suricata
app-layer-enip-common.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  */
23 
24 #ifndef SURICATA_APP_LAYER_ENIP_COMMON_H
25 #define SURICATA_APP_LAYER_ENIP_COMMON_H
26 
27 #include "rust.h"
28 
29 // EtherNet/IP commands
30 #define NOP 0x0000
31 #define LIST_SERVICES 0x0004
32 #define LIST_IDENTITY 0x0063
33 #define LIST_INTERFACES 0x0064
34 #define REGISTER_SESSION 0x0065
35 #define UNREGISTER_SESSION 0x0066
36 #define SEND_RR_DATA 0x006F
37 #define SEND_UNIT_DATA 0x0070
38 #define INDICATE_STATUS 0x0072
39 #define CANCEL 0x0073
40 
41 //Common Packet Format Types
42 #define NULL_ADDR 0x0000
43 #define CONNECTION_BASED 0x00a1
44 #define CONNECTED_DATA_ITEM 0x00b1
45 #define UNCONNECTED_DATA_ITEM 0x00b2
46 #define SEQUENCE_ADDR_ITEM 0xB002
47 
48 //status codes
49 #define SUCCESS 0x0000
50 #define INVALID_CMD 0x0001
51 #define NO_RESOURCES 0x0002
52 #define INCORRECT_DATA 0x0003
53 #define INVALID_SESSION 0x0064
54 #define INVALID_LENGTH 0x0065
55 #define UNSUPPORTED_PROT_REV 0x0069
56 //Found in wireshark
57 #define ENCAP_HEADER_ERROR 0x006A
58 
59 #define MAX_CIP_SERVICE 127
60 #define MAX_CIP_CLASS 65535
61 #define MAX_CIP_ATTRIBUTE 65535
62 
63 // CIP service codes
64 #define CIP_RESERVED 0x00
65 #define CIP_GET_ATTR_ALL 0x01
66 #define CIP_GET_ATTR_LIST 0x03
67 #define CIP_SET_ATTR_LIST 0x04
68 #define CIP_RESET 0x05
69 #define CIP_START 0x06
70 #define CIP_STOP 0x07
71 #define CIP_CREATE 0x08
72 #define CIP_DELETE 0x09
73 #define CIP_MSP 0x0a
74 #define CIP_APPLY_ATTR 0x0d
75 #define CIP_GET_ATTR_SINGLE 0x0e
76 #define CIP_SET_ATTR_SINGLE 0x10
77 #define CIP_KICK_TIMER 0x4b
78 #define CIP_OPEN_CONNECTION 0x4c
79 #define CIP_CHANGE_START 0x4f
80 #define CIP_GET_STATUS 0x50
81 
82 //PATH sizing codes
83 #define PATH_CLASS_8BIT 0x20
84 #define PATH_CLASS_16BIT 0x21
85 #define PATH_INSTANCE_8BIT 0x24
86 #define PATH_INSTANCE_16BIT 0x25
87 #define PATH_ATTR_8BIT 0x30
88 #define PATH_ATTR_16BIT 0x31 //possible value
89 
90 /**
91  * ENIP encapsulation header
92  */
93 typedef struct ENIPEncapHdr_
94 {
95  uint64_t context;
96  uint32_t session;
97  uint32_t status;
98  uint32_t option;
99  uint16_t command;
100  uint16_t length;
102 
103 /**
104  * ENIP encapsulation data header
105  */
106 typedef struct ENIPEncapDataHdr_
107 {
109  uint16_t timeout;
110  uint16_t item_count;
112 
113 /**
114  * ENIP encapsulation address item
115  */
116 typedef struct ENIPEncapAddressItem_ {
117  uint16_t type;
118  uint16_t length;
119  uint32_t conn_id;
120  uint32_t sequence_num;
122 
123 /**
124  * ENIP encapsulation data item
125  */
126 typedef struct ENIPEncapDataItem_
127 {
128  uint16_t type;
129  uint16_t length;
130  uint16_t sequence_count;
132 
133 /**
134  * CIP Request Header
135  */
136 typedef struct CIPReqHdr_
137 {
138  uint8_t service;
139  uint8_t path_size;
141 
142 /**
143  * CIP Response Header
144  */
145 typedef struct CIPRespHdr_
146 {
147  uint8_t service;
148  uint8_t pad;
149  uint8_t status;
150  uint8_t status_size;
152 
153 typedef struct SegmentEntry_
154 {
155  uint16_t segment; /**< segment type */
156  uint16_t value; /**< segment value (class or attribute) */
157 
160 
161 typedef struct AttributeEntry_
162 {
163  uint16_t attribute; /**< segment class */
164 
167 
168 typedef struct CIPServiceEntry_
