suricata
app-layer-enip-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  */
23 
24 #ifndef __APP_LAYER_ENIP_COMMON_H__
25 #define __APP_LAYER_ENIP_COMMON_H__
26 
27 #include "app-layer-protos.h"
28 #include "app-layer-parser.h"
29 #include "flow.h"
30 #include "queue.h"
31 
32 #define MAX_ENIP_CMD 65535
33 
34 // EtherNet/IP commands
35 #define NOP 0x0000
36 #define LIST_SERVICES 0x0004
37 #define LIST_IDENTITY 0x0063
38 #define LIST_INTERFACES 0x0064
39 #define REGISTER_SESSION 0x0065
40 #define UNREGISTER_SESSION 0x0066
41 #define SEND_RR_DATA 0x006F
42 #define SEND_UNIT_DATA 0x0070
43 #define INDICATE_STATUS 0x0072
44 #define CANCEL 0x0073
45 
46 //Common Packet Format Types
47 #define NULL_ADDR 0x0000
48 #define CONNECTION_BASED 0x00a1
49 #define CONNECTED_DATA_ITEM 0x00b1
50 #define UNCONNECTED_DATA_ITEM 0x00b2
51 #define SEQUENCE_ADDR_ITEM 0xB002
52 
53 //status codes
54 #define SUCCESS 0x0000
55 #define INVALID_CMD 0x0001
56 #define NO_RESOURCES 0x0002
57 #define INCORRECT_DATA 0x0003
58 #define INVALID_SESSION 0x0064
59 #define INVALID_LENGTH 0x0065
60 #define UNSUPPORTED_PROT_REV 0x0069
61 
62 #define MAX_CIP_SERVICE 127
63 #define MAX_CIP_CLASS 65535
64 #define MAX_CIP_ATTRIBUTE 65535
65 
66 // CIP service codes
67 #define CIP_RESERVED 0x00
68 #define CIP_GET_ATTR_ALL 0x01
69 #define CIP_GET_ATTR_LIST 0x03
70 #define CIP_SET_ATTR_LIST 0x04
71 #define CIP_RESET 0x05
72 #define CIP_START 0x06
73 #define CIP_STOP 0x07
74 #define CIP_CREATE 0x08
75 #define CIP_DELETE 0x09
76 #define CIP_MSP 0x0a
77 #define CIP_APPLY_ATTR 0x0d
78 #define CIP_GET_ATTR_SINGLE 0x0e
79 #define CIP_SET_ATTR_SINGLE 0x10
80 #define CIP_KICK_TIMER 0x4b
81 #define CIP_OPEN_CONNECTION 0x4c
82 #define CIP_CHANGE_START 0x4f
83 #define CIP_GET_STATUS 0x50
84 
85 //PATH sizing codes
86 #define PATH_CLASS_8BIT 0x20
87 #define PATH_CLASS_16BIT 0x21
88 #define PATH_INSTANCE_8BIT 0x24
89 #define PATH_INSTANCE_16BIT 0x25
90 #define PATH_ATTR_8BIT 0x30
91 #define PATH_ATTR_16BIT 0x31 //possible value
92 
93 /**
94  * ENIP encapsulation header
95  */
96 typedef struct ENIPEncapHdr_
97 {
98  uint64_t context;
99  uint32_t session;
100  uint32_t status;
101  uint32_t option;
102  uint16_t command;
103  uint16_t length;
105 
106 /**
107  * ENIP encapsulation data header
108  */
109 typedef struct ENIPEncapDataHdr_
110 {
112  uint16_t timeout;
113  uint16_t item_count;
115 
116 /**
117  * ENIP encapsulation address item
118  */
119 typedef struct ENIPEncapAddresItem_
120 {
121  uint16_t type;
122  uint16_t length;
123  uint16_t conn_id;
124  uint16_t sequence_num;
126 
127 /**
128  * ENIP encapsulation data item
129  */
130 typedef struct ENIPEncapDataItem_
131 {
132  uint16_t type;
133  uint16_t length;
134  uint16_t sequence_count;
136 
137 /**
138  * CIP Request Header
139  */
140 typedef struct CIPReqHdr_
141 {
142  uint8_t service;
143  uint8_t path_size;
145 
146 /**
147  * CIP Response Header
148  */
149 typedef struct CIPRespHdr_
150 {
151  uint8_t service;
152  uint8_t pad;
153  uint8_t status;
154  uint8_t status_size;
156 
157 typedef struct SegmentEntry_
158 {
159  uint16_t segment; /**< segment type */
160  uint16_t value; /**< segment value (class or attribute) */
161 
164 
165 typedef struct AttributeEntry_
166 {
