Go to the documentation of this file.
65 static int ENIPGetAlstateProgress(
void *tx, uint8_t direction)
76 static AppLayerStateData *ENIPGetStateData(
void *vstate)
82 static void *ENIPGetTx(
void *alstate, uint64_t tx_id)
91 if (tx->
tx_num != (tx_id+1))
101 static uint64_t ENIPGetTxCnt(
void *alstate)
103 return ((
ENIPState *)alstate)->transaction_max;
106 static int ENIPStateGetEventInfo(
const char *event_name,
int *event_id, AppLayerEventType *event_type)
110 if (*event_id == -1) {
112 "enip's enum map table.",
118 *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
123 static int ENIPStateGetEventInfoById(
int event_id,
const char **event_name,
124 AppLayerEventType *event_type)
127 if (*event_name == NULL) {
129 "enip's enum map table.",
135 *event_type = APP_LAYER_EVENT_TYPE_TRANSACTION;
144 static void *ENIPStateAlloc(
void *orig_state,
AppProto proto_orig)
190 if (tx->
tx_data.de_state != NULL) {
196 if (state->
iter == tx)
206 static void ENIPStateFree(
void *s)
218 ENIPTransactionFree(tx, enip_state);
221 if (enip_state->
buffer != NULL)
260 static void ENIPStateTransactionFree(
void *state, uint64_t tx_id)
269 if ((tx_id+1) < tx->
tx_num)
271 else if ((tx_id+1) > tx->
tx_num)
274 if (tx == enip_state->
curr)
275 enip_state->
curr = NULL;
277 if (tx->
tx_data.events != NULL) {
285 ENIPTransactionFree(tx, state);
302 StreamSlice stream_slice,
void *local_data, uint8_t direction)
308 const uint8_t *input = StreamSliceGetData(&stream_slice);
309 uint32_t input_len = StreamSliceGetDataLen(&stream_slice);
315 }
else if (input == NULL && input_len != 0) {
318 }
else if (input == NULL || input_len == 0)
323 while (input_len > 0)
325 tx = ENIPTransactionAlloc(enip);
329 if (direction == STREAM_TOCLIENT)
334 SCLogDebug(
"ENIPParse input len %d", input_len);
337 SCLogDebug(
"ENIPParse packet len %d", pkt_len);
338 if (pkt_len > input_len)
345 input_len -= pkt_len;
359 StreamSlice stream_slice,
void *local_data)
361 return ENIPParse(f, state, pstate, stream_slice, local_data, STREAM_TOSERVER);
365 StreamSlice stream_slice,
void *local_data)
367 return ENIPParse(f, state, pstate, stream_slice, local_data, STREAM_TOCLIENT);
370 #define ENIP_LEN_REGISTER_SESSION 4 // protocol u16, options u16
372 static uint16_t ENIPProbingParser(
Flow *f, uint8_t direction,
373 const uint8_t *input, uint32_t input_len, uint8_t *rdir)
378 SCLogDebug(
"length too small to be a ENIP header");
447 SCLogDebug(
"length too small to be a ENIP LIST_INTERFACES");
455 if (enip_len <
sizeof(
ENIPEncapHdr) + 2 * (
size_t)nbitems) {
465 static AppLayerGetTxIterTuple ENIPGetTxIterator(
const uint8_t ipproto,
const AppProto alproto,
469 AppLayerGetTxIterTuple no_tuple = { NULL, 0,
false };
472 if (state->
un.
ptr == NULL) {
478 while (tx_ptr->
tx_num < min_tx_id + 1) {
484 if (tx_ptr->
tx_num >= max_tx_id + 1) {
488 AppLayerGetTxIterTuple tuple = {
491 .has_next = (state->
un.
