suricata
app-layer-enip.c
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  *
23  * App-layer parser for ENIP protocol
24  *
25  */
26 
27 #include "suricata-common.h"
28 
29 #include "util-debug.h"
30 #include "util-byte.h"
31 #include "util-enum.h"
32 #include "util-mem.h"
33 #include "util-misc.h"
34 
35 #include "stream.h"
36 
37 #include "app-layer-protos.h"
38 #include "app-layer-parser.h"
39 #include "app-layer-enip.h"
40 #include "app-layer-enip-common.h"
41 
42 #include "app-layer-detect-proto.h"
43 
44 #include "conf.h"
45 #include "decode.h"
46 
47 #include "detect-parse.h"
48 #include "detect-engine.h"
49 #include "util-byte.h"
50 #include "util-unittest.h"
51 #include "util-unittest-helper.h"
52 #include "pkt-var.h"
53 #include "util-profiling.h"
54 
55 
57  { NULL, -1 },
58 };
59 
60 /** \brief get value for 'complete' status in ENIP
61  *
62  * For ENIP we use a simple bool.
63  */
64 static int ENIPGetAlstateProgress(void *tx, uint8_t direction)
65 {
66  return 1;
67 }
68 
69 /** \brief get value for 'complete' status in ENIP
70  *
71  * For ENIP we use a simple bool.
72  */
73 static int ENIPGetAlstateProgressCompletionStatus(uint8_t direction)
74 {
75  return 1;
76 }
77 
78 static DetectEngineState *ENIPGetTxDetectState(void *vtx)
79 {
80  ENIPTransaction *tx = (ENIPTransaction *)vtx;
81  return tx->de_state;
82 }
83 
84 static int ENIPSetTxDetectState(void *vtx, DetectEngineState *s)
85 {
86  ENIPTransaction *tx = (ENIPTransaction *)vtx;
87  tx->de_state = s;
88  return 0;
89 }
90 
91 static uint64_t ENIPGetTxDetectFlags(void *vtx, uint8_t dir)
92 {
93  ENIPTransaction *tx = (ENIPTransaction *)vtx;
94  if (dir & STREAM_TOSERVER) {
95  return tx->detect_flags_ts;
96  } else {
97  return tx->detect_flags_tc;
98  }
99 }
100 
101 static void ENIPSetTxDetectFlags(void *vtx, uint8_t dir, uint64_t flags)
102 {
103  ENIPTransaction *tx = (ENIPTransaction *)vtx;
104  if (dir &STREAM_TOSERVER) {
105  tx->detect_flags_ts = flags;
106  } else {
107  tx->detect_flags_tc = flags;
108  }
109 }
110 
111 static void *ENIPGetTx(void *alstate, uint64_t tx_id)
112 {
113  ENIPState *enip = (ENIPState *) alstate;
114  ENIPTransaction *tx = NULL;
115 
116  if (enip->curr && enip->curr->tx_num == tx_id + 1)
117  return enip->curr;
118 
119  TAILQ_FOREACH(tx, &enip->tx_list, next) {
120  if (tx->tx_num != (tx_id+1))
121  continue;
122 
123  SCLogDebug("returning tx %p", tx);
124  return tx;
125  }
126 
127  return NULL;
128 }
129 
130 static uint64_t ENIPGetTxCnt(void *alstate)
131 {
132  return ((uint64_t) ((ENIPState *) alstate)->transaction_max);
133 }
134 
135 static AppLayerDecoderEvents *ENIPGetEvents(void *tx)
136 {
137  return ((ENIPTransaction *)tx)->decoder_events;
138 }
139 
140 static int ENIPStateGetEventInfo(const char *event_name, int *event_id, AppLayerEventType *event_type)
141 {
142  *event_id = SCMapEnumNameToValue(event_name, enip_decoder_event_table);
143 
144  if (*event_id == -1) {
145  SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in "
146  "enip's enum map table.", event_name);
147  /* yes this is fatal */
148  return -1;
149  }
150 
151  *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
152 
153  return 0;
154 }
155 
156 static int ENIPStateGetEventInfoById(int event_id, const char **event_name,
157  AppLayerEventType *event_type)
158 {
159  *event_name = SCMapEnumValueToName(event_id, enip_decoder_event_table);
160  if (*event_name == NULL) {
161  SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%d\" not present in "
162  "enip's enum map table.", event_id);
