suricata
app-layer-enip-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  */
23 
24 #ifndef __APP_LAYER_ENIP_COMMON_H__
25 #define __APP_LAYER_ENIP_COMMON_H__
26 
27 #include "rust.h"
28 
29 // EtherNet/IP commands
30 #define NOP 0x0000
31 #define LIST_SERVICES 0x0004
32 #define LIST_IDENTITY 0x0063
33 #define LIST_INTERFACES 0x0064
34 #define REGISTER_SESSION 0x0065
35 #define UNREGISTER_SESSION 0x0066
36 #define SEND_RR_DATA 0x006F
37 #define SEND_UNIT_DATA 0x0070
38 #define INDICATE_STATUS 0x0072
39 #define CANCEL 0x0073
40 
41 //Common Packet Format Types
42 #define NULL_ADDR 0x0000
43 #define CONNECTION_BASED 0x00a1
44 #define CONNECTED_DATA_ITEM 0x00b1
45 #define UNCONNECTED_DATA_ITEM 0x00b2
46 #define SEQUENCE_ADDR_ITEM 0xB002
47 
48 //status codes
49 #define SUCCESS 0x0000
50 #define INVALID_CMD 0x0001
51 #define NO_RESOURCES 0x0002
52 #define INCORRECT_DATA 0x0003
53 #define INVALID_SESSION 0x0064
54 #define INVALID_LENGTH 0x0065
55 #define UNSUPPORTED_PROT_REV 0x0069
56 //Found in wireshark
57 #define ENCAP_HEADER_ERROR 0x006A
58 
59 #define MAX_CIP_SERVICE 127
60 #define MAX_CIP_CLASS 65535
61 #define MAX_CIP_ATTRIBUTE 65535
62 
63 // CIP service codes
64 #define CIP_RESERVED 0x00
65 #define CIP_GET_ATTR_ALL 0x01
66 #define CIP_GET_ATTR_LIST 0x03
67 #define CIP_SET_ATTR_LIST 0x04
68 #define CIP_RESET 0x05
69 #define CIP_START 0x06
70 #define CIP_STOP 0x07
71 #define CIP_CREATE 0x08
72 #define CIP_DELETE 0x09
73 #define CIP_MSP 0x0a
74 #define CIP_APPLY_ATTR 0x0d
75 #define CIP_GET_ATTR_SINGLE 0x0e
76 #define CIP_SET_ATTR_SINGLE 0x10
77 #define CIP_KICK_TIMER 0x4b
78 #define CIP_OPEN_CONNECTION 0x4c
79 #define CIP_CHANGE_START 0x4f
80 #define CIP_GET_STATUS 0x50
81 
82 //PATH sizing codes
83 #define PATH_CLASS_8BIT 0x20
84 #define PATH_CLASS_16BIT 0x21
85 #define PATH_INSTANCE_8BIT 0x24
86 #define PATH_INSTANCE_16BIT 0x25
87 #define PATH_ATTR_8BIT 0x30
88 #define PATH_ATTR_16BIT 0x31 //possible value
89 
90 /**
91  * ENIP encapsulation header
92  */
93 typedef struct ENIPEncapHdr_
94 {
95  uint64_t context;
96  uint32_t session;
97  uint32_t status;
98  uint32_t option;
99  uint16_t command;
100  uint16_t length;
102 
103 /**
104  * ENIP encapsulation data header
105  */
106 typedef struct ENIPEncapDataHdr_
107 {
109  uint16_t timeout;
110  uint16_t item_count;
112 
113 /**
114  * ENIP encapsulation address item
115  */
116 typedef struct ENIPEncapAddresItem_
117 {
118  uint16_t type;
119  uint16_t length;
120  uint32_t conn_id;
121  uint32_t sequence_num;
123 
124 /**
125  * ENIP encapsulation data item
126  */
127 typedef struct ENIPEncapDataItem_
128 {
129  uint16_t type;
130  uint16_t length;
131  uint16_t sequence_count;
133 
134 /**
135  * CIP Request Header
136  */
137 typedef struct CIPReqHdr_
138 {
139  uint8_t service;
140  uint8_t path_size;
142 
143 /**
144  * CIP Response Header
145  */
146 typedef struct CIPRespHdr_
147 {
148  uint8_t service;
149  uint8_t pad;
150  uint8_t status;
151  uint8_t status_size;
153 
154 typedef struct SegmentEntry_
155 {
156  uint16_t segment; /**< segment type */
