suricata
app-layer-enip-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  */
23 
24 #ifndef __APP_LAYER_ENIP_COMMON_H__
25 #define __APP_LAYER_ENIP_COMMON_H__
26 
27 #include "app-layer-protos.h"
28 #include "app-layer-parser.h"
29 #include "flow.h"
30 #include "queue.h"
31 
32 #define MAX_ENIP_CMD 65535
33 
34 // EtherNet/IP commands
35 #define NOP 0x0000
36 #define LIST_SERVICES 0x0004
37 #define LIST_IDENTITY 0x0063
38 #define LIST_INTERFACES 0x0064
39 #define REGISTER_SESSION 0x0065
40 #define UNREGISTER_SESSION 0x0066
41 #define SEND_RR_DATA 0x006F
42 #define SEND_UNIT_DATA 0x0070
43 #define INDICATE_STATUS 0x0072
44 #define CANCEL 0x0073
45 
46 //Common Packet Format Types
47 #define NULL_ADDR 0x0000
48 #define CONNECTION_BASED 0x00a1
49 #define CONNECTED_DATA_ITEM 0x00b1
50 #define UNCONNECTED_DATA_ITEM 0x00b2
51 #define SEQUENCE_ADDR_ITEM 0xB002
52 
53 //status codes
54 #define SUCCESS 0x0000
55 #define INVALID_CMD 0x0001
56 #define NO_RESOURCES 0x0002
57 #define INCORRECT_DATA 0x0003
58 #define INVALID_SESSION 0x0064
59 #define INVALID_LENGTH 0x0065
60 #define UNSUPPORTED_PROT_REV 0x0069
61 
62 #define MAX_CIP_SERVICE 127
63 #define MAX_CIP_CLASS 65535
64 #define MAX_CIP_ATTRIBUTE 65535
65 
66 // CIP service codes
67 #define CIP_RESERVED 0x00
68 #define CIP_GET_ATTR_ALL 0x01
69 #define CIP_GET_ATTR_LIST 0x03
70 #define CIP_SET_ATTR_LIST 0x04
71 #define CIP_RESET 0x05
72 #define CIP_START 0x06
73 #define CIP_STOP 0x07
74 #define CIP_CREATE 0x08
75 #define CIP_DELETE 0x09
76 #define CIP_MSP 0x0a
77 #define CIP_APPLY_ATTR 0x0d
78 #define CIP_GET_ATTR_SINGLE 0x0e
79 #define CIP_SET_ATTR_SINGLE 0x10
80 #define CIP_KICK_TIMER 0x4b
81 #define CIP_OPEN_CONNECTION 0x4c
82 #define CIP_CHANGE_START 0x4f
83 #define CIP_GET_STATUS 0x50
84 
85 //PATH sizing codes
86 #define PATH_CLASS_8BIT 0x20
87 #define PATH_CLASS_16BIT 0x21
88 #define PATH_INSTANCE_8BIT 0x24
89 #define PATH_INSTANCE_16BIT 0x25
90 #define PATH_ATTR_8BIT 0x30
91 #define PATH_ATTR_16BIT 0x31 //possible value
92 
93 /**
94  * ENIP encapsulation header
95  */
96 typedef struct ENIPEncapHdr_
97 {
98  uint64_t context;
99  uint32_t session;
100  uint32_t status;
101  uint32_t option;
102  uint16_t command;
103  uint16_t length;
104 } ENIPEncapHdr;
105 
106 /**
107  * ENIP encapsulation data header
108  */
109 typedef struct ENIPEncapDataHdr_
110 {
112  uint16_t timeout;
113  uint16_t item_count;
115 
116 /**
117  * ENIP encapsulation address item
118  */
119 typedef struct ENIPEncapAddresItem_
120 {
121  uint16_t type;
122  uint16_t length;
123  uint16_t conn_id;
124  uint16_t sequence_num;
126 
127 /**
128  * ENIP encapsulation data item
129  */
130 typedef struct ENIPEncapDataItem_
131 {
132  uint16_t type;
133  uint16_t length;
134  uint16_t sequence_count;
136 
137 /**
138  * CIP Request Header
139  */
140 typedef struct CIPReqHdr_
141 {
142  uint8_t service;
143  uint8_t path_size;
144 } CIPReqHdr;
145 
146 /**
147  * CIP Response Header
148  */
149 typedef struct CIPRespHdr_
150 {
151  uint8_t service;
152  uint8_t pad;
153  uint8_t status;
154  uint8_t status_size;
155 } CIPRespHdr;
156 
157 typedef struct SegmentEntry_
158 {
159  uint16_t segment; /**< segment type */
160  uint16_t value; /**< segment value (class or attribute) */
161 
163 } SegmentEntry;
164 
165 typedef struct AttributeEntry_
166 {
167  uint16_t attribute; /**< segment class */
168 
169  TAILQ_ENTRY(AttributeEntry_) next;
171 
172 typedef struct CIPServiceEntry_
173 {
174  uint8_t service; /**< cip service */
175  uint8_t direction;
176  union
177  {
178  struct
179  {
180  uint8_t path_size; /**< cip path size */
181  uint16_t path_offset; /**< offset to cip path */
182  } request;
