Go to the documentation of this file.
65 static int ENIPGetAlstateProgress(
void *tx, uint8_t direction)
76 static AppLayerStateData *ENIPGetStateData(
void *vstate)
82 static void *ENIPGetTx(
void *alstate, uint64_t tx_id)
91 if (tx->
tx_num != (tx_id+1))
101 static uint64_t ENIPGetTxCnt(
void *alstate)
103 return ((
ENIPState *)alstate)->transaction_max;
106 static int ENIPStateGetEventInfo(
const char *event_name,
int *event_id, AppLayerEventType *event_type)
110 if (*event_id == -1) {
112 "enip's enum map table.",
118 *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
123 static int ENIPStateGetEventInfoById(
int event_id,
const char **event_name,
124 AppLayerEventType *event_type)
127 if (*event_name == NULL) {
129 "enip's enum map table.",
135 *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
144 static void *ENIPStateAlloc(
void *orig_state,
AppProto proto_orig)
188 if (tx->
tx_data.de_state != NULL) {
194 if (state->
iter == tx)
204 static void ENIPStateFree(
void *s)
216 ENIPTransactionFree(tx, enip_state);
219 if (enip_state->
buffer != NULL)
257 static void ENIPStateTransactionFree(
void *state, uint64_t tx_id)
266 if ((tx_id+1) < tx->
tx_num)
268 else if ((tx_id+1) > tx->
tx_num)
271 if (tx == enip_state->
curr)
272 enip_state->
curr = NULL;
274 if (tx->
tx_data.events != NULL) {
282 ENIPTransactionFree(tx, state);
299 StreamSlice stream_slice,
void *local_data, uint8_t direction)
305 const uint8_t *input = StreamSliceGetData(&stream_slice);
306 uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
312 }
else if (input == NULL && input_len != 0) {
315 }
else if (input == NULL || input_len == 0)
320 while (input_len > 0)
322 tx = ENIPTransactionAlloc(enip);
326 if (direction == STREAM_TOCLIENT)
331 SCLogDebug(
"ENIPParse input len %d", input_len);
334 SCLogDebug(
"ENIPParse packet len %d", pkt_len);
335 if (pkt_len > input_len)
342 input_len -= pkt_len;
356 StreamSlice stream_slice,
void *local_data)
358 return ENIPParse(f, state, pstate, stream_slice, local_data, STREAM_TOSERVER);
362 StreamSlice stream_slice,
void *local_data)
364 return ENIPParse(f, state, pstate, stream_slice, local_data, STREAM_TOCLIENT);
367 #define ENIP_LEN_REGISTER_SESSION 4 // protocol u16, options u16
369 static uint16_t ENIPProbingParser(
Flow *f, uint8_t direction,
370 const uint8_t *input, uint32_t input_len, uint8_t *rdir)
375 SCLogDebug(
"length too small to be a ENIP header");
444 SCLogDebug(
"length too small to be a ENIP LIST_INTERFACES");
452 if (enip_len <
sizeof(
ENIPEncapHdr) + 2 * (
size_t)nbitems) {
462 static AppLayerGetTxIterTuple ENIPGetTxIterator(
const uint8_t ipproto,
const AppProto alproto,
466 AppLayerGetTxIterTuple no_tuple = { NULL, 0,
false };
469 if (state->
un.
ptr == NULL) {
475 while (tx_ptr->
tx_num < min_tx_id + 1) {
481 if (tx_ptr->
tx_num >= max_tx_id + 1) {
485 AppLayerGetTxIterTuple tuple = {
488 .has_next = (state->
un.
ptr != NULL),
502 const char *proto_name =
"enip";
510 0,
sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
513 0,
sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
519 ENIPProbingParser, ENIPProbingParser))
522 "no ENIP UDP config found enabling ENIP detection on port 44818.");
526 ENIPProbingParser, NULL);
530 ENIPProbingParser, NULL);
535 SCLogConfig(
"Protocol detection and parser disabled for %s protocol.",
546 ENIPStateAlloc, ENIPStateFree);
562 IPPROTO_UDP,
ALPROTO_ENIP, STREAM_TOSERVER | STREAM_TOCLIENT);
565 SCLogInfo(
"Parser disabled for %s protocol. Protocol detection still on.", proto_name);
581 const char *proto_name =
"enip";
589 0,
sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
592 0,
sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
598 ENIPProbingParser, ENIPProbingParser))
600 SCLogDebug(
"no ENIP TCP config found enabling ENIP detection on port 44818.");
603 sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
606 sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
613 SCLogDebug(
"Protocol detection and parser disabled for %s protocol.",
623 ENIPStateAlloc, ENIPStateFree);
647 SCLogConfig(
"Parser disabled for %s protocol. Protocol detection still on.",
663 static uint8_t listIdentity[] = { 0x63, 0x00,
665 0x00, 0x00, 0x00, 0x00,
666 0x00, 0x00, 0x00, 0x00,
668 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
669 0x00, 0x00, 0x00, 0x00, 0x00};
674 static int ALDecodeENIPTest(
void)
680 memset(&f, 0,
sizeof(f));
681 memset(&ssn, 0,
sizeof(ssn));
684 f.
proto = IPPROTO_TCP;
690 listIdentity,
sizeof(listIdentity));
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
union AppLayerGetTxIterState::@15 un
SCEnumCharMap enip_decoder_event_table[]
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Per flow ENIP state container.
AppLayerStateData state_data
struct HtpBodyChunk_ * next
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
#define ENIP_LEN_REGISTER_SESSION
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
#define TAILQ_FOREACH(var, head, field)
#define APP_LAYER_TX_SKIP_INSPECT_FLAG
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
#define TAILQ_INSERT_TAIL(head, elm, field)
#define APP_LAYER_PARSER_EOF_TS
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
#define TAILQ_REMOVE(head, elm, field)
#define TAILQ_FIRST(head)
#define PASS
Pass the test.
#define ENCAP_HEADER_ERROR
AppLayerParserThreadCtx * alp_tctx
void RegisterENIPTCPParsers(void)
Function to register the ENIP protocol parsers and other functions.
int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes)
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
#define APP_LAYER_PARSER_EOF_TC
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
void ENIPParserRegisterTests(void)
int RunmodeIsUnittests(void)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
struct AppLayerTxData AppLayerTxData
#define BYTE_LITTLE_ENDIAN
const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table)
Maps an enum value to a string name, from the supplied table.
#define SCReturnStruct(x)
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void StreamTcpFreeConfig(bool quiet)
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
#define TAILQ_NEXT(elm, field)
void RegisterENIPUDPParsers(void)
Function to register the ENIP protocol parsers and other functions.
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
#define UNSUPPORTED_PROT_REV
#define SCLogError(...)
Macro used to log ERROR messages.
struct ENIPEncapHdr_ ENIPEncapHdr
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
uint64_t tx_with_detect_state_cnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
int AppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
AppProto alproto
application level protocol
#define UNREGISTER_SESSION