ptr != NULL),
505 const char *proto_name =
"enip";
513 0,
sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
516 0,
sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
522 ENIPProbingParser, ENIPProbingParser))
525 "no ENIP UDP config found enabling ENIP detection on port 44818.");
529 ENIPProbingParser, NULL);
533 ENIPProbingParser, NULL);
538 SCLogConfig(
"Protocol detection and parser disabled for %s protocol.",
549 ENIPStateAlloc, ENIPStateFree);
565 IPPROTO_UDP,
ALPROTO_ENIP, STREAM_TOSERVER | STREAM_TOCLIENT);
569 "Parsed disabled for %s protocol. Protocol detection" "still on.",
586 const char *proto_name =
"enip";
594 0,
sizeof(
ENIPEncapHdr), STREAM_TOSERVER, ENIPProbingParser, NULL);
597 0,
sizeof(
ENIPEncapHdr), STREAM_TOCLIENT, ENIPProbingParser, NULL);
603 ENIPProbingParser, ENIPProbingParser))
610 SCLogDebug(
"Protocol detection and parser disabled for %s protocol.",
620 ENIPStateAlloc, ENIPStateFree);
644 SCLogConfig(
"Parser disabled for %s protocol. Protocol detection still on.",
660 static uint8_t listIdentity[] = { 0x63, 0x00,
662 0x00, 0x00, 0x00, 0x00,
663 0x00, 0x00, 0x00, 0x00,
665 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
666 0x00, 0x00, 0x00, 0x00, 0x00};
671 static int ALDecodeENIPTest(
void)
677 memset(&f, 0,
sizeof(f));
678 memset(&ssn, 0,
sizeof(ssn));
681 f.
proto = IPPROTO_TCP;
687 listIdentity,
sizeof(listIdentity));
void AppLayerParserRegisterGetStateProgressFunc(uint8_t ipproto, AppProto alproto, int(*StateGetProgress)(void *alstate, uint8_t direction))
int AppLayerProtoDetectPPParseConfPorts(const char *ipproto_name, uint8_t ipproto, const char *alproto_name, AppProto alproto, uint16_t min_depth, uint16_t max_depth, ProbingParserFPtr ProbingParserTs, ProbingParserFPtr ProbingParserTc)
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
union AppLayerGetTxIterState::@15 un
SCEnumCharMap enip_decoder_event_table[]
void AppLayerParserRegisterOptionFlags(uint8_t ipproto, AppProto alproto, uint32_t flags)
int ByteExtractUint16(uint16_t *res, int e, uint16_t len, const uint8_t *bytes)
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Per flow ENIP state container.
AppLayerStateData state_data
struct HtpBodyChunk_ * next
int DecodeENIPPDU(const uint8_t *input, uint32_t input_len, ENIPTransaction *enip_data)
Decode ENIP Encapsulation Header.
int AppLayerParserConfParserEnabled(const char *ipproto, const char *alproto_name)
check if a parser is enabled in the config Returns enabled always if: were running unittests
void AppLayerParserRegisterStateProgressCompletionStatus(AppProto alproto, const int ts, const int tc)
#define ENIP_LEN_REGISTER_SESSION
void AppLayerParserRegisterParserAcceptableDataDirection(uint8_t ipproto, AppProto alproto, uint8_t direction)
void AppLayerParserRegisterTxFreeFunc(uint8_t ipproto, AppProto alproto, void(*StateTransactionFree)(void *, uint64_t))
#define TAILQ_FOREACH(var, head, field)
#define APP_LAYER_TX_SKIP_INSPECT_FLAG
void AppLayerParserThreadCtxFree(AppLayerParserThreadCtx *tctx)
Destroys the app layer parser thread context obtained using AppLayerParserThreadCtxAlloc().
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
#define TAILQ_INSERT_TAIL(head, elm, field)
#define APP_LAYER_PARSER_EOF_TS
void AppLayerProtoDetectPPRegister(uint8_t ipproto, const char *portstr, AppProto alproto, uint16_t min_depth, uint16_t max_depth, uint8_t direction, ProbingParserFPtr ProbingParser1, ProbingParserFPtr ProbingParser2)
register parser at a port
void StreamTcpInitConfig(bool)
To initialize the stream global configuration data.