183  struct
184  {
185  uint8_t status;
186  } response;
187  };
188 
189  TAILQ_HEAD(, SegmentEntry_) segment_list; /**< list for CIP segment */
190  TAILQ_HEAD(, AttributeEntry_) attrib_list; /**< list for CIP segment */
191 
192  TAILQ_ENTRY(CIPServiceEntry_) next;
194 
195 typedef struct ENIPTransaction_
196 {
197  struct ENIPState_ *enip;
198  uint16_t tx_num; /**< internal: id */
199  uint16_t tx_id; /**< transaction id */
200  uint16_t service_count;
201 
202  ENIPEncapHdr header; /**< encapsulation header */
203  ENIPEncapDataHdr encap_data_header; /**< encapsulation data header */
204  ENIPEncapAddresItem encap_addr_item; /**< encapsulated address item */
205  ENIPEncapDataItem encap_data_item; /**< encapsulated data item */
206 
207  TAILQ_HEAD(, CIPServiceEntry_) service_list; /**< list for CIP */
208 
209  AppLayerDecoderEvents *decoder_events; /**< per tx events */
210 
211  TAILQ_ENTRY(ENIPTransaction_) next;
212  DetectEngineState *de_state;
214 
215 /** \brief Per flow ENIP state container */
216 typedef struct ENIPState_
217 {
218  TAILQ_HEAD(, ENIPTransaction_) tx_list; /**< transaction list */
219  ENIPTransaction *curr; /**< ptr to current tx */
221  uint64_t transaction_max;
223 
224  uint16_t events;
225  uint16_t givenup;
226 
227  /* used by TCP only */
228  uint16_t offset;
229  uint16_t record_len;
230  uint8_t *buffer;
231 } ENIPState;
232 
233 int DecodeENIPPDU(const uint8_t *input, uint32_t input_len,
234  ENIPTransaction *enip_data);
235 int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len,
236  ENIPTransaction *enip_data, uint16_t offset);
237 int DecodeCIPPDU(const uint8_t *input, uint32_t input_len,
238  ENIPTransaction *enip_data, uint16_t offset);
239 int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len,
240  ENIPTransaction *enip_data, uint16_t offset);
241 int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len,
242  ENIPTransaction *enip_data, uint16_t offset);
243 int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len,
244  CIPServiceEntry *node, uint16_t offset);
245 int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len,
246  ENIPTransaction *enip_data, uint16_t offset);
247 int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len,
248  ENIPTransaction *enip_data, uint16_t offset);
249 
250 #endif /* __APP_LAYER_ENIP_COMMON_H__ */
struct ENIPState_ * enip
ENIPEncapDataItem encap_data_item
struct ENIPEncapDataItem_ ENIPEncapDataItem
struct HtpBodyChunk_ * next
ENIPTransaction * iter
struct ENIPEncapAddresItem_ ENIPEncapAddresItem
struct CIPRespHdr_ CIPRespHdr
uint64_t offset
uint64_t transaction_max
struct CIPReqHdr_ CIPReqHdr
#define TAILQ_HEAD(name, type)
Definition: queue.h:321
ENIPTransaction * curr
Data structure to store app layer decoder events.
ENIPEncapAddresItem encap_addr_item
uint64_t tx_with_detect_state_cnt
int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode Common Packet Format.
Per flow ENIP state container.
struct ENIPEncapDataHdr_ ENIPEncapDataHdr
ENIPEncapDataHdr encap_data_header
int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response MultiService Packet.
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
#define TAILQ_ENTRY(type)
Definition: queue.h:330
int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request.
struct ENIPState_ ENIPState
Per flow ENIP state container.
int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
Deocde CIP Request Path.
struct ENIPEncapHdr_ ENIPEncapHdr
int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request Multi Service Packet.
int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response.
int DecodeCIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP packet.