167  uint16_t attribute; /**< segment class */
168 
171 
172 typedef struct CIPServiceEntry_
173 {
174  uint8_t service; /**< cip service */
175  uint8_t direction;
176  union
177  {
178  struct
179  {
180  uint8_t path_size; /**< cip path size */
181  uint16_t path_offset; /**< offset to cip path */
183  struct
184  {
185  uint8_t status;
187  };
188 
189  TAILQ_HEAD(, SegmentEntry_) segment_list; /**< list for CIP segment */
190  TAILQ_HEAD(, AttributeEntry_) attrib_list; /**< list for CIP segment */
191 
194 
195 typedef struct ENIPTransaction_
196 {
197  struct ENIPState_ *enip;
198  uint16_t tx_num; /**< internal: id */
199  uint16_t tx_id; /**< transaction id */
200  uint16_t service_count;
201 
202  ENIPEncapHdr header; /**< encapsulation header */
203  ENIPEncapDataHdr encap_data_header; /**< encapsulation data header */
204  ENIPEncapAddresItem encap_addr_item; /**< encapsulated address item */
205  ENIPEncapDataItem encap_data_item; /**< encapsulated data item */
206 
207  TAILQ_HEAD(, CIPServiceEntry_) service_list; /**< list for CIP */
208 
209  AppLayerDecoderEvents *decoder_events; /**< per tx events */
210 
213  uint64_t detect_flags_ts;
214  uint64_t detect_flags_tc;
216 
217 /** \brief Per flow ENIP state container */
218 typedef struct ENIPState_
219 {
220  TAILQ_HEAD(, ENIPTransaction_) tx_list; /**< transaction list */
221  ENIPTransaction *curr; /**< ptr to current tx */
223  uint64_t transaction_max;
225 
226  uint16_t events;
227  uint16_t givenup;
228 
229  /* used by TCP only */
230  uint16_t offset;
231  uint16_t record_len;
232  uint8_t *buffer;
234 
235 int DecodeENIPPDU(const uint8_t *input, uint32_t input_len,
236  ENIPTransaction *enip_data);
237 int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len,
238  ENIPTransaction *enip_data, uint16_t offset);
239 int DecodeCIPPDU(const uint8_t *input, uint32_t input_len,
240  ENIPTransaction *enip_data, uint16_t offset);
241 int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len,
242  ENIPTransaction *enip_data, uint16_t offset);
243 int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len,
244  ENIPTransaction *enip_data, uint16_t offset);
245 int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len,
246  CIPServiceEntry *node, uint16_t offset);
247 int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len,
248  ENIPTransaction *enip_data, uint16_t offset);
249 int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len,
250  ENIPTransaction *enip_data, uint16_t offset);
251 
252 #endif /* __APP_LAYER_ENIP_COMMON_H__ */
ENIPTransaction_::encap_data_header
ENIPEncapDataHdr encap_data_header
Definition: app-layer-enip-common.h:203
CIPServiceEntry_::response
struct CIPServiceEntry_::@2::@5 response
SegmentEntry_
Definition: app-layer-enip-common.h:158
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
CIPServiceEntry_::path_offset
uint16_t path_offset
Definition: app-layer-enip-common.h:181
ENIPState
struct ENIPState_ ENIPState
Per flow ENIP state container.
CIPServiceEntry_::request
struct CIPServiceEntry_::@2::@4 request
CIPReqHdr_::path_size
uint8_t path_size
Definition: app-layer-enip-common.h:143
DetectEngineState_
Definition: detect-engine-state.h:92
CIPRespHdr_
Definition: app-layer-enip-common.h:150
ENIPState_
Per flow ENIP state container.