#define TAILQ_REMOVE(head, elm, field)
#define TAILQ_FIRST(head)
#define PASS
Pass the test.
#define ENCAP_HEADER_ERROR
AppLayerParserThreadCtx * alp_tctx
void RegisterENIPTCPParsers(void)
Function to register the ENIP protocol parsers and other functions.
int ByteExtractUint32(uint32_t *res, int e, uint16_t len, const uint8_t *bytes)
void AppLayerParserRegisterStateFuncs(uint8_t ipproto, AppProto alproto, void *(*StateAlloc)(void *, AppProto), void(*StateFree)(void *))
void AppLayerParserRegisterProtocolUnittests(uint8_t ipproto, AppProto alproto, void(*RegisterUnittests)(void))
#define APP_LAYER_PARSER_EOF_TC
void AppLayerParserRegisterGetEventInfo(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfo)(const char *event_name, int *event_id, AppLayerEventType *event_type))
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
void ENIPParserRegisterTests(void)
int RunmodeIsUnittests(void)
#define SCLogInfo(...)
Macro used to log INFORMATIONAL messages.
int AppLayerParserRegisterParser(uint8_t ipproto, AppProto alproto, uint8_t direction, AppLayerParserFPtr Parser)
Register app layer parser for the protocol.
void DetectEngineStateFree(DetectEngineState *state)
Frees a DetectEngineState object.
AppLayerParserThreadCtx * AppLayerParserThreadCtxAlloc(void)
Gets a new app layer protocol's parser thread context.
void AppLayerParserRegisterGetTx(uint8_t ipproto, AppProto alproto, void *(StateGetTx)(void *alstate, uint64_t tx_id))
struct AppLayerTxData AppLayerTxData
#define BYTE_LITTLE_ENDIAN
const char * SCMapEnumValueToName(int enum_value, SCEnumCharMap *table)
Maps an enum value to a string name, from the supplied table.
#define SCReturnStruct(x)
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
void StreamTcpFreeConfig(bool quiet)
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
int AppLayerParserParse(ThreadVars *tv, AppLayerParserThreadCtx *alp_tctx, Flow *f, AppProto alproto, uint8_t flags, const uint8_t *input, uint32_t input_len)
#define TAILQ_NEXT(elm, field)
void RegisterENIPUDPParsers(void)
Function to register the ENIP protocol parsers and other functions.
void AppLayerParserRegisterStateDataFunc(uint8_t ipproto, AppProto alproto, AppLayerStateData *(*GetStateData)(void *state))
void AppLayerParserRegisterTxDataFunc(uint8_t ipproto, AppProto alproto, AppLayerTxData *(*GetTxData)(void *tx))
struct SCLogConfig_ SCLogConfig
Holds the config state used by the logging api.
#define APP_LAYER_PARSER_OPT_ACCEPT_GAPS
void AppLayerParserRegisterGetTxIterator(uint8_t ipproto, AppProto alproto, AppLayerGetTxIteratorFunc Func)
#define UNSUPPORTED_PROT_REV
#define SCLogError(...)
Macro used to log ERROR messages.
struct ENIPEncapHdr_ ENIPEncapHdr
void AppLayerParserRegisterGetEventInfoById(uint8_t ipproto, AppProto alproto, int(*StateGetEventInfoById)(int event_id, const char **event_name, AppLayerEventType *event_type))
uint64_t tx_with_detect_state_cnt
void AppLayerParserRegisterGetTxCnt(uint8_t ipproto, AppProto alproto, uint64_t(*StateGetTxCnt)(void *alstate))
int AppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
uint16_t AppLayerParserStateIssetFlag(AppLayerParserState *pstate, uint16_t flag)
AppProto alproto
application level protocol
#define UNREGISTER_SESSION