Go to the documentation of this file.
65 static int ENIPGetAlstateProgress(
void *tx, uint8_t direction)
70 static AppLayerTxData *ENIPGetTxData(
void *vtx)
76 static void *ENIPGetTx(
void *alstate, uint64_t tx_id)
85 if (tx->
tx_num != (tx_id+1))
95 static uint64_t ENIPGetTxCnt(
void *alstate)
97 return ((
ENIPState *)alstate)->transaction_max;
100 static int ENIPStateGetEventInfo(
const char *event_name,
int *event_id,
AppLayerEventType *event_type)
104 if (*event_id == -1) {
106 "enip's enum map table.", event_name);
116 static int ENIPStateGetEventInfoById(
int event_id,
const char **event_name,
120 if (*event_name == NULL) {
122 "enip's enum map table.", event_id);
136 static void *ENIPStateAlloc(
void *orig_state,
AppProto proto_orig)
182 if (tx->
tx_data.de_state != NULL) {
188 if (state->
iter == tx)
198 static void ENIPStateFree(
void *s)
210 ENIPTransactionFree(tx, enip_state);
213 if (enip_state->
buffer != NULL)
252 static void ENIPStateTransactionFree(
void *state, uint64_t tx_id)
261 if ((tx_id+1) < tx->
tx_num)
263 else if ((tx_id+1) > tx->
tx_num)
266 if (tx == enip_state->
curr)
267 enip_state->
curr = NULL;
269 if (tx->
tx_data.events != NULL) {
277 ENIPTransactionFree(tx, state);
294 StreamSlice stream_slice,
void *local_data)
300 const uint8_t *input = StreamSliceGetData(&stream_slice);
301 uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
307 }
else if (input == NULL && input_len != 0) {
310 }
else if (input == NULL || input_len == 0)
315 while (input_len > 0)
317 tx = ENIPTransactionAlloc(enip);
321 SCLogDebug(
"ENIPParse input len %d", input_len);
324 SCLogDebug(
"ENIPParse packet len %d", pkt_len);
325 if (pkt_len > input_len)
332 input_len -= pkt_len;
345 #define ENIP_LEN_REGISTER_SESSION 4 // protocol u16, options u16
347 static uint16_t ENIPProbingParser(
Flow *f, uint8_t direction,
348 const uint8_t *input, uint32_t input_len, uint8_t *rdir)
353 SCLogDebug(
"length too small to be a ENIP header");
422 SCLogDebug(
"length too small to be a ENIP LIST_INTERFACES");
430 if (enip_len <
sizeof(
ENIPEncapHdr) + 2 * (
size_t)nbitems) {
446 const char *proto_name =
"enip";
454 0,
sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
457 0,
sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
463 ENIPProbingParser, ENIPProbingParser))
466 "no ENIP UDP config found enabling ENIP detection on port 44818.");
470 ENIPProbingParser, NULL);
474 ENIPProbingParser, NULL);
479 SCLogConfig(
"Protocol detection and parser disabled for %s protocol.",
487 STREAM_TOSERVER, ENIPParse);
489 STREAM_TOCLIENT, ENIPParse);
492 ENIPStateAlloc, ENIPStateFree);
512 "Parsed disabled for %s protocol. Protocol detection" "still on.",
529 const char *proto_name =
"enip";
537 0,
sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
540 0,
sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
546 ENIPProbingParser, ENIPProbingParser))
553 SCLogDebug(
"Protocol detection and parser disabled for %s protocol.",
561 STREAM_TOSERVER, ENIPParse);
563 STREAM_TOCLIENT, ENIPParse);
565 ENIPStateAlloc, ENIPStateFree);
588 SCLogConfig(
"Parser disabled for %s protocol. Protocol detection still on.",
609 static uint8_t listIdentity[] = { 0x63, 0x00,
611 0x00, 0x00, 0x00, 0x00,
612 0x00, 0x00, 0x00, 0x00,
614 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
615 0x00, 0x00, 0x00, 0x00, 0x00};
620 static int ALDecodeENIPTest(
void)
626 memset(&f, 0,
sizeof(f));
627 memset(&ssn, 0,
sizeof(ssn));
630 f.
proto = IPPROTO_TCP;
636 listIdentity,
sizeof(listIdentity));
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
SCEnumCharMap enip_decoder_event_table[]
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Per flow ENIP state container.
struct HtpBodyChunk_ * next
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
enum AppLayerEventType_ AppLayerEventType
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
#define ENIP_LEN_REGISTER_SESSION
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
#define TAILQ_FOREACH(var, head, field)
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
#define TAILQ_INSERT_TAIL(head, elm, field)
#define APP_LAYER_PARSER_EOF_TS
@ APP_LAYER_EVENT_TYPE_TRANSACTION
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
#define TAILQ_REMOVE(head, elm, field)
#define TAILQ_FIRST(head)
#define PASS
Pass the test.
#define ENCAP_HEADER_ERROR
AppLayerParserThreadCtx * alp_tctx
void RegisterENIPTCPParsers(void)
Function to register the ENIP protocol parsers and other functions.
int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes)
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
#define APP_LAYER_PARSER_OPT_UNIDIR_TXS
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
#define APP_LAYER_PARSER_EOF_TC
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
void ENIPParserRegisterTests(void)
int RunmodeIsUnittests(void)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
#define BYTE_LITTLE_ENDIAN
const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table)
Maps an enum value to a string name, from the supplied table.
#define SCReturnStruct(x)
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void StreamTcpFreeConfig(bool quiet)
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
void RegisterENIPUDPParsers(void)
Function to register the ENIP protocol parsers and other functions.
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define UNSUPPORTED_PROT_REV
struct ENIPEncapHdr_ ENIPEncapHdr
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
uint64_t tx_with_detect_state_cnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
@ SC_ERR_INVALID_ENUM_MAP
int AppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
AppProto alproto
application level protocol
#define UNREGISTER_SESSION