169 {
170  uint8_t service; /**< cip service */
171  uint8_t direction;
172  union
173  {
174  struct
175  {
176  uint8_t path_size; /**< cip path size */
177  uint16_t path_offset; /**< offset to cip path */
179  struct
180  {
181  uint16_t status;
183  };
184 
185  TAILQ_HEAD(, SegmentEntry_) segment_list; /**< list for CIP segment */
186  TAILQ_HEAD(, AttributeEntry_) attrib_list; /**< list for CIP segment */
187 
190 
191 typedef struct ENIPTransaction_
192 {
193  struct ENIPState_ *enip;
194  uint64_t tx_num; /**< internal: id */
195  uint16_t tx_id; /**< transaction id */
196  uint16_t service_count;
197 
198  ENIPEncapHdr header; /**< encapsulation header */
199  ENIPEncapDataHdr encap_data_header; /**< encapsulation data header */
200  ENIPEncapAddressItem encap_addr_item; /**< encapsulated address item */
201  ENIPEncapDataItem encap_data_item; /**< encapsulated data item */
202 
203  TAILQ_HEAD(, CIPServiceEntry_) service_list; /**< list for CIP */
204 
208 
209 /** \brief Per flow ENIP state container */
210 typedef struct ENIPState_
211 {
212  AppLayerStateData state_data;
213  TAILQ_HEAD(, ENIPTransaction_) tx_list; /**< transaction list */
214  ENIPTransaction *curr; /**< ptr to current tx */
216  uint64_t transaction_max;
218 
219  uint16_t events;
220  uint16_t givenup;
221 
222  /* used by TCP only */
223  uint16_t offset;
224  uint16_t record_len;
225  uint8_t *buffer;
227 
228 int DecodeENIPPDU(const uint8_t *input, uint32_t input_len,
229  ENIPTransaction *enip_data);
230 int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len,
231  ENIPTransaction *enip_data, uint16_t offset);
232 int DecodeCIPPDU(const uint8_t *input, uint32_t input_len,
233  ENIPTransaction *enip_data, uint16_t offset);
234 int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len,
235  ENIPTransaction *enip_data, uint16_t offset);
236 int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len,
237  ENIPTransaction *enip_data, uint16_t offset);
238 int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len,
239  CIPServiceEntry *node, uint16_t offset);
240 int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len,
241  ENIPTransaction *enip_data, uint16_t offset);
242 int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len,
243  ENIPTransaction *enip_data, uint16_t offset);
244 
245 #endif /* SURICATA_APP_LAYER_ENIP_COMMON_H */
ENIPEncapAddressItem_::length
uint16_t length
Definition: app-layer-enip-common.h:118
ENIPEncapAddressItem
struct ENIPEncapAddressItem_ ENIPEncapAddressItem
ENIPTransaction_::encap_data_header
ENIPEncapDataHdr encap_data_header
Definition: app-layer-enip-common.h:199
CIPServiceEntry_::response
struct CIPServiceEntry_::@2::@5 response
SegmentEntry_
Definition: app-layer-enip-common.h:154
CIPServiceEntry_::status
uint16_t status
Definition: app-layer-enip-common.h:181
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
CIPServiceEntry_::path_offset
uint16_t path_offset
Definition: app-layer-enip-common.h:177
ENIPState
struct ENIPState_ ENIPState
Per flow ENIP state container.
CIPServiceEntry_::request
struct CIPServiceEntry_::@2::@4 request
CIPReqHdr_::path_size
uint8_t path_size
Definition: app-layer-enip-common.h:139
CIPRespHdr_
Definition: app-layer-enip-common.h:146
ENIPState_
Per flow ENIP state container.
