suricata
detect-cipservice.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  */
23 
24 #ifndef _DETECT_CIPSERVICE_H
25 #define _DETECT_CIPSERVICE_H
26 
27 #include "app-layer-protos.h"
28 #include "app-layer-parser.h"
29 #include "flow.h"
30 #include "queue.h"
31 #include "app-layer-enip-common.h"
32 
33 #define ENIP_PORT 44818 //standard EtherNet/IP port
34 
35 /**
36  * CIP Service rule data structure
37  */
38 typedef struct DetectCipServiceData_
39 {
40  uint8_t cipservice; /* cip service type */
41  uint16_t cipclass;
42  uint16_t cipattribute;
43  uint8_t matchattribute; /* whether to match on attribute*/
44  uint8_t tokens; /* number of parameters*/
46 
47 /**
48  * ENIP Command rule data structure
49  */
50 typedef struct DetectEnipCommandData_
51 {
52  uint16_t enipcommand; /* enip command */
54 
55 void DetectCipServiceRegister(void);
56 void DetectEnipCommandRegister(void);
57 
58 /**
59  * link list node for storing CIP service data
60  */
61 typedef struct CIPServiceData_
62 {
63  uint8_t service; //cip service
64  union
65  {
66  struct
67  {
68  uint8_t path_size; //cip path size
69  uint16_t path_offset; //offset to cip path
70  } request;
71  struct
72  {
73  uint8_t status;
74  } response;
75  };
78 
79 /**
80  * ENIP data structure
81  */
82 typedef struct ENIPData_
83 {
84  int direction;
85  ENIPEncapHdr header; //encapsulation header
86  ENIPEncapDataHdr encap_data_header; //encapsulation data header
87  ENIPEncapAddresItem encap_addr_item; //encapsulated address item
88  ENIPEncapDataItem encap_data_item; //encapsulated data item
89 
90  CIPServiceData* service_head; //head of cip service data list
91  CIPServiceData* service_tail; //tail of cip service data list
92 
93 } ENIPData;
94 
95 #endif /* _DETECT_CIPSERVICE_H */
DetectCipServiceData_::matchattribute
uint8_t matchattribute
Definition: detect-cipservice.h:43
ENIPData
struct ENIPData_ ENIPData
DetectCipServiceData_::tokens
uint8_t tokens
Definition: detect-cipservice.h:44
ENIPData_::encap_data_item
ENIPEncapDataItem encap_data_item
Definition: detect-cipservice.h:88
DetectCipServiceRegister
void DetectCipServiceRegister(void)
Registration function for cip_service: keyword.
Definition: detect-cipservice.c:50
ENIPData_::header
ENIPEncapHdr header
Definition: detect-cipservice.h:85
CIPServiceData_::path_offset
uint16_t path_offset
Definition: detect-cipservice.h:69
ENIPData_::direction
int direction
Definition: detect-cipservice.h:84
CIPServiceData_::service
uint8_t service
Definition: detect-cipservice.h:63
CIPServiceData_::next
struct CIPServiceData * next
Definition: detect-cipservice.h:76
ENIPData_
Definition: detect-cipservice.h:82
CIPServiceData_::request
struct CIPServiceData_::@64::@66 request
CIPServiceData_::path_size
uint8_t path_size
Definition: detect-cipservice.h:68
DetectCipServiceData_::cipservice
uint8_t cipservice
Definition: detect-cipservice.h:40
CIPServiceData_::status
uint8_t status
Definition: detect-cipservice.h:73
DetectEnipCommandData_::enipcommand
uint16_t enipcommand
Definition: detect-cipservice.h:52
ENIPData_::service_tail
CIPServiceData * service_tail
Definition: detect-cipservice.h:91
ENIPData_::encap_data_header
ENIPEncapDataHdr encap_data_header
Definition: detect-cipservice.h:86
ENIPEncapHdr_
Definition: app-layer-enip-common.h:96
ENIPEncapAddresItem_
Definition: app-layer-enip-common.h:119
ENIPData_::service_head
CIPServiceData * service_head
Definition: detect-cipservice.h:90
app-layer-parser.h
DetectEnipCommandData_
Definition: detect-cipservice.h:50
queue.h
ENIPEncapDataHdr_
Definition: app-layer-enip-common.h:109
DetectEnipCommandData
struct DetectEnipCommandData_ DetectEnipCommandData
CIPServiceData
struct CIPServiceData_ CIPServiceData
CIPServiceData_
Definition: detect-cipservice.h:61
DetectEnipCommandRegister
void DetectEnipCommandRegister(void)
Registration function for enip_command: keyword.
Definition: detect-cipservice.c:305
app-layer-enip-common.h
ENIPEncapDataItem_
Definition: app-layer-enip-common.h:130
app-layer-protos.h
DetectCipServiceData_::cipattribute
uint16_t cipattribute
Definition: detect-cipservice.h:42
DetectCipServiceData_::cipclass
uint16_t cipclass
Definition: detect-cipservice.h:41
DetectCipServiceData_
Definition: detect-cipservice.h:38
flow.h
ENIPData_::encap_addr_item
ENIPEncapAddresItem encap_addr_item
Definition: detect-cipservice.h:87
CIPServiceData_::response
struct CIPServiceData_::@64::@67 response
DetectCipServiceData
struct DetectCipServiceData_ DetectCipServiceData