163  /* yes this is fatal */
164  return -1;
165  }
166 
167  *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
168 
169  return 0;
170 }
171 
172 /** \brief Allocate enip state
173  *
174  * return state
175  */
176 static void *ENIPStateAlloc(void)
177 {
178  SCLogDebug("ENIPStateAlloc");
179  void *s = SCMalloc(sizeof(ENIPState));
180  if (unlikely(s == NULL))
181  return NULL;
182 
183  memset(s, 0, sizeof(ENIPState));
184 
185  ENIPState *enip_state = (ENIPState *) s;
186 
187  TAILQ_INIT(&enip_state->tx_list);
188  return s;
189 }
190 
191 /** \internal
192  * \brief Free a ENIP TX
193  * \param tx ENIP TX to free */
194 static void ENIPTransactionFree(ENIPTransaction *tx, ENIPState *state)
195 {
196  SCEnter();
197  SCLogDebug("ENIPTransactionFree");
198  CIPServiceEntry *svc = NULL;
199  while ((svc = TAILQ_FIRST(&tx->service_list)))
200  {
201  TAILQ_REMOVE(&tx->service_list, svc, next);
202 
203  SegmentEntry *seg = NULL;
204  while ((seg = TAILQ_FIRST(&svc->segment_list)))
205  {
206  TAILQ_REMOVE(&svc->segment_list, seg, next);
207  SCFree(seg);
208  }
209 
210  AttributeEntry *attr = NULL;
211  while ((attr = TAILQ_FIRST(&svc->attrib_list)))
212  {
213  TAILQ_REMOVE(&svc->attrib_list, attr, next);
214  SCFree(attr);
215  }
216 
217  SCFree(svc);
218  }
219 
221 
222  if (tx->de_state != NULL)
223  {
225 
226  state->tx_with_detect_state_cnt--;
227  }
228 
229  if (state->iter == tx)
230  state->iter = NULL;
231 
232  SCFree(tx);
233  SCReturn;
234 }
235 
236 /** \brief Free enip state
237  *
238  */
239 static void ENIPStateFree(void *s)
240 {
241  SCEnter();
242  SCLogDebug("ENIPStateFree");
243  if (s)
244  {
245  ENIPState *enip_state = (ENIPState *) s;
246 
247  ENIPTransaction *tx = NULL;
248  while ((tx = TAILQ_FIRST(&enip_state->tx_list)))
249  {
250  TAILQ_REMOVE(&enip_state->tx_list, tx, next);
251  ENIPTransactionFree(tx, enip_state);
252  }
253 
254  if (enip_state->buffer != NULL)
255  {
256  SCFree(enip_state->buffer);
257  }
258 
259  SCFree(s);
260  }
261  SCReturn;
262 }
263 
264 /** \internal
265  * \brief Allocate a ENIP TX
266  * \retval tx or NULL */
267 static ENIPTransaction *ENIPTransactionAlloc(ENIPState *state)
268 {
269  SCLogDebug("ENIPStateTransactionAlloc");
271  sizeof(ENIPTransaction));
272  if (unlikely(tx == NULL))
273  return NULL;
274 
275  state->curr = tx;
276  state->transaction_max++;
277 
278  memset(tx, 0x00, sizeof(ENIPTransaction));
279  TAILQ_INIT(&tx->service_list);
280 
281  tx->enip = state;
282  tx->tx_num = state->transaction_max;
283  tx->service_count = 0;
284 
285  TAILQ_INSERT_TAIL(&state->tx_list, tx, next);
286 
287  return tx;
288 }
289 
290 /**
291  * \brief enip transaction cleanup callback
292  */
293 static void ENIPStateTransactionFree(void *state, uint64_t tx_id)
294 {
295  SCEnter();
296  SCLogDebug("ENIPStateTransactionFree");
297  ENIPState *enip_state = state;
298  ENIPTransaction *tx = NULL;
299  TAILQ_FOREACH(tx, &enip_state->tx_list, next)
300  {
301 
302  if ((tx_id+1) < tx->tx_num)
303  break;
304  else if ((tx_id+1) > tx->tx_num)
305  continue;
306 
307  if (tx == enip_state->curr)
308  enip_state->curr = NULL;
309 
310  if (tx->decoder_events != NULL)
311  {
312  if (tx->decoder_events->cnt <= enip_state->events)
313  enip_state->events -= tx->decoder_events->cnt;
314  else
315  enip_state->events = 0;
316  }
317 
318  TAILQ_REMOVE(&enip_state->tx_list, tx, next);
319  ENIPTransactionFree(tx, state);
320  break;
321  }
322  SCReturn;
323 }
324 
325 /** \internal
326  *