Definition: app-layer-enip-common.h:211
ENIPState_::events
uint16_t events
Definition: app-layer-enip-common.h:219
ENIPState_::state_data
AppLayerStateData state_data
Definition: app-layer-enip-common.h:212
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
ENIPEncapHdr_::session
uint32_t session
Definition: app-layer-enip-common.h:96
ENIPState_::offset
uint16_t offset
Definition: app-layer-enip-common.h:223
ENIPEncapDataItem_::length
uint16_t length
Definition: app-layer-enip-common.h:129
ENIPEncapHdr_::option
uint32_t option
Definition: app-layer-enip-common.h:98
SegmentEntry_::TAILQ_ENTRY
TAILQ_ENTRY(SegmentEntry_) next
ENIPEncapDataItem_::sequence_count
uint16_t sequence_count
Definition: app-layer-enip-common.h:130
ENIPState_::TAILQ_HEAD
TAILQ_HEAD(, ENIPTransaction_) tx_list
rust.h
SegmentEntry_::segment
uint16_t segment
Definition: app-layer-enip-common.h:155
ENIPState_::record_len
uint16_t record_len
Definition: app-layer-enip-common.h:224
ENIPEncapDataHdr_::item_count
uint16_t item_count
Definition: app-layer-enip-common.h:110
DecodeCommonPacketFormatPDU
int DecodeCommonPacketFormatPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode Common Packet Format.
Definition: app-layer-enip-common.c:292
ENIPEncapHdr_::command
uint16_t command
Definition: app-layer-enip-common.h:99
AttributeEntry_
Definition: app-layer-enip-common.h:162
CIPServiceEntry_
Definition: app-layer-enip-common.h:169
DecodeCIPRequestMSPPDU
int DecodeCIPRequestMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request Multi Service Packet.
Definition: app-layer-enip-common.c:867
CIPReqHdr_
Definition: app-layer-enip-common.h:137
ENIPTransaction
struct ENIPTransaction_ ENIPTransaction
CIPServiceEntry
struct CIPServiceEntry_ CIPServiceEntry
ENIPEncapHdr_::context
uint64_t context
Definition: app-layer-enip-common.h:95
CIPRespHdr
struct CIPRespHdr_ CIPRespHdr
ENIPTransaction_::enip
struct ENIPState_ * enip
Definition: app-layer-enip-common.h:193
CIPServiceEntry_::path_size
uint8_t path_size
Definition: app-layer-enip-common.h:176
ENIPEncapHdr_
Definition: app-layer-enip-common.h:94
CIPServiceEntry_::service
uint8_t service
Definition: app-layer-enip-common.h:170
DecodeCIPResponseMSPPDU
int DecodeCIPResponseMSPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response MultiService Packet.
Definition: app-layer-enip-common.c:919
ENIPTransaction_::encap_data_item
ENIPEncapDataItem encap_data_item
Definition: app-layer-enip-common.h:201
ENIPEncapAddressItem_::type
uint16_t type
Definition: app-layer-enip-common.h:117
ENIPState_::buffer
uint8_t * buffer
Definition: app-layer-enip-common.h:225
ENIPEncapAddressItem_::sequence_num
uint32_t sequence_num
Definition: app-layer-enip-common.h:120
ENIPTransaction_::tx_data
AppLayerTxData tx_data
Definition: app-layer-enip-common.h:206
ENIPEncapDataHdr_
Definition: app-layer-enip-common.h:107
DecodeCIPRequestPathPDU
int DecodeCIPRequestPathPDU(const uint8_t *input, uint32_t input_len, CIPServiceEntry *node, uint16_t offset)
Decode CIP Request Path.
Definition: app-layer-enip-common.c:575
CIPReqHdr_::service
uint8_t service
Definition: app-layer-enip-common.h:138
DecodeCIPResponsePDU
int DecodeCIPResponsePDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Response.