157  uint16_t value; /**< segment value (class or attribute) */
158 
161 
162 typedef struct AttributeEntry_
163 {
164  uint16_t attribute; /**< segment class */
165 
168 
169 typedef struct CIPServiceEntry_
170 {
171  uint8_t service; /**< cip service */
172  uint8_t direction;
173  union
174  {
175  struct
176  {
177  uint8_t path_size; /**< cip path size */
178  uint16_t path_offset; /**< offset to cip path */
180  struct
181  {
182  uint16_t status;
184  };
185 
186  TAILQ_HEAD(, SegmentEntry_) segment_list; /**< list for CIP segment */
187  TAILQ_HEAD(, AttributeEntry_) attrib_list; /**< list for CIP segment */
188 
191 
192 typedef struct ENIPTransaction_
193 {
194  struct ENIPState_ *enip;
195  uint64_t tx_num; /**< internal: id */
196  uint16_t tx_id; /**< transaction id */
197  uint16_t service_count;
198 
199  ENIPEncapHdr header; /**< encapsulation header */
200  ENIPEncapDataHdr encap_data_header; /**< encapsulation data header */
201  ENIPEncapAddresItem encap_addr_item; /**< encapsulated address item */
202  ENIPEncapDataItem encap_data_item; /**< encapsulated data item */
203 
204  TAILQ_HEAD(, CIPServiceEntry_) service_list; /**< list for CIP */
205 
207  AppLayerTxData tx_data;
209 
210 /** \brief Per flow ENIP state container */
211 typedef struct ENIPState_
212 {
213  TAILQ_HEAD(, ENIPTransaction_) tx_list; /**< transaction list */
214  ENIPTransaction *curr; /**< ptr to current tx */
216  uint64_t transaction_max;
218 
219  uint16_t events;
220  uint16_t givenup;
221 
222  /* used by TCP only */
223  uint16_t offset;
224  uint16_t record_len;
225  uint8_t *buffer;
227 
228 int DecodeENIPPDU(const uint8_t *input, uint32_t input_len,
229  ENIPTransaction *enip_data);
230 int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len,
231  ENIPTransaction *enip_data, uint16_t offset);
232 int DecodeCIPPDU(const uint8_t *input, uint32_t input_len,
233  ENIPTransaction *enip_data, uint16_t offset);
234 int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len,
235  ENIPTransaction *enip_data, uint16_t offset);
236 int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len,
237  ENIPTransaction *enip_data, uint16_t offset);
238 int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len,
239  CIPServiceEntry *node, uint16_t offset);
240 int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len,
241  ENIPTransaction *enip_data, uint16_t offset);
242 int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len,
243  ENIPTransaction *enip_data, uint16_t offset);
244 
245 #endif /* __APP_LAYER_ENIP_COMMON_H__ */
ENIPTransaction_::encap_data_header
ENIPEncapDataHdr encap_data_header
Definition: app-layer-enip-common.h:200
CIPServiceEntry_::response
struct CIPServiceEntry_::@2::@5 response
SegmentEntry_
Definition: app-layer-enip-common.h:155
CIPServiceEntry_::status
uint16_t status
Definition: app-layer-enip-common.h:182
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
CIPServiceEntry_::path_offset
uint16_t path_offset
Definition: app-layer-enip-common.h:178
ENIPState
struct ENIPState_ ENIPState
Per flow ENIP state container.