Definition: app-layer-enip-common.h:219
ENIPState_::events
uint16_t events
Definition: app-layer-enip-common.h:226
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
ENIPEncapHdr_::session
uint32_t session
Definition: app-layer-enip-common.h:99
ENIPState_::offset
uint16_t offset
Definition: app-layer-enip-common.h:230
ENIPEncapDataItem_::length
uint16_t length
Definition: app-layer-enip-common.h:133
ENIPEncapHdr_::option
uint32_t option
Definition: app-layer-enip-common.h:101
SegmentEntry_::TAILQ_ENTRY
TAILQ_ENTRY(SegmentEntry_) next
ENIPEncapDataItem_::sequence_count
uint16_t sequence_count
Definition: app-layer-enip-common.h:134
ENIPTransaction_::encap_addr_item
ENIPEncapAddresItem encap_addr_item
Definition: app-layer-enip-common.h:204
ENIPState_::TAILQ_HEAD
TAILQ_HEAD(, ENIPTransaction_) tx_list
SegmentEntry_::segment
uint16_t segment
Definition: app-layer-enip-common.h:159
ENIPTransaction_::tx_num
uint16_t tx_num
Definition: app-layer-enip-common.h:198
CIPServiceEntry_::status
uint8_t status
Definition: app-layer-enip-common.h:185
ENIPState_::record_len
uint16_t record_len
Definition: app-layer-enip-common.h:231
ENIPEncapDataHdr_::item_count
uint16_t item_count
Definition: app-layer-enip-common.h:113
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
DecodeCommonPacketFormatPDU
int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode Common Packet Format.
Definition: app-layer-enip-common.c:286
ENIPEncapHdr_::command
uint16_t command
Definition: app-layer-enip-common.h:102
AttributeEntry_
Definition: app-layer-enip-common.h:166
CIPServiceEntry_
Definition: app-layer-enip-common.h:173
DecodeCIPRequestMSPPDU
int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request Multi Service Packet.
Definition: app-layer-enip-common.c:863
CIPReqHdr_
Definition: app-layer-enip-common.h:141
ENIPTransaction
struct ENIPTransaction_ ENIPTransaction
CIPServiceEntry
struct CIPServiceEntry_ CIPServiceEntry
ENIPEncapAddresItem_::length
uint16_t length
Definition: app-layer-enip-common.h:122
ENIPEncapHdr_::context
uint64_t context
Definition: app-layer-enip-common.h:98
CIPRespHdr
struct CIPRespHdr_ CIPRespHdr
ENIPTransaction_::enip
struct ENIPState_ * enip
Definition: app-layer-enip-common.h:197
CIPServiceEntry_::path_size
uint8_t path_size
Definition: app-layer-enip-common.h:180
ENIPTransaction_::detect_flags_tc
uint64_t detect_flags_tc
Definition: app-layer-enip-common.h:214
ENIPEncapHdr_
Definition: app-layer-enip-common.h:97
ENIPEncapAddresItem_
Definition: app-layer-enip-common.h:120
CIPServiceEntry_::service
uint8_t service
Definition: app-layer-enip-common.h:174
DecodeCIPResponseMSPPDU
int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response MultiService Packet.
Definition: app-layer-enip-common.c:910
app-layer-parser.h
ENIPTransaction_::detect_flags_ts
uint64_t detect_flags_ts
Definition: app-layer-enip-common.h:213
ENIPTransaction_::encap_data_item
ENIPEncapDataItem encap_data_item
Definition: app-layer-enip-common.h:205
ENIPEncapAddresItem
struct ENIPEncapAddresItem_ ENIPEncapAddresItem
ENIPState_::buffer
uint8_t * buffer
Definition: app-layer-enip-common.h:232
ENIPEncapAddresItem_::conn_id
uint16_t conn_id
Definition: app-layer-enip-common.h:123
queue.h
ENIPEncapDataHdr_
Definition: app-layer-enip-common.h:110
DecodeCIPRequestPathPDU
int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
Deocde CIP Request Path.
Definition: app-layer-enip-common.c:571
CIPReqHdr_::service
uint8_t service
Definition: app-layer-enip-common.h:142
DecodeCIPResponsePDU
int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response.