327  * \brief This function is called to retrieve a ENIP
328  *
329  * \param state ENIP state structure for the parser
330  * \param input Input line of the command
331  * \param input_len Length of the request
332  *
333  * \retval 1 when the command is parsed, 0 otherwise
334  */
335 static AppLayerResult ENIPParse(Flow *f, void *state, AppLayerParserState *pstate,
336  const uint8_t *input, uint32_t input_len, void *local_data,
337  const uint8_t flags)
338 {
339  SCEnter();
340  ENIPState *enip = (ENIPState *) state;
341  ENIPTransaction *tx;
342 
343  if (input == NULL && AppLayerParserStateIssetFlag(pstate,
345  {
347  } else if (input == NULL && input_len != 0) {
348  // GAP
350  } else if (input == NULL || input_len == 0)
351  {
353  }
354 
355  while (input_len > 0)
356  {
357  tx = ENIPTransactionAlloc(enip);
358  if (tx == NULL)
360 
361  SCLogDebug("ENIPParse input len %d", input_len);
362  DecodeENIPPDU(input, input_len, tx);
363  uint32_t pkt_len = tx->header.length + sizeof(ENIPEncapHdr);
364  SCLogDebug("ENIPParse packet len %d", pkt_len);
365  if (pkt_len > input_len)
366  {
367  SCLogDebug("Invalid packet length");
368  break;
369  }
370 
371  input += pkt_len;
372  input_len -= pkt_len;
373  //SCLogDebug("remaining %d", input_len);
374 
375  if (input_len < sizeof(ENIPEncapHdr))
376  {
377  //SCLogDebug("Not enough data"); //not enough data for ENIP
378  break;
379  }
380  }
381 
383 }
384 
385 
386 
387 static uint16_t ENIPProbingParser(Flow *f, uint8_t direction,
388  const uint8_t *input, uint32_t input_len, uint8_t *rdir)
389 {
390  // SCLogDebug("ENIPProbingParser %d", input_len);
391  if (input_len < sizeof(ENIPEncapHdr))
392  {
393  SCLogDebug("length too small to be a ENIP header");
394  return ALPROTO_UNKNOWN;
395  }
396  uint16_t cmd;
397  int ret = ByteExtractUint16(&cmd, BYTE_LITTLE_ENDIAN, sizeof(uint16_t),
398  (const uint8_t *) (input));
399  if(ret < 0) {
400  return ALPROTO_FAILED;
401  }
402  //ok for all the known commands
403  switch(cmd) {
404  case NOP:
405  case LIST_SERVICES:
406  case LIST_IDENTITY:
407  case LIST_INTERFACES:
408  case REGISTER_SESSION:
409  case UNREGISTER_SESSION:
410  case SEND_RR_DATA:
411  case SEND_UNIT_DATA:
412  case INDICATE_STATUS:
413  case CANCEL:
414  return ALPROTO_ENIP;
415  }
416  return ALPROTO_FAILED;
417 }
418 
419 /**
420  * \brief Function to register the ENIP protocol parsers and other functions
421  */
423 {
424  SCEnter();
425  const char *proto_name = "enip";
426 
427  if (AppLayerProtoDetectConfProtoDetectionEnabled("udp", proto_name))
428  {
430 
431  if (RunmodeIsUnittests())
432  {
433  AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818", ALPROTO_ENIP,
434  0, sizeof(ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
435 
436  AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818", ALPROTO_ENIP,
437  0, sizeof(ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
438 
439  } else
440  {
441  if (!AppLayerProtoDetectPPParseConfPorts("udp", IPPROTO_UDP,
442  proto_name, ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr),
443  ENIPProbingParser, ENIPProbingParser))
444  {
445  SCLogDebug(
446  "no ENIP UDP config found enabling ENIP detection on port 44818.");
447 
448  AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818",
450  ENIPProbingParser, NULL);
451 
452  AppLayerProtoDetectPPRegister(IPPROTO_UDP, "44818",
454  ENIPProbingParser, NULL);
455  }
456  }
457 
458  } else
459  {
460  SCLogConfig("Protocol detection and parser disabled for %s protocol.",
461  proto_name);
462  return;
463  }
464 