CIPServiceEntry_::request
struct CIPServiceEntry_::@2::@4 request
CIPReqHdr_::path_size
uint8_t path_size
Definition: app-layer-enip-common.h:140
CIPRespHdr_
Definition: app-layer-enip-common.h:147
ENIPState_
Per flow ENIP state container.
Definition: app-layer-enip-common.h:212
ENIPState_::events
uint16_t events
Definition: app-layer-enip-common.h:219
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
ENIPEncapHdr_::session
uint32_t session
Definition: app-layer-enip-common.h:96
ENIPState_::offset
uint16_t offset
Definition: app-layer-enip-common.h:223
ENIPEncapDataItem_::length
uint16_t length
Definition: app-layer-enip-common.h:130
ENIPEncapHdr_::option
uint32_t option
Definition: app-layer-enip-common.h:98
SegmentEntry_::TAILQ_ENTRY
TAILQ_ENTRY(SegmentEntry_) next
ENIPEncapDataItem_::sequence_count
uint16_t sequence_count
Definition: app-layer-enip-common.h:131
ENIPTransaction_::encap_addr_item
ENIPEncapAddresItem encap_addr_item
Definition: app-layer-enip-common.h:201
ENIPState_::TAILQ_HEAD
TAILQ_HEAD(, ENIPTransaction_) tx_list
rust.h
SegmentEntry_::segment
uint16_t segment
Definition: app-layer-enip-common.h:156
ENIPState_::record_len
uint16_t record_len
Definition: app-layer-enip-common.h:224
ENIPEncapDataHdr_::item_count
uint16_t item_count
Definition: app-layer-enip-common.h:110
DecodeCommonPacketFormatPDU
int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode Common Packet Format.
Definition: app-layer-enip-common.c:286
ENIPEncapHdr_::command
uint16_t command
Definition: app-layer-enip-common.h:99
AttributeEntry_
Definition: app-layer-enip-common.h:163
CIPServiceEntry_
Definition: app-layer-enip-common.h:170
DecodeCIPRequestMSPPDU
int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request Multi Service Packet.
Definition: app-layer-enip-common.c:863
CIPReqHdr_
Definition: app-layer-enip-common.h:138
ENIPTransaction
struct ENIPTransaction_ ENIPTransaction
CIPServiceEntry
struct CIPServiceEntry_ CIPServiceEntry
ENIPEncapAddresItem_::length
uint16_t length
Definition: app-layer-enip-common.h:119
ENIPEncapHdr_::context
uint64_t context
Definition: app-layer-enip-common.h:95
CIPRespHdr
struct CIPRespHdr_ CIPRespHdr
ENIPTransaction_::enip
struct ENIPState_ * enip
Definition: app-layer-enip-common.h:194
CIPServiceEntry_::path_size
uint8_t path_size
Definition: app-layer-enip-common.h:177
ENIPEncapHdr_
Definition: app-layer-enip-common.h:94
ENIPEncapAddresItem_
Definition: app-layer-enip-common.h:117
CIPServiceEntry_::service
uint8_t service
Definition: app-layer-enip-common.h:171
DecodeCIPResponseMSPPDU
int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response MultiService Packet.
Definition: app-layer-enip-common.c:910
ENIPTransaction_::encap_data_item
ENIPEncapDataItem encap_data_item
Definition: app-layer-enip-common.h:202
ENIPEncapAddresItem
struct ENIPEncapAddresItem_ ENIPEncapAddresItem
ENIPState_::buffer
uint8_t * buffer
Definition: app-layer-enip-common.h:225
ENIPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-enip-common.h:207
ENIPEncapDataHdr_
Definition: app-layer-enip-common.h:107
DecodeCIPRequestPathPDU
int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
Deocde CIP Request Path.
Definition: app-layer-enip-common.c:571
CIPReqHdr_::service
uint8_t service
Definition: app-layer-enip-common.h:139
DecodeCIPResponsePDU
int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response.