Definition: app-layer-enip-common.c:748
ENIPEncapDataItem
struct ENIPEncapDataItem_ ENIPEncapDataItem
SegmentEntry
struct SegmentEntry_ SegmentEntry
AttributeEntry
struct AttributeEntry_ AttributeEntry
ENIPTransaction_::tx_num
uint64_t tx_num
Definition: app-layer-enip-common.h:194
CIPRespHdr_::service
uint8_t service
Definition: app-layer-enip-common.h:147
ENIPState_::iter
ENIPTransaction * iter
Definition: app-layer-enip-common.h:215
ENIPTransaction_
Definition: app-layer-enip-common.h:192
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1370
ENIPTransaction_::TAILQ_HEAD
TAILQ_HEAD(, CIPServiceEntry_) service_list
CIPServiceEntry_::TAILQ_ENTRY
TAILQ_ENTRY(CIPServiceEntry_) next
ENIPTransaction_::tx_id
uint16_t tx_id
Definition: app-layer-enip-common.h:195
ENIPEncapDataHdr_::interface_handle
uint32_t interface_handle
Definition: app-layer-enip-common.h:108
AttributeEntry_::TAILQ_ENTRY
TAILQ_ENTRY(AttributeEntry_) next
CIPServiceEntry_::TAILQ_HEAD
TAILQ_HEAD(, AttributeEntry_) attrib_list
ENIPState_::curr
ENIPTransaction * curr
Definition: app-layer-enip-common.h:214
ENIPEncapHdr_::status
uint32_t status
Definition: app-layer-enip-common.h:97
CIPRespHdr_::pad
uint8_t pad
Definition: app-layer-enip-common.h:148
ENIPEncapDataHdr_::timeout
uint16_t timeout
Definition: app-layer-enip-common.h:109
ENIPTransaction_::service_count
uint16_t service_count
Definition: app-layer-enip-common.h:196
ENIPEncapHdr
struct ENIPEncapHdr_ ENIPEncapHdr
ENIPEncapDataItem_
Definition: app-layer-enip-common.h:127
ENIPState_::tx_with_detect_state_cnt
uint64_t tx_with_detect_state_cnt
Definition: app-layer-enip-common.h:217
ENIPEncapDataHdr
struct ENIPEncapDataHdr_ ENIPEncapDataHdr
ENIPEncapDataItem_::type
uint16_t type
Definition: app-layer-enip-common.h:128
DecodeCIPPDU
int DecodeCIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP packet.
Definition: app-layer-enip-common.c:412
ENIPEncapHdr_::length
uint16_t length
Definition: app-layer-enip-common.h:100
ENIPState_::transaction_max
uint64_t transaction_max
Definition: app-layer-enip-common.h:216
ENIPState_::givenup
uint16_t givenup
Definition: app-layer-enip-common.h:220
CIPRespHdr_::status_size
uint8_t status_size
Definition: app-layer-enip-common.h:150
CIPRespHdr_::status
uint8_t status
Definition: app-layer-enip-common.h:149
ENIPEncapAddressItem_::conn_id
uint32_t conn_id
Definition: app-layer-enip-common.h:119
DecodeENIPPDU
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
Definition: app-layer-enip-common.c:191
ENIPTransaction_::header
ENIPEncapHdr header
Definition: app-layer-enip-common.h:198
CIPServiceEntry_::direction
uint8_t direction
Definition: app-layer-enip-common.h:171
CIPReqHdr
struct CIPReqHdr_ CIPReqHdr
ENIPEncapAddressItem_
Definition: app-layer-enip-common.h:116
SegmentEntry_::value
uint16_t value
Definition: app-layer-enip-common.h:156
AttributeEntry_::attribute
uint16_t attribute
Definition: app-layer-enip-common.h:163
DecodeCIPRequestPDU
int DecodeCIPRequestPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data, uint16_t offset)
Decode CIP Request.
Definition: app-layer-enip-common.c:456
ENIPTransaction_::TAILQ_ENTRY
TAILQ_ENTRY(ENIPTransaction_) next
ENIPTransaction_::encap_addr_item
ENIPEncapAddressItem encap_addr_item
Definition: app-layer-enip-common.h:200
CIPServiceEntry_::TAILQ_HEAD
TAILQ_HEAD(, SegmentEntry_) segment_list