465  if (AppLayerParserConfParserEnabled("udp", proto_name))
466  {
468  STREAM_TOSERVER, ENIPParse);
470  STREAM_TOCLIENT, ENIPParse);
471 
473  ENIPStateAlloc, ENIPStateFree);
474 
475  AppLayerParserRegisterGetEventsFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetEvents);
476 
478  ENIPGetTxDetectState, ENIPSetTxDetectState);
479 
480  AppLayerParserRegisterGetTx(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetTx);
481  AppLayerParserRegisterGetTxCnt(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetTxCnt);
482  AppLayerParserRegisterTxFreeFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateTransactionFree);
483 
484  AppLayerParserRegisterGetStateProgressFunc(IPPROTO_UDP, ALPROTO_ENIP, ENIPGetAlstateProgress);
485  AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_ENIP, ENIPGetAlstateProgressCompletionStatus);
486 
487  AppLayerParserRegisterGetEventInfo(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateGetEventInfo);
488  AppLayerParserRegisterGetEventInfoById(IPPROTO_UDP, ALPROTO_ENIP, ENIPStateGetEventInfoById);
489 
493  ENIPGetTxDetectFlags, ENIPSetTxDetectFlags);
494 
495  } else
496  {
497  SCLogInfo(
498  "Parsed disabled for %s protocol. Protocol detection" "still on.",
499  proto_name);
500  }
501 
502 #ifdef UNITTESTS
504 #endif
505 
506  SCReturn;
507 }
508 
509 /**
510  * \brief Function to register the ENIP protocol parsers and other functions
511  */
513 {
514  SCEnter();
515  const char *proto_name = "enip";
516 
517  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name))
518  {
520 
521  if (RunmodeIsUnittests())
522  {
523  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "44818", ALPROTO_ENIP,
524  0, sizeof(ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
525 
526  AppLayerProtoDetectPPRegister(IPPROTO_TCP, "44818", ALPROTO_ENIP,
527  0, sizeof(ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
528 
529  } else
530  {
531  if (!AppLayerProtoDetectPPParseConfPorts("tcp", IPPROTO_TCP,
532  proto_name, ALPROTO_ENIP, 0, sizeof(ENIPEncapHdr),
533  ENIPProbingParser, ENIPProbingParser))
534  {
535  return;
536  }
537  }
538 
539  } else
540  {
541  SCLogDebug("Protocol detection and parser disabled for %s protocol.",
542  proto_name);
543  return;
544  }
545 
546  if (AppLayerParserConfParserEnabled("tcp", proto_name))
547  {
549  STREAM_TOSERVER, ENIPParse);
551  STREAM_TOCLIENT, ENIPParse);
553  ENIPStateAlloc, ENIPStateFree);
554 
555  AppLayerParserRegisterGetEventsFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetEvents);
556 
558  ENIPGetTxDetectState, ENIPSetTxDetectState);
559 
560  AppLayerParserRegisterGetTx(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetTx);
561  AppLayerParserRegisterGetTxCnt(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetTxCnt);
562  AppLayerParserRegisterTxFreeFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPStateTransactionFree);
563 
564  AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_ENIP, ENIPGetAlstateProgress);
565  AppLayerParserRegisterGetStateProgressCompletionStatus(ALPROTO_ENIP, ENIPGetAlstateProgressCompletionStatus);
566 
567  AppLayerParserRegisterGetEventInfo(IPPROTO_TCP, ALPROTO_ENIP, ENIPStateGetEventInfo);
568 
571 
572  /* This parser accepts gaps. */
576  ENIPGetTxDetectFlags, ENIPSetTxDetectFlags);
577 
578  } else
579  {
580  SCLogConfig("Parser disabled for %s protocol. Protocol detection still on.",
581  proto_name);
582  }
583 
584 #ifdef UNITTESTS
586 #endif
587 
588  SCReturn;
589 }
590 
591 /* UNITTESTS */
592 #ifdef UNITTESTS