Definition: app-layer-enip-common.c:744
ENIPEncapDataItem
struct ENIPEncapDataItem_ ENIPEncapDataItem
SegmentEntry
struct SegmentEntry_ SegmentEntry
AttributeEntry
struct AttributeEntry_ AttributeEntry
ENIPTransaction_::tx_num
uint64_t tx_num
Definition: app-layer-enip-common.h:195
CIPRespHdr_::service
uint8_t service
Definition: app-layer-enip-common.h:148
ENIPState_::iter
ENIPTransaction * iter
Definition: app-layer-enip-common.h:215
ENIPTransaction_
Definition: app-layer-enip-common.h:193
ENIPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, CIPServiceEntry_) service_list
CIPServiceEntry_::TAILQ_ENTRY
TAILQ_ENTRY(CIPServiceEntry_) next
ENIPTransaction_::tx_id
uint16_t tx_id
Definition: app-layer-enip-common.h:196
ENIPEncapDataHdr_::interface_handle
uint32_t interface_handle
Definition: app-layer-enip-common.h:108
AttributeEntry_::TAILQ_ENTRY
TAILQ_ENTRY(AttributeEntry_) next
CIPServiceEntry_::TAILQ_HEAD
TAILQ_HEAD(, AttributeEntry_) attrib_list
ENIPState_::curr
ENIPTransaction * curr
Definition: app-layer-enip-common.h:214
ENIPEncapHdr_::status
uint32_t status
Definition: app-layer-enip-common.h:97
CIPRespHdr_::pad
uint8_t pad
Definition: app-layer-enip-common.h:149
ENIPEncapDataHdr_::timeout
uint16_t timeout
Definition: app-layer-enip-common.h:109
ENIPTransaction_::service_count
uint16_t service_count
Definition: app-layer-enip-common.h:197
ENIPEncapHdr
struct ENIPEncapHdr_ ENIPEncapHdr
ENIPEncapDataItem_
Definition: app-layer-enip-common.h:128
ENIPState_::tx_with_detect_state_cnt
uint64_t tx_with_detect_state_cnt
Definition: app-layer-enip-common.h:217
ENIPEncapDataHdr
struct ENIPEncapDataHdr_ ENIPEncapDataHdr
ENIPEncapDataItem_::type
uint16_t type
Definition: app-layer-enip-common.h:129
DecodeCIPPDU
int DecodeCIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP packet.
Definition: app-layer-enip-common.c:407
ENIPEncapHdr_::length
uint16_t length
Definition: app-layer-enip-common.h:100
ENIPState_::transaction_max
uint64_t transaction_max
Definition: app-layer-enip-common.h:216
ENIPState_::givenup
uint16_t givenup
Definition: app-layer-enip-common.h:220
CIPRespHdr_::status_size
uint8_t status_size
Definition: app-layer-enip-common.h:151
ENIPEncapAddresItem_::sequence_num
uint32_t sequence_num
Definition: app-layer-enip-common.h:121
CIPRespHdr_::status
uint8_t status
Definition: app-layer-enip-common.h:150
DecodeENIPPDU
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
Definition: app-layer-enip-common.c:185
ENIPTransaction_::header
ENIPEncapHdr header
Definition: app-layer-enip-common.h:199
ENIPEncapAddresItem_::type
uint16_t type
Definition: app-layer-enip-common.h:118
ENIPEncapAddresItem_::conn_id
uint32_t conn_id
Definition: app-layer-enip-common.h:120
CIPServiceEntry_::direction
uint8_t direction
Definition: app-layer-enip-common.h:172
CIPReqHdr
struct CIPReqHdr_ CIPReqHdr
SegmentEntry_::value
uint16_t value
Definition: app-layer-enip-common.h:157
AttributeEntry_::attribute
uint16_t attribute
Definition: app-layer-enip-common.h:164
DecodeCIPRequestPDU
int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request.
Definition: app-layer-enip-common.c:451
ENIPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(ENIPTransaction_) next
CIPServiceEntry_::TAILQ_HEAD
TAILQ_HEAD(, SegmentEntry_) segment_list