Definition: app-layer-enip-common.c:744
ENIPEncapDataItem
struct ENIPEncapDataItem_ ENIPEncapDataItem
SegmentEntry
struct SegmentEntry_ SegmentEntry
AttributeEntry
struct AttributeEntry_ AttributeEntry
CIPRespHdr_::service
uint8_t service
Definition: app-layer-enip-common.h:151
ENIPState_::iter
ENIPTransaction * iter
Definition: app-layer-enip-common.h:222
ENIPTransaction_
Definition: app-layer-enip-common.h:196
ENIPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, CIPServiceEntry_) service_list
CIPServiceEntry_::TAILQ_ENTRY
TAILQ_ENTRY(CIPServiceEntry_) next
ENIPTransaction_::tx_id
uint16_t tx_id
Definition: app-layer-enip-common.h:199
ENIPEncapDataHdr_::interface_handle
uint32_t interface_handle
Definition: app-layer-enip-common.h:111
AttributeEntry_::TAILQ_ENTRY
TAILQ_ENTRY(AttributeEntry_) next
ENIPEncapAddresItem_::sequence_num
uint16_t sequence_num
Definition: app-layer-enip-common.h:124
CIPServiceEntry_::TAILQ_HEAD
TAILQ_HEAD(, AttributeEntry_) attrib_list
ENIPState_::curr
ENIPTransaction * curr
Definition: app-layer-enip-common.h:221
ENIPEncapHdr_::status
uint32_t status
Definition: app-layer-enip-common.h:100
CIPRespHdr_::pad
uint8_t pad
Definition: app-layer-enip-common.h:152
ENIPTransaction_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: app-layer-enip-common.h:209
ENIPEncapDataHdr_::timeout
uint16_t timeout
Definition: app-layer-enip-common.h:112
ENIPTransaction_::de_state
DetectEngineState * de_state
Definition: app-layer-enip-common.h:212
ENIPTransaction_::service_count
uint16_t service_count
Definition: app-layer-enip-common.h:200
ENIPEncapHdr
struct ENIPEncapHdr_ ENIPEncapHdr
ENIPEncapDataItem_
Definition: app-layer-enip-common.h:131
ENIPState_::tx_with_detect_state_cnt
uint64_t tx_with_detect_state_cnt
Definition: app-layer-enip-common.h:224
ENIPEncapDataHdr
struct ENIPEncapDataHdr_ ENIPEncapDataHdr
ENIPEncapDataItem_::type
uint16_t type
Definition: app-layer-enip-common.h:132
DecodeCIPPDU
int DecodeCIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP packet.
Definition: app-layer-enip-common.c:407
ENIPEncapHdr_::length
uint16_t length
Definition: app-layer-enip-common.h:103
app-layer-protos.h
ENIPState_::transaction_max
uint64_t transaction_max
Definition: app-layer-enip-common.h:223
ENIPState_::givenup
uint16_t givenup
Definition: app-layer-enip-common.h:227
CIPRespHdr_::status_size
uint8_t status_size
Definition: app-layer-enip-common.h:154
CIPRespHdr_::status
uint8_t status
Definition: app-layer-enip-common.h:153
flow.h
DecodeENIPPDU
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
Definition: app-layer-enip-common.c:185
ENIPTransaction_::header
ENIPEncapHdr header
Definition: app-layer-enip-common.h:202
ENIPEncapAddresItem_::type
uint16_t type
Definition: app-layer-enip-common.h:121
CIPServiceEntry_::direction
uint8_t direction
Definition: app-layer-enip-common.h:175
CIPReqHdr
struct CIPReqHdr_ CIPReqHdr
SegmentEntry_::value
uint16_t value
Definition: app-layer-enip-common.h:160
AttributeEntry_::attribute
uint16_t attribute
Definition: app-layer-enip-common.h:167
DecodeCIPRequestPDU
int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request.
Definition: app-layer-enip-common.c:451
ENIPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(ENIPTransaction_) next
CIPServiceEntry_::TAILQ_HEAD
TAILQ_HEAD(, SegmentEntry_) segment_list