593 #include "app-layer-parser.h"
594 #include "detect-parse.h"
595 #include "detect-engine.h"
596 #include "flow-util.h"
597 #include "stream-tcp.h"
598 #include "util-unittest.h"
599 #include "util-unittest-helper.h"
600 
601 static uint8_t listIdentity[] = {/* List ID */ 0x63, 0x00,
602  /* Length */ 0x00, 0x00,
603  /* Session */ 0x00, 0x00, 0x00, 0x00,
604  /* Status */ 0x00, 0x00, 0x00, 0x00,
605  /* Delay*/ 0x00,
606  /* Context */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
607  /* Quantity of coils */ 0x00, 0x00, 0x00, 0x00, 0x00};
608 
609 /**
610  * \brief Test if ENIP Packet matches signature
611  */
612 static int ALDecodeENIPTest(void)
613 {
615  Flow f;
616  TcpSession ssn;
617 
618  memset(&f, 0, sizeof(f));
619  memset(&ssn, 0, sizeof(ssn));
620 
621  f.protoctx = (void *)&ssn;
622  f.proto = IPPROTO_TCP;
623  f.alproto = ALPROTO_ENIP;
624 
626 
628  listIdentity, sizeof(listIdentity));
629  FAIL_IF(r != 0);
630 
631  ENIPState *enip_state = f.alstate;
632  FAIL_IF_NULL(enip_state);
633 
634  ENIPTransaction *tx = ENIPGetTx(enip_state, 0);
635  FAIL_IF_NULL(tx);
636 
637  FAIL_IF(tx->header.command != 99);
638 
641  FLOW_DESTROY(&f);
642 
643  PASS;
644 }
645 
646 #endif /* UNITTESTS */
647 
649 {
650 #ifdef UNITTESTS
651  UtRegisterTest("ALDecodeENIPTest", ALDecodeENIPTest);
652 #endif /* UNITTESTS */
653 }
util-byte.h
SEND_RR_DATA
#define SEND_RR_DATA
Definition: app-layer-enip-common.h:41
AppLayerParserRegisterGetStateProgressFunc
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
Definition: app-layer-parser.c:490
AppLayerProtoDetectPPParseConfPorts
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
Definition: app-layer-detect-proto.c:1645
LIST_SERVICES
#define LIST_SERVICES
Definition: app-layer-enip-common.h:36
detect-engine.h
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
SegmentEntry_
Definition: app-layer-enip-common.h:158
enip_decoder_event_table
SCEnumCharMap enip_decoder_event_table[]
Definition: app-layer-enip.c:56
AppLayerParserRegisterOptionFlags
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
Definition: app-layer-parser.c:387
TAILQ_INIT
#define TAILQ_INIT(head)
Definition: queue.h:370
ByteExtractUint16
int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes)
Definition: util-byte.c:164
flow-util.h
AppLayerParserRegisterStateFuncs
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void), void(*StateFree)(void *))
Definition: app-layer-parser.c:397
DetectEngineState_
Definition: detect-engine-state.h:92
stream-tcp.h
ALPROTO_ENIP
@ ALPROTO_ENIP
Definition: app-layer-protos.h:43
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ENIPState_
Per flow ENIP state container.
Definition: app-layer-enip-common.h:219
ENIPState_::events
uint16_t events
Definition: app-layer-enip-common.h:226
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
SEND_UNIT_DATA
#define SEND_UNIT_DATA
Definition: app-layer-enip-common.h:42
next
struct HtpBodyChunk_ * next
Definition: app-layer-htp.h:0
AppLayerParserRegisterDetectFlagsFuncs
void AppLayerParserRegisterDetectFlagsFuncs(uint8_t ipproto, AppProto alproto, uint64_t(*GetTxDetectFlags)(void *tx, uint8_t dir), void(*SetTxDetectFlags)(void *tx, uint8_t dir, uint64_t))
Definition: app-layer-parser.c:589
DecodeENIPPDU
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
Definition: app-layer-enip-common.c:185
Flow_::proto
uint8_t proto
Definition: flow.h:361
AppLayerParserConfParserEnabled
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
Definition: app-layer-parser.c:302
Flow_
Flow data structure.
