suricata
detect-cipservice.h
Go to the documentation of this file.
1 /* Copyright (C) 2015 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Kevin Wong <kwong@solananetworks.com>
22  */
23 
24 #ifndef _DETECT_CIPSERVICE_H
25 #define _DETECT_CIPSERVICE_H
26 
27 #include "app-layer-protos.h"
28 #include "app-layer-parser.h"
29 #include "flow.h"
30 #include "queue.h"
31 #include "app-layer-enip-common.h"
32 
33 #define ENIP_PORT 44818 //standard EtherNet/IP port
34 
35 /**
36  * CIP Service rule data structure
37  */
38 typedef struct DetectCipServiceData_
39 {
40  uint8_t cipservice; /* cip service type */
41  uint16_t cipclass;
42  uint16_t cipattribute;
43  uint8_t matchattribute; /* whether to match on attribute*/
44  uint8_t tokens; /* number of parameters*/
46 
47 /**
48  * ENIP Command rule data structure
49  */
50 typedef struct DetectEnipCommandData_
51 {
52  uint16_t enipcommand; /* enip command */
54 
55 void DetectCipServiceRegister(void);
56 void DetectEnipCommandRegister(void);
57 
58 /**
59  * link list node for storing CIP service data
60  */
61 typedef struct CIPServiceData_
62 {
63  uint8_t service; //cip service
64  union
65  {
66  struct
67  {
68  uint8_t path_size; //cip path size
69  uint16_t path_offset; //offset to cip path
70  } request;
71  struct
72  {
73  uint8_t status;
74  } response;
75  };
78 
79 /**
80  * ENIP data structure
81  */
82 typedef struct ENIPData_
83 {
84  int direction;
85  ENIPEncapHdr header; //encapsulation header
86  ENIPEncapDataHdr encap_data_header; //encapsulation data header
87  ENIPEncapAddresItem encap_addr_item; //encapsulated address item
88  ENIPEncapDataItem encap_data_item; //encapsulated data item
89 
90  CIPServiceData* service_head; //head of cip service data list
91  CIPServiceData* service_tail; //tail of cip service data list
92 
93 } ENIPData;
94 
95 #endif /* _DETECT_CIPSERVICE_H */
CIPServiceData * service_tail
ENIPEncapDataItem encap_data_item
ENIPEncapHdr header
struct CIPServiceData * next
ENIPEncapDataHdr encap_data_header
void DetectCipServiceRegister(void)
Registration function for cip_service: keyword.
struct DetectEnipCommandData_ DetectEnipCommandData
struct ENIPData_ ENIPData
CIPServiceData * service_head
struct DetectCipServiceData_ DetectCipServiceData
ENIPEncapAddresItem encap_addr_item
void DetectEnipCommandRegister(void)
Registration function for enip_command: keyword.
struct CIPServiceData_ CIPServiceData