Documentation

◆ DecodeCIPPDU()

int DecodeCIPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 407 of file app-layer-enip-common.c.

References DecodeCIPRequestPDU(), DecodeCIPResponsePDU(), ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, offset, and SCLogDebug.

Referenced by DecodeCIPRequestMSPPDU(), and DecodeCIPResponseMSPPDU().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodeCIPRequestMSPPDU()

int DecodeCIPRequestMSPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request Multi Service Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 863 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Here is the call graph for this function:

◆ DecodeCIPRequestPathPDU()

int DecodeCIPRequestPathPDU ( const uint8_t *  input,
uint32_t  input_len,
CIPServiceEntry node,
uint16_t  offset 
)

Deocde CIP Request Path.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
cipservicedthe cip service rule
Returns
1 Packet matches
0 Packet not match

Definition at line 571 of file app-layer-enip-common.c.

References CIPServiceEntry_::request.

◆ DecodeCIPRequestPDU()

int DecodeCIPRequestPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Request.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 451 of file app-layer-enip-common.c.

References ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, and SCLogDebug.

Referenced by DecodeCIPPDU().

Here is the caller graph for this function:

◆ DecodeCIPResponseMSPPDU()

int DecodeCIPResponseMSPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response MultiService Packet.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 910 of file app-layer-enip-common.c.

References BYTE_LITTLE_ENDIAN, ByteExtractUint16(), DecodeCIPPDU(), offset, and SCLogDebug.

Here is the call graph for this function:

◆ DecodeCIPResponsePDU()

int DecodeCIPResponsePDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode CIP Response.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 744 of file app-layer-enip-common.c.

References ENIPTransaction_::encap_data_item, ENIPEncapDataItem_::length, and SCLogDebug.

Referenced by DecodeCIPPDU().

Here is the caller graph for this function:

◆ DecodeCommonPacketFormatPDU()

int DecodeCommonPacketFormatPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data,
uint16_t  offset 
)

Decode Common Packet Format.

Parameters
input,input_lendata stream
enip_datastores data from Packet
offsetcurrent point in the packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 286 of file app-layer-enip-common.c.

References ENIPTransaction_::header, ENIPEncapHdr_::length, and SCLogDebug.

◆ DecodeENIPPDU()

int DecodeENIPPDU ( const uint8_t *  input,
uint32_t  input_len,
ENIPTransaction enip_data 
)

Decode ENIP Encapsulation Header.

Parameters
input,input_lendata stream
enip_datastores data from Packet
Returns
1 Packet ok
0 Packet has errors

Definition at line 185 of file app-layer-enip-common.c.

References context, len, and offset.