Definition: flow.h:343
AppLayerEventType
enum AppLayerEventType_ AppLayerEventType
AppLayerParserRegisterGetEventsFunc
void AppLayerParserRegisterGetEventsFunc(uint8_t ipproto, AppProto alproto, AppLayerDecoderEvents *(*StateGetEvents)(void *))
Definition: app-layer-parser.c:436
AppLayerParserRegisterParserAcceptableDataDirection
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
Definition: app-layer-parser.c:376
AppLayerParserRegisterTxFreeFunc
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
Definition: app-layer-parser.c:501
TAILQ_FOREACH
#define TAILQ_FOREACH(var, head, field)
Definition: queue.h:350
NOP
#define NOP
Definition: app-layer-enip-common.h:35
AppLayerParserThreadCtxFree
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
Definition: app-layer-parser.c:279
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:148
AppLayerParserRegisterDetectStateFuncs
void AppLayerParserRegisterDetectStateFuncs(uint8_t ipproto, AppProto alproto, DetectEngineState *(*GetTxDetectState)(void *tx), int(*SetTxDetectState)(void *tx, DetectEngineState *))
Definition: app-layer-parser.c:577
ENIPTransaction_::tx_num
uint16_t tx_num
Definition: app-layer-enip-common.h:198
REGISTER_SESSION
#define REGISTER_SESSION
Definition: app-layer-enip-common.h:39
TAILQ_INSERT_TAIL
#define TAILQ_INSERT_TAIL(head, elm, field)
Definition: queue.h:385
LIST_INTERFACES
#define LIST_INTERFACES
Definition: app-layer-enip-common.h:38
LIST_IDENTITY
#define LIST_IDENTITY
Definition: app-layer-enip-common.h:37
CANCEL
#define CANCEL
Definition: app-layer-enip-common.h:44
Flow_::protoctx
void * protoctx
Definition: flow.h:416
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
util-unittest.h
ENIPEncapHdr_::command
uint16_t command
Definition: app-layer-enip-common.h:102
APP_LAYER_EVENT_TYPE_TRANSACTION
@ APP_LAYER_EVENT_TYPE_TRANSACTION
Definition: app-layer-events.h:57
AttributeEntry_
Definition: app-layer-enip-common.h:166
util-unittest-helper.h
CIPServiceEntry_
Definition: app-layer-enip-common.h:173
AppLayerProtoDetectPPRegister
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
Definition: app-layer-detect-proto.c:1611
app-layer-detect-proto.h
AppLayerParserStateIssetFlag
int AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint8_t flag)
Definition: app-layer-parser.c:1609
TAILQ_REMOVE
#define TAILQ_REMOVE(head, elm, field)
Definition: queue.h:412
decode.h
util-debug.h
TAILQ_FIRST
#define TAILQ_FIRST(head)
Definition: queue.h:339
AppLayerParserState_
Definition: app-layer-parser.c:155
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
ENIPTransaction_::enip
struct ENIPState_ * enip
Definition: app-layer-enip-common.h:197
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
alp_tctx
AppLayerParserThreadCtx * alp_tctx
Definition: fuzz_applayerparserparse.c:19
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
RegisterENIPTCPParsers
void RegisterENIPTCPParsers(void)
Function to register the ENIP protocol parsers and other functions.
Definition: app-layer-enip.c:512
pkt-var.h
ENIPTransaction_::detect_flags_tc
uint64_t detect_flags_tc
Definition: app-layer-enip-common.h:214
ENIPEncapHdr_
Definition: app-layer-enip-common.h:97
app-layer-parser.h
TRUE
#define TRUE
Definition: suricata-common.h:33
AppLayerDecoderEvents_::cnt
uint8_t cnt
Definition: app-layer-events.h:38
ENIPTransaction_::detect_flags_ts
uint64_t detect_flags_ts
Definition: app-layer-enip-common.h:213
util-profiling.h
SCReturn
#define SCReturn
Definition: util-debug.h:302
stream.h
AppLayerParserRegisterProtocolUnittests
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
Definition: app-layer-parser.c:1707
ENIPState_::buffer
uint8_t * buffer
Definition: app-layer-enip-common.h:232
StreamTcpFreeConfig
void StreamTcpFreeConfig(char quiet)
Definition: stream-tcp.c:669
conf.h
AppLayerParserRegisterGetEventInfo
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
Definition: app-layer-parser.c:565
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1826
APP_LAYER_PARSER_EOF
#define APP_LAYER_PARSER_EOF
Definition: app-layer-parser.h:35
ENIPParserRegisterTests
void ENIPParserRegisterTests(void)
Definition: app-layer-enip.c:648
RunmodeIsUnittests
int RunmodeIsUnittests(void)
Definition: suricata.c:264
INDICATE_STATUS
#define INDICATE_STATUS
Definition: app-layer-enip-common.h:43
SCLogInfo
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
Definition: util-debug.h:217
AppLayerParserRegisterParser
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
Definition: app-layer-parser.c:364
DetectEngineStateFree
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
Definition: detect-engine-state.c:175
AppLayerParserRegisterGetStateProgressCompletionStatus
void AppLayerParserRegisterGetStateProgressCompletionStatus(AppProto alproto, int(*StateGetProgressCompletionStatus)(uint8_t direction))
Definition: app-layer-parser.c:542
AppLayerParserThreadCtxAlloc
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
Definition: app-layer-parser.c:253
AppLayerParserRegisterGetTx
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
Definition: app-layer-parser.c:523
ENIPState_::iter
ENIPTransaction * iter
Definition: app-layer-enip-common.h:222
ENIPTransaction_
Definition: app-layer-enip-common.h:196
util-mem.h
APP_LAYER_OK
#define APP_LAYER_OK
Definition: app-layer-parser.h:56
BYTE_LITTLE_ENDIAN
#define BYTE_LITTLE_ENDIAN
Definition: util-byte.h:30
app-layer-enip.h
SCMapEnumValueToName
const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table)
Maps an enum value to a string name, from the supplied table.
Definition: util-enum.c:68
SCReturnStruct
#define SCReturnStruct(x)
Definition: util-debug.h:320
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
SCMapEnumNameToValue
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:40
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerParserParse
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
Definition: app-layer-parser.c:1171
suricata-common.h
SCEnumCharMap_
Definition: util-enum.h:27
STREAM_TOCLIENT
#define STREAM_TOCLIENT
Definition: stream.h:32
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
RegisterENIPUDPParsers
void RegisterENIPUDPParsers(void)
Function to register the ENIP protocol parsers and other functions.
Definition: app-layer-enip.c:422
ENIPState_::curr
ENIPTransaction * curr
Definition: app-layer-enip-common.h:221
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCLogConfig
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
ENIPTransaction_::decoder_events
AppLayerDecoderEvents * decoder_events
Definition: app-layer-enip-common.h:209
APP_LAYER_PARSER_OPT_ACCEPT_GAPS
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
Definition: app-layer-parser.h:42
ENIPTransaction_::de_state
DetectEngineState * de_state
Definition: app-layer-enip-common.h:212
SCFree
#define SCFree(p)
Definition: util-mem.h:61
ENIPTransaction_::service_count
uint16_t service_count
Definition: app-layer-enip-common.h:200
ENIPEncapHdr
struct ENIPEncapHdr_ ENIPEncapHdr
Flow_::alstate
void * alstate
Definition: flow.h:454
detect-parse.h
AppLayerParserRegisterGetEventInfoById
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
Definition: app-layer-parser.c:553
app-layer-enip-common.h
ENIPState_::tx_with_detect_state_cnt
uint64_t tx_with_detect_state_cnt
Definition: app-layer-enip-common.h:224
StreamTcpInitConfig
void StreamTcpInitConfig(char)
To initialize the stream global configuration data.
Definition: stream-tcp.c:365
ALPROTO_UNKNOWN
@ ALPROTO_UNKNOWN
Definition: app-layer-protos.h:29
ALPROTO_FAILED
@ ALPROTO_FAILED
Definition: app-layer-protos.h:61
ENIPEncapHdr_::length
uint16_t length
Definition: app-layer-enip-common.h:103
app-layer-protos.h
ENIPState_::transaction_max
uint64_t transaction_max
Definition: app-layer-enip-common.h:223
AppLayerParserRegisterGetTxCnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
Definition: app-layer-parser.c:512
APP_LAYER_ERROR
#define APP_LAYER_ERROR
Definition: app-layer-parser.h:60
SC_ERR_INVALID_ENUM_MAP
@ SC_ERR_INVALID_ENUM_MAP
Definition: util-error.h:45
AppLayerParserThreadCtx_
Definition: app-layer-parser.c:85
TcpSession_
Definition: stream-tcp-private.h:260
util-misc.h
Flow_::alproto
AppProto alproto
application level protocol
Definition: flow.h:425
ENIPTransaction_::header
ENIPEncapHdr header
Definition: app-layer-enip-common.h:202
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
util-enum.h
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1890
FLOW_DESTROY
#define FLOW_DESTROY(f)
Definition: flow-util.h:121
UNREGISTER_SESSION
#define UNREGISTER_SESSION
Definition: app-layer-enip-common.h:40